neuron-technologies/neuron
3
0
Fork 0
Code Issues 23 Pull Requests Actions Packages Projects Releases Wiki Activity

self-review 2026-07-25: break curiosity positive-feedback loop; observability for WM regime

Browse Source 
proactive_curiosity strengthened its top result unconditionally every
scan — a positive-feedback fixed point that pinned auto_term on the same
node's first word for hours ('Fast-slow' era). Strengthen now fires only
when the top node changed since the last scan, and a 4-deep finst-style
tabu ring (ACT-R declarative finsts) hard-excludes recently used auto
terms (~2 min at the 30s cadence). Quoted-title guard stops '"The'
leaking through the >3-char stopword check and seeding lexical floods.

Heartbeat now pumps /api/embed-backfill?n=32 on the authoritative store
(its lazy backfill had no production trigger; coverage stalled at
93/12175) and emits wm_saturated, wm_top0_streak, embed_backfilled,
embed_count. Curiosity ISE emits auto_term_streak. The stuck-WM failure
mode is now a one-glance signal instead of manual ISE cross-referencing.
This commit is contained in:
Will Anderson
2026-07-25 08:45:22 -05:00
parent fb0bb553f3
commit 58a9eda311
2 changed files with 197 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files
awareness.el
+82 -3
View File
@@ -180,7 +180,40 @@ fn emit_heartbeat() -> Void {
// (2026-07-19 self-review) // (2026-07-19 self-review)
let sync_ok_raw: String = state_get("soul.last_sync_ok_ts") let sync_ok_raw: String = state_get("soul.last_sync_ok_ts")
let sync_age: Int = if str_eq(sync_ok_raw, "") { 0 - 1 } else { ts - str_to_int(sync_ok_raw) } let sync_age: Int = if str_eq(sync_ok_raw, "") { 0 - 1 } else { ts - str_to_int(sync_ok_raw) }
let payload: String = "{\"event\":\"heartbeat\",\"pulse\":" + pulse + ",\"tick\":" + pulse + ",\"boot\":" + boot + ",\"idle\":" + idle + ",\"node_count\":" + int_to_str(nc) + ",\"edge_count\":" + int_to_str(ec) + ",\"node_delta\":" + int_to_str(node_delta) + ",\"edge_delta\":" + int_to_str(edge_delta) + ",\"wm_active\":" + int_to_str(wmc) + ",\"wm_delta\":" + int_to_str(wm_delta) + ",\"sync_added_total\":" + sat_str + ",\"sync_age_ms\":" + int_to_str(sync_age) + ",\"wm_avg_weight\":" + wm_avg_str + ",\"wm_top\":" + wm_top + ",\"ts\":" + int_to_str(ts) + ",\"uptime_ms\":" + int_to_str(up_ms) + ",\"uptime\":\"" + up_human + "\",\"embed_ok\":" + int_to_str(emb_ok) + ",\"ise_fail\":" + fail_str + "}" // Embedding pump + real coverage (2026-07-25 self-review): the
// authoritative :8742 store's lazy backfill only runs inside
// engram_activate, and nothing calls /api/activate there in production —
// embedded_count stalled at 93/12175 after a restart from a snapshot
// without vectors. Pump up to 32 embeds per heartbeat via the new
// /api/embed-backfill route (route persists the snapshot when it embeds
// anything, so vectors survive the next restart; self-limiting once
// coverage is full) and surface the store's true coverage here.
// embed_ok alone is misleading — it pings the Ollama root, not the
// embed pipeline. embed_count=-1 means the route was unreachable.
// URL resolution mirrors ise_post: env -> state -> localhost constant.
let hb_env_url: String = env("SOUL_ISE_URL")
let hb_state_url: String = if str_eq(hb_env_url, "") { state_get("soul_engram_url") } else { hb_env_url }
let hb_engram_url: String = if str_eq(hb_state_url, "") { "http://localhost:8742" } else { hb_state_url }
let bf_resp: String = http_get(hb_engram_url + "/api/embed-backfill?n=32")
let bf_done_raw: String = json_get(bf_resp, "embedded")
let bf_done: String = if str_eq(bf_done_raw, "") { "-1" } else { bf_done_raw }
let bf_total_raw: String = json_get(bf_resp, "embedded_count")
let bf_total: String = if str_eq(bf_total_raw, "") { "-1" } else { bf_total_raw }
// WM regime observability (2026-07-25 self-review): the "same 2 nodes
// pinned at a saturated cap" failure took cross-referencing the ISE
// stream by hand to spot. Make it one-glance: wm_saturated flags the
// cap-pinned regime; wm_top0_streak counts consecutive heartbeats with
// the same node in WM slot 0 (state-tracked, same mechanism as wm_delta).
let wm_sat: Int = if wmc >= 24 { 1 } else { 0 }
let wm_top0: String = json_array_get(wm_top, 0)
let wm_top0_id: String = json_get(wm_top0, "id")
let prev_top0: String = state_get("soul.prev_wm_top0")
let t0streak_raw: String = state_get("soul.wm_top0_streak")
let t0streak_prev: Int = if str_eq(t0streak_raw, "") { 0 } else { str_to_int(t0streak_raw) }
let t0streak: Int = if str_eq(wm_top0_id, prev_top0) { t0streak_prev + 1 } else { 1 }
state_set("soul.prev_wm_top0", wm_top0_id)
state_set("soul.wm_top0_streak", int_to_str(t0streak))
let payload: String = "{\"event\":\"heartbeat\",\"pulse\":" + pulse + ",\"tick\":" + pulse + ",\"boot\":" + boot + ",\"idle\":" + idle + ",\"node_count\":" + int_to_str(nc) + ",\"edge_count\":" + int_to_str(ec) + ",\"node_delta\":" + int_to_str(node_delta) + ",\"edge_delta\":" + int_to_str(edge_delta) + ",\"wm_active\":" + int_to_str(wmc) + ",\"wm_delta\":" + int_to_str(wm_delta) + ",\"wm_saturated\":" + int_to_str(wm_sat) + ",\"wm_top0_streak\":" + int_to_str(t0streak) + ",\"sync_added_total\":" + sat_str + ",\"sync_age_ms\":" + int_to_str(sync_age) + ",\"wm_avg_weight\":" + wm_avg_str + ",\"wm_top\":" + wm_top + ",\"ts\":" + int_to_str(ts) + ",\"uptime_ms\":" + int_to_str(up_ms) + ",\"uptime\":\"" + up_human + "\",\"embed_ok\":" + int_to_str(emb_ok) + ",\"embed_backfilled\":" + bf_done + ",\"embed_count\":" + bf_total + ",\"ise_fail\":" + fail_str + "}"
ise_post(payload) ise_post(payload)
} }
@@ -251,6 +284,25 @@ fn auto_term_try_slot(slot_type: String, slot_lbl: String) -> Void {
if str_eq(term, "Paper") { state_set("_ats_gw", "1") } if str_eq(term, "Paper") { state_set("_ats_gw", "1") }
if str_eq(term, "Knowledge") { state_set("_ats_gw", "1") } if str_eq(term, "Knowledge") { state_set("_ats_gw", "1") }
if str_eq(term, "Value") { state_set("_ats_gw", "1") } if str_eq(term, "Value") { state_set("_ats_gw", "1") }
// QUOTED-TITLE GUARD (2026-07-25 self-review): labels that
// open with a quote ('"The Algorithmic Caricature" ...')
// defeat the >3-char stopword guard — the extracted term
// '"The' is 4 chars and seeds a lexical flood on "The"
// (observed live: activated jumped 48 → 87). Any term
// carrying a quote character is not a topic word.
if str_contains(term, "\"") { state_set("_ats_gw", "1") }
if str_contains(term, "'") { state_set("_ats_gw", "1") }
// AUTO-TERM TABU (2026-07-25 self-review): finst-style
// inhibition-of-return (ACT-R declarative finsts: small
// marker pool, hard exclusion). The last 4 selected auto
// terms are ineligible (~2 min at the 30s scan cadence),
// forcing rotation instead of "Fast-slow" every scan for
// hours. Empty tabu slots return "" from state_get and can
// never match — term is always > 3 chars here.
if str_eq(term, state_get("soul.tabu_t0")) { state_set("_ats_gw", "1") }
if str_eq(term, state_get("soul.tabu_t1")) { state_set("_ats_gw", "1") }
if str_eq(term, state_get("soul.tabu_t2")) { state_set("_ats_gw", "1") }
if str_eq(term, state_get("soul.tabu_t3")) { state_set("_ats_gw", "1") }
if str_eq(state_get("_ats_gw"), "0") { if str_eq(state_get("_ats_gw"), "0") {
state_set("cseed_auto", term) state_set("cseed_auto", term)
} }
@@ -323,8 +375,19 @@ fn proactive_curiosity() -> Bool {
// pattern as attend(): json_array_get element 0, json_get its "id". // pattern as attend(): json_array_get element 0, json_get its "id".
let top_entry: String = json_array_get(results_all, 0) let top_entry: String = json_array_get(results_all, 0)
let top_id: String = json_get(top_entry, "id") let top_id: String = json_get(top_entry, "id")
// STREAK-GATED STRENGTHEN (2026-07-25 self-review): unconditionally
// strengthening the top result every scan was a positive-feedback fixed
// point — whatever led WM got its salience bumped again, kept leading,
// and pinned the auto_term for hours ("Fast-slow" era). Strengthen only
// when the top node CHANGED since the last scan: novelty is reinforced,
// incumbency is not. Pairs with the runtime-side Lebiere-Best short-term
// inhibition (el_runtime.c Pass 2), which handles score-level rotation.
let prev_str_id: String = state_get("soul.last_strengthen_id")
if !str_eq(top_id, "") { if !str_eq(top_id, "") {
engram_strengthen(top_id) if !str_eq(top_id, prev_str_id) {
engram_strengthen(top_id)
}
state_set("soul.last_strengthen_id", top_id)
} }
// WM-autobiographical 4th seed: scan top-10 WM nodes for the highest-ranked // WM-autobiographical 4th seed: scan top-10 WM nodes for the highest-ranked
@@ -372,6 +435,21 @@ fn proactive_curiosity() -> Bool {
let found_auto: Int = json_array_len(results_auto) let found_auto: Int = json_array_len(results_auto)
let total_found: Int = found + found_auto let total_found: Int = found + found_auto
let safe_auto: String = str_replace(auto_term, "\"", "'") let safe_auto: String = str_replace(auto_term, "\"", "'")
// Push the selected term into the 4-deep tabu ring (see
// auto_term_try_slot) and track the consecutive-same-term streak for
// the ISE — the stuck-term failure becomes a one-glance signal.
let prev_auto: String = state_get("soul.prev_auto_term")
let atstreak_raw: String = state_get("soul.auto_term_streak")
let atstreak_prev: Int = if str_eq(atstreak_raw, "") { 0 } else { str_to_int(atstreak_raw) }
let atstreak: Int = if str_eq(auto_term, prev_auto) { atstreak_prev + 1 } else { 1 }
state_set("soul.prev_auto_term", auto_term)
state_set("soul.auto_term_streak", int_to_str(atstreak))
if !str_eq(auto_term, "") {
state_set("soul.tabu_t3", state_get("soul.tabu_t2"))
state_set("soul.tabu_t2", state_get("soul.tabu_t1"))
state_set("soul.tabu_t1", state_get("soul.tabu_t0"))
state_set("soul.tabu_t0", auto_term)
}
let wmc: Int = engram_wm_count() let wmc: Int = engram_wm_count()
// wm_top snapshot in curiosity_scan ISE: top-3 WM nodes by weight. // wm_top snapshot in curiosity_scan ISE: top-3 WM nodes by weight.
@@ -384,7 +462,8 @@ fn proactive_curiosity() -> Bool {
let wm3: String = engram_wm_top_json(3) let wm3: String = engram_wm_top_json(3)
let ise: String = "{\"event\":\"curiosity_scan\",\"seed\":\"" + curiosity_seed let ise: String = "{\"event\":\"curiosity_scan\",\"seed\":\"" + curiosity_seed
+ "\",\"auto_term\":\"" + safe_auto + "\",\"auto_term\":\"" + safe_auto
+ "\",\"minute_block\":" + int_to_str(minute_block) + "\",\"auto_term_streak\":" + int_to_str(atstreak)
+ ",\"minute_block\":" + int_to_str(minute_block)
+ ",\"activated\":" + int_to_str(total_found) + ",\"activated\":" + int_to_str(total_found)
+ ",\"wm_active\":" + int_to_str(wmc) + ",\"wm_active\":" + int_to_str(wmc)
+ ",\"wm_top\":" + wm3 + ",\"wm_top\":" + wm3
dist/awareness.c
Generated Vendored
+115 -64
View File
@@ -160,7 +160,24 @@ el_val_t emit_heartbeat(void) {
state_set(EL_STR("soul.prev_edge_count"), int_to_str(ec)); state_set(EL_STR("soul.prev_edge_count"), int_to_str(ec));
el_val_t sync_ok_raw = state_get(EL_STR("soul.last_sync_ok_ts")); el_val_t sync_ok_raw = state_get(EL_STR("soul.last_sync_ok_ts"));
el_val_t sync_age = ({ el_val_t _if_result_10 = 0; if (str_eq(sync_ok_raw, EL_STR(""))) { _if_result_10 = ((0 - 1)); } else { _if_result_10 = ((ts - str_to_int(sync_ok_raw))); } _if_result_10; }); el_val_t sync_age = ({ el_val_t _if_result_10 = 0; if (str_eq(sync_ok_raw, EL_STR(""))) { _if_result_10 = ((0 - 1)); } else { _if_result_10 = ((ts - str_to_int(sync_ok_raw))); } _if_result_10; });
el_val_t payload = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"event\":\"heartbeat\",\"pulse\":"), pulse), EL_STR(",\"tick\":")), pulse), EL_STR(",\"boot\":")), boot), EL_STR(",\"idle\":")), idle), EL_STR(",\"node_count\":")), int_to_str(nc)), EL_STR(",\"edge_count\":")), int_to_str(ec)), EL_STR(",\"node_delta\":")), int_to_str(node_delta)), EL_STR(",\"edge_delta\":")), int_to_str(edge_delta)), EL_STR(",\"wm_active\":")), int_to_str(wmc)), EL_STR(",\"wm_delta\":")), int_to_str(wm_delta)), EL_STR(",\"sync_added_total\":")), sat_str), EL_STR(",\"sync_age_ms\":")), int_to_str(sync_age)), EL_STR(",\"wm_avg_weight\":")), wm_avg_str), EL_STR(",\"wm_top\":")), wm_top), EL_STR(",\"ts\":")), int_to_str(ts)), EL_STR(",\"uptime_ms\":")), int_to_str(up_ms)), EL_STR(",\"uptime\":\"")), up_human), EL_STR("\",\"embed_ok\":")), int_to_str(emb_ok)), EL_STR(",\"ise_fail\":")), fail_str), EL_STR("}")); el_val_t hb_env_url = env(EL_STR("SOUL_ISE_URL"));
el_val_t hb_state_url = ({ el_val_t _if_result_11 = 0; if (str_eq(hb_env_url, EL_STR(""))) { _if_result_11 = (state_get(EL_STR("soul_engram_url"))); } else { _if_result_11 = (hb_env_url); } _if_result_11; });
el_val_t hb_engram_url = ({ el_val_t _if_result_12 = 0; if (str_eq(hb_state_url, EL_STR(""))) { _if_result_12 = (EL_STR("http://localhost:8742")); } else { _if_result_12 = (hb_state_url); } _if_result_12; });
el_val_t bf_resp = http_get(el_str_concat(hb_engram_url, EL_STR("/api/embed-backfill?n=32")));
el_val_t bf_done_raw = json_get(bf_resp, EL_STR("embedded"));
el_val_t bf_done = ({ el_val_t _if_result_13 = 0; if (str_eq(bf_done_raw, EL_STR(""))) { _if_result_13 = (EL_STR("-1")); } else { _if_result_13 = (bf_done_raw); } _if_result_13; });
el_val_t bf_total_raw = json_get(bf_resp, EL_STR("embedded_count"));
el_val_t bf_total = ({ el_val_t _if_result_14 = 0; if (str_eq(bf_total_raw, EL_STR(""))) { _if_result_14 = (EL_STR("-1")); } else { _if_result_14 = (bf_total_raw); } _if_result_14; });
el_val_t wm_sat = ({ el_val_t _if_result_15 = 0; if ((wmc >= 24)) { _if_result_15 = (1); } else { _if_result_15 = (0); } _if_result_15; });
el_val_t wm_top0 = json_array_get(wm_top, 0);
el_val_t wm_top0_id = json_get(wm_top0, EL_STR("id"));
el_val_t prev_top0 = state_get(EL_STR("soul.prev_wm_top0"));
el_val_t t0streak_raw = state_get(EL_STR("soul.wm_top0_streak"));
el_val_t t0streak_prev = ({ el_val_t _if_result_16 = 0; if (str_eq(t0streak_raw, EL_STR(""))) { _if_result_16 = (0); } else { _if_result_16 = (str_to_int(t0streak_raw)); } _if_result_16; });
el_val_t t0streak = ({ el_val_t _if_result_17 = 0; if (str_eq(wm_top0_id, prev_top0)) { _if_result_17 = ((t0streak_prev + 1)); } else { _if_result_17 = (1); } _if_result_17; });
state_set(EL_STR("soul.prev_wm_top0"), wm_top0_id);
state_set(EL_STR("soul.wm_top0_streak"), int_to_str(t0streak));
el_val_t payload = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"event\":\"heartbeat\",\"pulse\":"), pulse), EL_STR(",\"tick\":")), pulse), EL_STR(",\"boot\":")), boot), EL_STR(",\"idle\":")), idle), EL_STR(",\"node_count\":")), int_to_str(nc)), EL_STR(",\"edge_count\":")), int_to_str(ec)), EL_STR(",\"node_delta\":")), int_to_str(node_delta)), EL_STR(",\"edge_delta\":")), int_to_str(edge_delta)), EL_STR(",\"wm_active\":")), int_to_str(wmc)), EL_STR(",\"wm_delta\":")), int_to_str(wm_delta)), EL_STR(",\"wm_saturated\":")), int_to_str(wm_sat)), EL_STR(",\"wm_top0_streak\":")), int_to_str(t0streak)), EL_STR(",\"sync_added_total\":")), sat_str), EL_STR(",\"sync_age_ms\":")), int_to_str(sync_age)), EL_STR(",\"wm_avg_weight\":")), wm_avg_str), EL_STR(",\"wm_top\":")), wm_top), EL_STR(",\"ts\":")), int_to_str(ts)), EL_STR(",\"uptime_ms\":")), int_to_str(up_ms)), EL_STR(",\"uptime\":\"")), up_human), EL_STR("\",\"embed_ok\":")), int_to_str(emb_ok)), EL_STR(",\"embed_backfilled\":")), bf_done), EL_STR(",\"embed_count\":")), bf_total), EL_STR(",\"ise_fail\":")), fail_str), EL_STR("}"));
ise_post(payload); ise_post(payload);
return 0; return 0;
} }
@@ -211,6 +228,24 @@ el_val_t auto_term_try_slot(el_val_t slot_type, el_val_t slot_lbl) {
if (str_eq(term, EL_STR("Value"))) { if (str_eq(term, EL_STR("Value"))) {
state_set(EL_STR("_ats_gw"), EL_STR("1")); state_set(EL_STR("_ats_gw"), EL_STR("1"));
} }
if (str_contains(term, EL_STR("\""))) {
state_set(EL_STR("_ats_gw"), EL_STR("1"));
}
if (str_contains(term, EL_STR("'"))) {
state_set(EL_STR("_ats_gw"), EL_STR("1"));
}
if (str_eq(term, state_get(EL_STR("soul.tabu_t0")))) {
state_set(EL_STR("_ats_gw"), EL_STR("1"));
}
if (str_eq(term, state_get(EL_STR("soul.tabu_t1")))) {
state_set(EL_STR("_ats_gw"), EL_STR("1"));
}
if (str_eq(term, state_get(EL_STR("soul.tabu_t2")))) {
state_set(EL_STR("_ats_gw"), EL_STR("1"));
}
if (str_eq(term, state_get(EL_STR("soul.tabu_t3")))) {
state_set(EL_STR("_ats_gw"), EL_STR("1"));
}
if (str_eq(state_get(EL_STR("_ats_gw")), EL_STR("0"))) { if (str_eq(state_get(EL_STR("_ats_gw")), EL_STR("0"))) {
state_set(EL_STR("cseed_auto"), term); state_set(EL_STR("cseed_auto"), term);
} }
@@ -254,8 +289,12 @@ el_val_t proactive_curiosity(void) {
el_val_t found = json_array_len(results_all); el_val_t found = json_array_len(results_all);
el_val_t top_entry = json_array_get(results_all, 0); el_val_t top_entry = json_array_get(results_all, 0);
el_val_t top_id = json_get(top_entry, EL_STR("id")); el_val_t top_id = json_get(top_entry, EL_STR("id"));
el_val_t prev_str_id = state_get(EL_STR("soul.last_strengthen_id"));
if (!str_eq(top_id, EL_STR(""))) { if (!str_eq(top_id, EL_STR(""))) {
engram_strengthen(top_id); if (!str_eq(top_id, prev_str_id)) {
engram_strengthen(top_id);
}
state_set(EL_STR("soul.last_strengthen_id"), top_id);
} }
state_set(EL_STR("cseed_auto"), EL_STR("")); state_set(EL_STR("cseed_auto"), EL_STR(""));
el_val_t wm10 = engram_wm_top_json(10); el_val_t wm10 = engram_wm_top_json(10);
@@ -280,13 +319,25 @@ el_val_t proactive_curiosity(void) {
auto_term_try_slot(json_get(wm10_n1, EL_STR("node_type")), json_get(wm10_n1, EL_STR("label"))); auto_term_try_slot(json_get(wm10_n1, EL_STR("node_type")), json_get(wm10_n1, EL_STR("label")));
auto_term_try_slot(json_get(wm10_n0, EL_STR("node_type")), json_get(wm10_n0, EL_STR("label"))); auto_term_try_slot(json_get(wm10_n0, EL_STR("node_type")), json_get(wm10_n0, EL_STR("label")));
el_val_t auto_term = state_get(EL_STR("cseed_auto")); el_val_t auto_term = state_get(EL_STR("cseed_auto"));
el_val_t results_auto = ({ el_val_t _if_result_11 = 0; if (str_eq(auto_term, EL_STR(""))) { _if_result_11 = (EL_STR("[]")); } else { _if_result_11 = (engram_activate_json(auto_term, 1)); } _if_result_11; }); el_val_t results_auto = ({ el_val_t _if_result_18 = 0; if (str_eq(auto_term, EL_STR(""))) { _if_result_18 = (EL_STR("[]")); } else { _if_result_18 = (engram_activate_json(auto_term, 1)); } _if_result_18; });
el_val_t found_auto = json_array_len(results_auto); el_val_t found_auto = json_array_len(results_auto);
el_val_t total_found = (found + found_auto); el_val_t total_found = (found + found_auto);
el_val_t safe_auto = str_replace(auto_term, EL_STR("\""), EL_STR("'")); el_val_t safe_auto = str_replace(auto_term, EL_STR("\""), EL_STR("'"));
el_val_t prev_auto = state_get(EL_STR("soul.prev_auto_term"));
el_val_t atstreak_raw = state_get(EL_STR("soul.auto_term_streak"));
el_val_t atstreak_prev = ({ el_val_t _if_result_19 = 0; if (str_eq(atstreak_raw, EL_STR(""))) { _if_result_19 = (0); } else { _if_result_19 = (str_to_int(atstreak_raw)); } _if_result_19; });
el_val_t atstreak = ({ el_val_t _if_result_20 = 0; if (str_eq(auto_term, prev_auto)) { _if_result_20 = ((atstreak_prev + 1)); } else { _if_result_20 = (1); } _if_result_20; });
state_set(EL_STR("soul.prev_auto_term"), auto_term);
state_set(EL_STR("soul.auto_term_streak"), int_to_str(atstreak));
if (!str_eq(auto_term, EL_STR(""))) {
state_set(EL_STR("soul.tabu_t3"), state_get(EL_STR("soul.tabu_t2")));
state_set(EL_STR("soul.tabu_t2"), state_get(EL_STR("soul.tabu_t1")));
state_set(EL_STR("soul.tabu_t1"), state_get(EL_STR("soul.tabu_t0")));
state_set(EL_STR("soul.tabu_t0"), auto_term);
}
el_val_t wmc = engram_wm_count(); el_val_t wmc = engram_wm_count();
el_val_t wm3 = engram_wm_top_json(3); el_val_t wm3 = engram_wm_top_json(3);
el_val_t ise = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"event\":\"curiosity_scan\",\"seed\":\""), curiosity_seed), EL_STR("\",\"auto_term\":\"")), safe_auto), EL_STR("\",\"minute_block\":")), int_to_str(minute_block)), EL_STR(",\"activated\":")), int_to_str(total_found)), EL_STR(",\"wm_active\":")), int_to_str(wmc)), EL_STR(",\"wm_top\":")), wm3), EL_STR(",\"ts\":")), int_to_str(ts)), EL_STR("}")); el_val_t ise = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"event\":\"curiosity_scan\",\"seed\":\""), curiosity_seed), EL_STR("\",\"auto_term\":\"")), safe_auto), EL_STR("\",\"auto_term_streak\":")), int_to_str(atstreak)), EL_STR(",\"minute_block\":")), int_to_str(minute_block)), EL_STR(",\"activated\":")), int_to_str(total_found)), EL_STR(",\"wm_active\":")), int_to_str(wmc)), EL_STR(",\"wm_top\":")), wm3), EL_STR(",\"ts\":")), int_to_str(ts)), EL_STR("}"));
ise_post(ise); ise_post(ise);
return (total_found > 0); return (total_found > 0);
return 0; return 0;
@@ -469,9 +520,9 @@ el_val_t awareness_run(void) {
state_set(EL_STR("soul.boot_ts"), int_to_str(time_now())); state_set(EL_STR("soul.boot_ts"), int_to_str(time_now()));
} }
el_val_t tick_raw = env(EL_STR("SOUL_TICK_MS")); el_val_t tick_raw = env(EL_STR("SOUL_TICK_MS"));
el_val_t tick_ms = ({ el_val_t _if_result_12 = 0; if (str_eq(tick_raw, EL_STR(""))) { _if_result_12 = (200); } else { _if_result_12 = (str_to_int(tick_raw)); } _if_result_12; }); el_val_t tick_ms = ({ el_val_t _if_result_21 = 0; if (str_eq(tick_raw, EL_STR(""))) { _if_result_21 = (200); } else { _if_result_21 = (str_to_int(tick_raw)); } _if_result_21; });
el_val_t beat_ms_raw = env(EL_STR("SOUL_HEARTBEAT_MS")); el_val_t beat_ms_raw = env(EL_STR("SOUL_HEARTBEAT_MS"));
el_val_t beat_ms = ({ el_val_t _if_result_13 = 0; if (str_eq(beat_ms_raw, EL_STR(""))) { _if_result_13 = (60000); } else { _if_result_13 = (str_to_int(beat_ms_raw)); } _if_result_13; }); el_val_t beat_ms = ({ el_val_t _if_result_22 = 0; if (str_eq(beat_ms_raw, EL_STR(""))) { _if_result_22 = (60000); } else { _if_result_22 = (str_to_int(beat_ms_raw)); } _if_result_22; });
el_val_t scan_ms = (beat_ms / 2); el_val_t scan_ms = (beat_ms / 2);
while (1) { while (1) {
el_val_t tick_mark = el_arena_push(); el_val_t tick_mark = el_arena_push();
@@ -491,7 +542,7 @@ el_val_t awareness_run(void) {
} }
el_val_t now_ts = time_now(); el_val_t now_ts = time_now();
el_val_t last_beat_str = state_get(EL_STR("soul.last_beat_ts")); el_val_t last_beat_str = state_get(EL_STR("soul.last_beat_ts"));
el_val_t last_beat_ts = ({ el_val_t _if_result_14 = 0; if (str_eq(last_beat_str, EL_STR(""))) { _if_result_14 = (0); } else { _if_result_14 = (str_to_int(last_beat_str)); } _if_result_14; }); el_val_t last_beat_ts = ({ el_val_t _if_result_23 = 0; if (str_eq(last_beat_str, EL_STR(""))) { _if_result_23 = (0); } else { _if_result_23 = (str_to_int(last_beat_str)); } _if_result_23; });
el_val_t beat_elapsed = (now_ts - last_beat_ts); el_val_t beat_elapsed = (now_ts - last_beat_ts);
el_val_t should_beat = (beat_elapsed >= beat_ms); el_val_t should_beat = (beat_elapsed >= beat_ms);
if (should_beat) { if (should_beat) {
@@ -503,7 +554,7 @@ el_val_t awareness_run(void) {
} }
} }
el_val_t last_scan_str = state_get(EL_STR("soul.last_scan_ts")); el_val_t last_scan_str = state_get(EL_STR("soul.last_scan_ts"));
el_val_t last_scan_ts = ({ el_val_t _if_result_15 = 0; if (str_eq(last_scan_str, EL_STR(""))) { _if_result_15 = (0); } else { _if_result_15 = (str_to_int(last_scan_str)); } _if_result_15; }); el_val_t last_scan_ts = ({ el_val_t _if_result_24 = 0; if (str_eq(last_scan_str, EL_STR(""))) { _if_result_24 = (0); } else { _if_result_24 = (str_to_int(last_scan_str)); } _if_result_24; });
el_val_t scan_elapsed = (now_ts - last_scan_ts); el_val_t scan_elapsed = (now_ts - last_scan_ts);
el_val_t should_scan = (!did_work && (scan_elapsed >= scan_ms)); el_val_t should_scan = (!did_work && (scan_elapsed >= scan_ms));
if (should_scan) { if (should_scan) {
@@ -511,15 +562,15 @@ el_val_t awareness_run(void) {
state_set(EL_STR("soul.last_scan_ts"), int_to_str(now_ts)); state_set(EL_STR("soul.last_scan_ts"), int_to_str(now_ts));
} }
el_val_t refresh_ms_raw = env(EL_STR("SOUL_REFRESH_MS")); el_val_t refresh_ms_raw = env(EL_STR("SOUL_REFRESH_MS"));
el_val_t refresh_ms = ({ el_val_t _if_result_16 = 0; if (str_eq(refresh_ms_raw, EL_STR(""))) { _if_result_16 = (600000); } else { _if_result_16 = (str_to_int(refresh_ms_raw)); } _if_result_16; }); el_val_t refresh_ms = ({ el_val_t _if_result_25 = 0; if (str_eq(refresh_ms_raw, EL_STR(""))) { _if_result_25 = (600000); } else { _if_result_25 = (str_to_int(refresh_ms_raw)); } _if_result_25; });
el_val_t last_refresh_str = state_get(EL_STR("soul.last_refresh_ts")); el_val_t last_refresh_str = state_get(EL_STR("soul.last_refresh_ts"));
el_val_t last_refresh_ts = ({ el_val_t _if_result_17 = 0; if (str_eq(last_refresh_str, EL_STR(""))) { _if_result_17 = (0); } else { _if_result_17 = (str_to_int(last_refresh_str)); } _if_result_17; }); el_val_t last_refresh_ts = ({ el_val_t _if_result_26 = 0; if (str_eq(last_refresh_str, EL_STR(""))) { _if_result_26 = (0); } else { _if_result_26 = (str_to_int(last_refresh_str)); } _if_result_26; });
el_val_t refresh_elapsed = (now_ts - last_refresh_ts); el_val_t refresh_elapsed = (now_ts - last_refresh_ts);
el_val_t should_refresh = (refresh_elapsed >= refresh_ms); el_val_t should_refresh = (refresh_elapsed >= refresh_ms);
if (should_refresh) { if (should_refresh) {
el_val_t sync_env_url = env(EL_STR("SOUL_ISE_URL")); el_val_t sync_env_url = env(EL_STR("SOUL_ISE_URL"));
el_val_t sync_state_url = ({ el_val_t _if_result_18 = 0; if (str_eq(sync_env_url, EL_STR(""))) { _if_result_18 = (state_get(EL_STR("soul_engram_url"))); } else { _if_result_18 = (sync_env_url); } _if_result_18; }); el_val_t sync_state_url = ({ el_val_t _if_result_27 = 0; if (str_eq(sync_env_url, EL_STR(""))) { _if_result_27 = (state_get(EL_STR("soul_engram_url"))); } else { _if_result_27 = (sync_env_url); } _if_result_27; });
el_val_t engram_url = ({ el_val_t _if_result_19 = 0; if (str_eq(sync_state_url, EL_STR(""))) { _if_result_19 = (EL_STR("http://localhost:8742")); } else { _if_result_19 = (sync_state_url); } _if_result_19; }); el_val_t engram_url = ({ el_val_t _if_result_28 = 0; if (str_eq(sync_state_url, EL_STR(""))) { _if_result_28 = (EL_STR("http://localhost:8742")); } else { _if_result_28 = (sync_state_url); } _if_result_28; });
if (!str_eq(engram_url, EL_STR(""))) { if (!str_eq(engram_url, EL_STR(""))) {
el_val_t sync_json = http_get(el_str_concat(engram_url, EL_STR("/api/sync"))); el_val_t sync_json = http_get(el_str_concat(engram_url, EL_STR("/api/sync")));
if (!str_eq(sync_json, EL_STR("")) && !str_eq(sync_json, EL_STR("{}"))) { if (!str_eq(sync_json, EL_STR("")) && !str_eq(sync_json, EL_STR("{}"))) {
@@ -529,7 +580,7 @@ el_val_t awareness_run(void) {
el_val_t added = engram_load_merge(tmp); el_val_t added = engram_load_merge(tmp);
el_val_t pruned_sync = engram_prune_telemetry(172800000); el_val_t pruned_sync = engram_prune_telemetry(172800000);
el_val_t sat_raw = state_get(EL_STR("soul.sync_added_total")); el_val_t sat_raw = state_get(EL_STR("soul.sync_added_total"));
el_val_t sat_n = ({ el_val_t _if_result_20 = 0; if (str_eq(sat_raw, EL_STR(""))) { _if_result_20 = (0); } else { _if_result_20 = (str_to_int(sat_raw)); } _if_result_20; }); el_val_t sat_n = ({ el_val_t _if_result_29 = 0; if (str_eq(sat_raw, EL_STR(""))) { _if_result_29 = (0); } else { _if_result_29 = (str_to_int(sat_raw)); } _if_result_29; });
state_set(EL_STR("soul.sync_added_total"), int_to_str((sat_n + added))); state_set(EL_STR("soul.sync_added_total"), int_to_str((sat_n + added)));
el_val_t ts2 = time_now(); el_val_t ts2 = time_now();
state_set(EL_STR("soul.last_sync_ok_ts"), int_to_str(ts2)); state_set(EL_STR("soul.last_sync_ok_ts"), int_to_str(ts2));
@@ -555,78 +606,78 @@ el_val_t security_research_authorized(void) {
} }
el_val_t threat_score_command(el_val_t cmd) { el_val_t threat_score_command(el_val_t cmd) {
el_val_t s1 = ({ el_val_t _if_result_21 = 0; if (str_contains(cmd, EL_STR("nmap"))) { _if_result_21 = (30); } else { _if_result_21 = (0); } _if_result_21; }); el_val_t s1 = ({ el_val_t _if_result_30 = 0; if (str_contains(cmd, EL_STR("nmap"))) { _if_result_30 = (30); } else { _if_result_30 = (0); } _if_result_30; });
el_val_t s2 = ({ el_val_t _if_result_22 = 0; if (str_contains(cmd, EL_STR("masscan"))) { _if_result_22 = (40); } else { _if_result_22 = (0); } _if_result_22; }); el_val_t s2 = ({ el_val_t _if_result_31 = 0; if (str_contains(cmd, EL_STR("masscan"))) { _if_result_31 = (40); } else { _if_result_31 = (0); } _if_result_31; });
el_val_t s3 = ({ el_val_t _if_result_23 = 0; if (str_contains(cmd, EL_STR(" nc "))) { _if_result_23 = (20); } else { _if_result_23 = (0); } _if_result_23; }); el_val_t s3 = ({ el_val_t _if_result_32 = 0; if (str_contains(cmd, EL_STR(" nc "))) { _if_result_32 = (20); } else { _if_result_32 = (0); } _if_result_32; });
el_val_t s4 = ({ el_val_t _if_result_24 = 0; if (str_contains(cmd, EL_STR("netcat"))) { _if_result_24 = (20); } else { _if_result_24 = (0); } _if_result_24; }); el_val_t s4 = ({ el_val_t _if_result_33 = 0; if (str_contains(cmd, EL_STR("netcat"))) { _if_result_33 = (20); } else { _if_result_33 = (0); } _if_result_33; });
el_val_t s5 = ({ el_val_t _if_result_25 = 0; if (str_contains(cmd, EL_STR("/etc/shadow"))) { _if_result_25 = (80); } else { _if_result_25 = (0); } _if_result_25; }); el_val_t s5 = ({ el_val_t _if_result_34 = 0; if (str_contains(cmd, EL_STR("/etc/shadow"))) { _if_result_34 = (80); } else { _if_result_34 = (0); } _if_result_34; });
el_val_t s6 = ({ el_val_t _if_result_26 = 0; if (str_contains(cmd, EL_STR("/etc/passwd"))) { _if_result_26 = (30); } else { _if_result_26 = (0); } _if_result_26; }); el_val_t s6 = ({ el_val_t _if_result_35 = 0; if (str_contains(cmd, EL_STR("/etc/passwd"))) { _if_result_35 = (30); } else { _if_result_35 = (0); } _if_result_35; });
el_val_t s7 = ({ el_val_t _if_result_27 = 0; if (str_contains(cmd, EL_STR("id_rsa"))) { _if_result_27 = (60); } else { _if_result_27 = (0); } _if_result_27; }); el_val_t s7 = ({ el_val_t _if_result_36 = 0; if (str_contains(cmd, EL_STR("id_rsa"))) { _if_result_36 = (60); } else { _if_result_36 = (0); } _if_result_36; });
el_val_t s8 = ({ el_val_t _if_result_28 = 0; if (str_contains(cmd, EL_STR(".ssh/"))) { _if_result_28 = (50); } else { _if_result_28 = (0); } _if_result_28; }); el_val_t s8 = ({ el_val_t _if_result_37 = 0; if (str_contains(cmd, EL_STR(".ssh/"))) { _if_result_37 = (50); } else { _if_result_37 = (0); } _if_result_37; });
el_val_t s9 = ({ el_val_t _if_result_29 = 0; if (str_contains(cmd, EL_STR("crontab"))) { _if_result_29 = (30); } else { _if_result_29 = (0); } _if_result_29; }); el_val_t s9 = ({ el_val_t _if_result_38 = 0; if (str_contains(cmd, EL_STR("crontab"))) { _if_result_38 = (30); } else { _if_result_38 = (0); } _if_result_38; });
el_val_t s10 = ({ el_val_t _if_result_30 = 0; if (str_contains(cmd, EL_STR("LaunchDaemon"))) { _if_result_30 = (40); } else { _if_result_30 = (0); } _if_result_30; }); el_val_t s10 = ({ el_val_t _if_result_39 = 0; if (str_contains(cmd, EL_STR("LaunchDaemon"))) { _if_result_39 = (40); } else { _if_result_39 = (0); } _if_result_39; });
el_val_t s11 = ({ el_val_t _if_result_31 = 0; if ((str_contains(cmd, EL_STR("curl")) && str_contains(cmd, EL_STR("bash")))) { _if_result_31 = (75); } else { _if_result_31 = (0); } _if_result_31; }); el_val_t s11 = ({ el_val_t _if_result_40 = 0; if ((str_contains(cmd, EL_STR("curl")) && str_contains(cmd, EL_STR("bash")))) { _if_result_40 = (75); } else { _if_result_40 = (0); } _if_result_40; });
el_val_t s12 = ({ el_val_t _if_result_32 = 0; if ((str_contains(cmd, EL_STR("wget")) && str_contains(cmd, EL_STR("bash")))) { _if_result_32 = (75); } else { _if_result_32 = (0); } _if_result_32; }); el_val_t s12 = ({ el_val_t _if_result_41 = 0; if ((str_contains(cmd, EL_STR("wget")) && str_contains(cmd, EL_STR("bash")))) { _if_result_41 = (75); } else { _if_result_41 = (0); } _if_result_41; });
el_val_t s13 = ({ el_val_t _if_result_33 = 0; if ((str_contains(cmd, EL_STR("curl")) && str_contains(cmd, EL_STR("| sh")))) { _if_result_33 = (60); } else { _if_result_33 = (0); } _if_result_33; }); el_val_t s13 = ({ el_val_t _if_result_42 = 0; if ((str_contains(cmd, EL_STR("curl")) && str_contains(cmd, EL_STR("| sh")))) { _if_result_42 = (60); } else { _if_result_42 = (0); } _if_result_42; });
el_val_t s14 = ({ el_val_t _if_result_34 = 0; if ((str_contains(cmd, EL_STR("base64")) && str_contains(cmd, EL_STR("curl")))) { _if_result_34 = (50); } else { _if_result_34 = (0); } _if_result_34; }); el_val_t s14 = ({ el_val_t _if_result_43 = 0; if ((str_contains(cmd, EL_STR("base64")) && str_contains(cmd, EL_STR("curl")))) { _if_result_43 = (50); } else { _if_result_43 = (0); } _if_result_43; });
el_val_t s15 = ({ el_val_t _if_result_35 = 0; if (str_contains(cmd, EL_STR("mkfifo"))) { _if_result_35 = (50); } else { _if_result_35 = (0); } _if_result_35; }); el_val_t s15 = ({ el_val_t _if_result_44 = 0; if (str_contains(cmd, EL_STR("mkfifo"))) { _if_result_44 = (50); } else { _if_result_44 = (0); } _if_result_44; });
el_val_t s16 = ({ el_val_t _if_result_36 = 0; if (str_contains(cmd, EL_STR("chmod +s"))) { _if_result_36 = (70); } else { _if_result_36 = (0); } _if_result_36; }); el_val_t s16 = ({ el_val_t _if_result_45 = 0; if (str_contains(cmd, EL_STR("chmod +s"))) { _if_result_45 = (70); } else { _if_result_45 = (0); } _if_result_45; });
el_val_t s17 = ({ el_val_t _if_result_37 = 0; if (str_contains(cmd, EL_STR("chmod 4755"))) { _if_result_37 = (70); } else { _if_result_37 = (0); } _if_result_37; }); el_val_t s17 = ({ el_val_t _if_result_46 = 0; if (str_contains(cmd, EL_STR("chmod 4755"))) { _if_result_46 = (70); } else { _if_result_46 = (0); } _if_result_46; });
return ((((((((((((((((s1 + s2) + s3) + s4) + s5) + s6) + s7) + s8) + s9) + s10) + s11) + s12) + s13) + s14) + s15) + s16) + s17); return ((((((((((((((((s1 + s2) + s3) + s4) + s5) + s6) + s7) + s8) + s9) + s10) + s11) + s12) + s13) + s14) + s15) + s16) + s17);
return 0; return 0;
} }
el_val_t threat_score_path(el_val_t path) { el_val_t threat_score_path(el_val_t path) {
el_val_t s1 = ({ el_val_t _if_result_38 = 0; if (str_starts_with(path, EL_STR("/etc/"))) { _if_result_38 = (60); } else { _if_result_38 = (0); } _if_result_38; }); el_val_t s1 = ({ el_val_t _if_result_47 = 0; if (str_starts_with(path, EL_STR("/etc/"))) { _if_result_47 = (60); } else { _if_result_47 = (0); } _if_result_47; });
el_val_t s2 = ({ el_val_t _if_result_39 = 0; if (str_contains(path, EL_STR("/.ssh/"))) { _if_result_39 = (70); } else { _if_result_39 = (0); } _if_result_39; }); el_val_t s2 = ({ el_val_t _if_result_48 = 0; if (str_contains(path, EL_STR("/.ssh/"))) { _if_result_48 = (70); } else { _if_result_48 = (0); } _if_result_48; });
el_val_t s3 = ({ el_val_t _if_result_40 = 0; if (str_contains(path, EL_STR("/LaunchDaemons/"))) { _if_result_40 = (80); } else { _if_result_40 = (0); } _if_result_40; }); el_val_t s3 = ({ el_val_t _if_result_49 = 0; if (str_contains(path, EL_STR("/LaunchDaemons/"))) { _if_result_49 = (80); } else { _if_result_49 = (0); } _if_result_49; });
el_val_t s4 = ({ el_val_t _if_result_41 = 0; if (str_contains(path, EL_STR("/LaunchAgents/"))) { _if_result_41 = (40); } else { _if_result_41 = (0); } _if_result_41; }); el_val_t s4 = ({ el_val_t _if_result_50 = 0; if (str_contains(path, EL_STR("/LaunchAgents/"))) { _if_result_50 = (40); } else { _if_result_50 = (0); } _if_result_50; });
el_val_t s5 = ({ el_val_t _if_result_42 = 0; if (str_contains(path, EL_STR("/cron"))) { _if_result_42 = (60); } else { _if_result_42 = (0); } _if_result_42; }); el_val_t s5 = ({ el_val_t _if_result_51 = 0; if (str_contains(path, EL_STR("/cron"))) { _if_result_51 = (60); } else { _if_result_51 = (0); } _if_result_51; });
el_val_t s6 = ({ el_val_t _if_result_43 = 0; if (str_contains(path, EL_STR("/.bashrc"))) { _if_result_43 = (35); } else { _if_result_43 = (0); } _if_result_43; }); el_val_t s6 = ({ el_val_t _if_result_52 = 0; if (str_contains(path, EL_STR("/.bashrc"))) { _if_result_52 = (35); } else { _if_result_52 = (0); } _if_result_52; });
el_val_t s7 = ({ el_val_t _if_result_44 = 0; if (str_contains(path, EL_STR("/.zshrc"))) { _if_result_44 = (35); } else { _if_result_44 = (0); } _if_result_44; }); el_val_t s7 = ({ el_val_t _if_result_53 = 0; if (str_contains(path, EL_STR("/.zshrc"))) { _if_result_53 = (35); } else { _if_result_53 = (0); } _if_result_53; });
el_val_t s8 = ({ el_val_t _if_result_45 = 0; if (str_contains(path, EL_STR("/.profile"))) { _if_result_45 = (35); } else { _if_result_45 = (0); } _if_result_45; }); el_val_t s8 = ({ el_val_t _if_result_54 = 0; if (str_contains(path, EL_STR("/.profile"))) { _if_result_54 = (35); } else { _if_result_54 = (0); } _if_result_54; });
el_val_t s9 = ({ el_val_t _if_result_46 = 0; if (str_starts_with(path, EL_STR("/usr/"))) { _if_result_46 = (50); } else { _if_result_46 = (0); } _if_result_46; }); el_val_t s9 = ({ el_val_t _if_result_55 = 0; if (str_starts_with(path, EL_STR("/usr/"))) { _if_result_55 = (50); } else { _if_result_55 = (0); } _if_result_55; });
el_val_t s10 = ({ el_val_t _if_result_47 = 0; if (str_starts_with(path, EL_STR("/bin/"))) { _if_result_47 = (70); } else { _if_result_47 = (0); } _if_result_47; }); el_val_t s10 = ({ el_val_t _if_result_56 = 0; if (str_starts_with(path, EL_STR("/bin/"))) { _if_result_56 = (70); } else { _if_result_56 = (0); } _if_result_56; });
el_val_t s11 = ({ el_val_t _if_result_48 = 0; if (str_starts_with(path, EL_STR("/sbin/"))) { _if_result_48 = (70); } else { _if_result_48 = (0); } _if_result_48; }); el_val_t s11 = ({ el_val_t _if_result_57 = 0; if (str_starts_with(path, EL_STR("/sbin/"))) { _if_result_57 = (70); } else { _if_result_57 = (0); } _if_result_57; });
return ((((((((((s1 + s2) + s3) + s4) + s5) + s6) + s7) + s8) + s9) + s10) + s11); return ((((((((((s1 + s2) + s3) + s4) + s5) + s6) + s7) + s8) + s9) + s10) + s11);
return 0; return 0;
} }
el_val_t threat_score_history(el_val_t history) { el_val_t threat_score_history(el_val_t history) {
el_val_t s1 = ({ el_val_t _if_result_49 = 0; if (str_contains(history, EL_STR("port scan"))) { _if_result_49 = (15); } else { _if_result_49 = (0); } _if_result_49; }); el_val_t s1 = ({ el_val_t _if_result_58 = 0; if (str_contains(history, EL_STR("port scan"))) { _if_result_58 = (15); } else { _if_result_58 = (0); } _if_result_58; });
el_val_t s2 = ({ el_val_t _if_result_50 = 0; if (str_contains(history, EL_STR("enumerate"))) { _if_result_50 = (10); } else { _if_result_50 = (0); } _if_result_50; }); el_val_t s2 = ({ el_val_t _if_result_59 = 0; if (str_contains(history, EL_STR("enumerate"))) { _if_result_59 = (10); } else { _if_result_59 = (0); } _if_result_59; });
el_val_t s3 = ({ el_val_t _if_result_51 = 0; if (str_contains(history, EL_STR("exploit"))) { _if_result_51 = (20); } else { _if_result_51 = (0); } _if_result_51; }); el_val_t s3 = ({ el_val_t _if_result_60 = 0; if (str_contains(history, EL_STR("exploit"))) { _if_result_60 = (20); } else { _if_result_60 = (0); } _if_result_60; });
el_val_t s4 = ({ el_val_t _if_result_52 = 0; if (str_contains(history, EL_STR("payload"))) { _if_result_52 = (15); } else { _if_result_52 = (0); } _if_result_52; }); el_val_t s4 = ({ el_val_t _if_result_61 = 0; if (str_contains(history, EL_STR("payload"))) { _if_result_61 = (15); } else { _if_result_61 = (0); } _if_result_61; });
el_val_t s5 = ({ el_val_t _if_result_53 = 0; if (str_contains(history, EL_STR("persistence"))) { _if_result_53 = (15); } else { _if_result_53 = (0); } _if_result_53; }); el_val_t s5 = ({ el_val_t _if_result_62 = 0; if (str_contains(history, EL_STR("persistence"))) { _if_result_62 = (15); } else { _if_result_62 = (0); } _if_result_62; });
el_val_t s6 = ({ el_val_t _if_result_54 = 0; if (str_contains(history, EL_STR("lateral movement"))) { _if_result_54 = (25); } else { _if_result_54 = (0); } _if_result_54; }); el_val_t s6 = ({ el_val_t _if_result_63 = 0; if (str_contains(history, EL_STR("lateral movement"))) { _if_result_63 = (25); } else { _if_result_63 = (0); } _if_result_63; });
el_val_t s7 = ({ el_val_t _if_result_55 = 0; if (str_contains(history, EL_STR("privilege escalation"))) { _if_result_55 = (25); } else { _if_result_55 = (0); } _if_result_55; }); el_val_t s7 = ({ el_val_t _if_result_64 = 0; if (str_contains(history, EL_STR("privilege escalation"))) { _if_result_64 = (25); } else { _if_result_64 = (0); } _if_result_64; });
el_val_t s8 = ({ el_val_t _if_result_56 = 0; if (str_contains(history, EL_STR("reverse shell"))) { _if_result_56 = (40); } else { _if_result_56 = (0); } _if_result_56; }); el_val_t s8 = ({ el_val_t _if_result_65 = 0; if (str_contains(history, EL_STR("reverse shell"))) { _if_result_65 = (40); } else { _if_result_65 = (0); } _if_result_65; });
el_val_t s9 = ({ el_val_t _if_result_57 = 0; if (str_contains(history, EL_STR("bind shell"))) { _if_result_57 = (40); } else { _if_result_57 = (0); } _if_result_57; }); el_val_t s9 = ({ el_val_t _if_result_66 = 0; if (str_contains(history, EL_STR("bind shell"))) { _if_result_66 = (40); } else { _if_result_66 = (0); } _if_result_66; });
el_val_t s10 = ({ el_val_t _if_result_58 = 0; if (str_contains(history, EL_STR("command and control"))) { _if_result_58 = (35); } else { _if_result_58 = (0); } _if_result_58; }); el_val_t s10 = ({ el_val_t _if_result_67 = 0; if (str_contains(history, EL_STR("command and control"))) { _if_result_67 = (35); } else { _if_result_67 = (0); } _if_result_67; });
el_val_t s11 = ({ el_val_t _if_result_59 = 0; if (str_contains(history, EL_STR("self-replicate"))) { _if_result_59 = (45); } else { _if_result_59 = (0); } _if_result_59; }); el_val_t s11 = ({ el_val_t _if_result_68 = 0; if (str_contains(history, EL_STR("self-replicate"))) { _if_result_68 = (45); } else { _if_result_68 = (0); } _if_result_68; });
el_val_t s12 = ({ el_val_t _if_result_60 = 0; if (str_contains(history, EL_STR("propagat"))) { _if_result_60 = (20); } else { _if_result_60 = (0); } _if_result_60; }); el_val_t s12 = ({ el_val_t _if_result_69 = 0; if (str_contains(history, EL_STR("propagat"))) { _if_result_69 = (20); } else { _if_result_69 = (0); } _if_result_69; });
el_val_t s13 = ({ el_val_t _if_result_61 = 0; if (str_contains(history, EL_STR("ransomware"))) { _if_result_61 = (30); } else { _if_result_61 = (0); } _if_result_61; }); el_val_t s13 = ({ el_val_t _if_result_70 = 0; if (str_contains(history, EL_STR("ransomware"))) { _if_result_70 = (30); } else { _if_result_70 = (0); } _if_result_70; });
el_val_t s14 = ({ el_val_t _if_result_62 = 0; if (str_contains(history, EL_STR("encrypt files"))) { _if_result_62 = (40); } else { _if_result_62 = (0); } _if_result_62; }); el_val_t s14 = ({ el_val_t _if_result_71 = 0; if (str_contains(history, EL_STR("encrypt files"))) { _if_result_71 = (40); } else { _if_result_71 = (0); } _if_result_71; });
el_val_t s15 = ({ el_val_t _if_result_63 = 0; if (str_contains(history, EL_STR("exfiltrat"))) { _if_result_63 = (35); } else { _if_result_63 = (0); } _if_result_63; }); el_val_t s15 = ({ el_val_t _if_result_72 = 0; if (str_contains(history, EL_STR("exfiltrat"))) { _if_result_72 = (35); } else { _if_result_72 = (0); } _if_result_72; });
el_val_t s16 = ({ el_val_t _if_result_64 = 0; if (str_contains(history, EL_STR("zero-day"))) { _if_result_64 = (20); } else { _if_result_64 = (0); } _if_result_64; }); el_val_t s16 = ({ el_val_t _if_result_73 = 0; if (str_contains(history, EL_STR("zero-day"))) { _if_result_73 = (20); } else { _if_result_73 = (0); } _if_result_73; });
el_val_t s17 = ({ el_val_t _if_result_65 = 0; if (str_contains(history, EL_STR("rootkit"))) { _if_result_65 = (45); } else { _if_result_65 = (0); } _if_result_65; }); el_val_t s17 = ({ el_val_t _if_result_74 = 0; if (str_contains(history, EL_STR("rootkit"))) { _if_result_74 = (45); } else { _if_result_74 = (0); } _if_result_74; });
el_val_t s18 = ({ el_val_t _if_result_66 = 0; if (str_contains(history, EL_STR("keylogger"))) { _if_result_66 = (45); } else { _if_result_66 = (0); } _if_result_66; }); el_val_t s18 = ({ el_val_t _if_result_75 = 0; if (str_contains(history, EL_STR("keylogger"))) { _if_result_75 = (45); } else { _if_result_75 = (0); } _if_result_75; });
el_val_t s19 = ({ el_val_t _if_result_67 = 0; if (str_contains(history, EL_STR("botnet"))) { _if_result_67 = (40); } else { _if_result_67 = (0); } _if_result_67; }); el_val_t s19 = ({ el_val_t _if_result_76 = 0; if (str_contains(history, EL_STR("botnet"))) { _if_result_76 = (40); } else { _if_result_76 = (0); } _if_result_76; });
el_val_t s20 = ({ el_val_t _if_result_68 = 0; if (str_contains(history, EL_STR("malware"))) { _if_result_68 = (15); } else { _if_result_68 = (0); } _if_result_68; }); el_val_t s20 = ({ el_val_t _if_result_77 = 0; if (str_contains(history, EL_STR("malware"))) { _if_result_77 = (15); } else { _if_result_77 = (0); } _if_result_77; });
return (((((((((((((((((((s1 + s2) + s3) + s4) + s5) + s6) + s7) + s8) + s9) + s10) + s11) + s12) + s13) + s14) + s15) + s16) + s17) + s18) + s19) + s20); return (((((((((((((((((((s1 + s2) + s3) + s4) + s5) + s6) + s7) + s8) + s9) + s10) + s11) + s12) + s13) + s14) + s15) + s16) + s17) + s18) + s19) + s20);
return 0; return 0;
} }
el_val_t threat_trajectory_check(el_val_t tool_name, el_val_t tool_input) { el_val_t threat_trajectory_check(el_val_t tool_name, el_val_t tool_input) {
el_val_t history = state_get(EL_STR("agentic_conv_history")); el_val_t history = state_get(EL_STR("agentic_conv_history"));
el_val_t computed_tool_score = ({ el_val_t _if_result_69 = 0; if (str_eq(tool_name, EL_STR("run_command"))) { el_val_t cmd = json_get(tool_input, EL_STR("command")); _if_result_69 = (threat_score_command(cmd)); } else { _if_result_69 = (({ el_val_t _if_result_70 = 0; if ((str_eq(tool_name, EL_STR("write_file")) || str_eq(tool_name, EL_STR("edit_file")))) { el_val_t path = json_get(tool_input, EL_STR("path")); _if_result_70 = (threat_score_path(path)); } else { _if_result_70 = (0); } _if_result_70; })); } _if_result_69; }); el_val_t computed_tool_score = ({ el_val_t _if_result_78 = 0; if (str_eq(tool_name, EL_STR("run_command"))) { el_val_t cmd = json_get(tool_input, EL_STR("command")); _if_result_78 = (threat_score_command(cmd)); } else { _if_result_78 = (({ el_val_t _if_result_79 = 0; if ((str_eq(tool_name, EL_STR("write_file")) || str_eq(tool_name, EL_STR("edit_file")))) { el_val_t path = json_get(tool_input, EL_STR("path")); _if_result_79 = (threat_score_path(path)); } else { _if_result_79 = (0); } _if_result_79; })); } _if_result_78; });
el_val_t history_score = threat_score_history(history); el_val_t history_score = threat_score_history(history);
el_val_t history_contrib = (history_score / 3); el_val_t history_contrib = (history_score / 3);
el_val_t combined = (computed_tool_score + history_contrib); el_val_t combined = (computed_tool_score + history_contrib);
el_val_t should_log = (combined >= 40); el_val_t should_log = (combined >= 40);
if (should_log) { if (should_log) {
el_val_t ts = time_now(); el_val_t ts = time_now();
el_val_t authorized_str = ({ el_val_t _if_result_71 = 0; if (security_research_authorized()) { _if_result_71 = (EL_STR("true")); } else { _if_result_71 = (EL_STR("false")); } _if_result_71; }); el_val_t authorized_str = ({ el_val_t _if_result_80 = 0; if (security_research_authorized()) { _if_result_80 = (EL_STR("true")); } else { _if_result_80 = (EL_STR("false")); } _if_result_80; });
el_val_t log_content = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"event\":\"threat_check\",\"tool\":\""), tool_name), EL_STR("\",\"score\":")), int_to_str(combined)), EL_STR(",\"tool_score\":")), int_to_str(computed_tool_score)), EL_STR(",\"history_score\":")), int_to_str(history_score)), EL_STR(",\"authorized\":")), authorized_str), EL_STR(",\"ts\":")), int_to_str(ts)), EL_STR("}")); el_val_t log_content = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"event\":\"threat_check\",\"tool\":\""), tool_name), EL_STR("\",\"score\":")), int_to_str(combined)), EL_STR(",\"tool_score\":")), int_to_str(computed_tool_score)), EL_STR(",\"history_score\":")), int_to_str(history_score)), EL_STR(",\"authorized\":")), authorized_str), EL_STR(",\"ts\":")), int_to_str(ts)), EL_STR("}"));
el_val_t log_tags = EL_STR("[\"security-audit\",\"threat-check\"]"); el_val_t log_tags = EL_STR("[\"security-audit\",\"threat-check\"]");
el_val_t discard = mem_remember(log_content, log_tags); el_val_t discard = mem_remember(log_content, log_tags);
@@ -643,7 +694,7 @@ el_val_t threat_history_append(el_val_t text) {
el_val_t safe_text = str_to_lower(text); el_val_t safe_text = str_to_lower(text);
el_val_t combined = el_str_concat(el_str_concat(current, EL_STR(" ")), safe_text); el_val_t combined = el_str_concat(el_str_concat(current, EL_STR(" ")), safe_text);
el_val_t len = str_len(combined); el_val_t len = str_len(combined);
el_val_t trimmed = ({ el_val_t _if_result_72 = 0; if ((len > 2000)) { _if_result_72 = (str_slice(combined, (len - 2000), len)); } else { _if_result_72 = (combined); } _if_result_72; }); el_val_t trimmed = ({ el_val_t _if_result_81 = 0; if ((len > 2000)) { _if_result_81 = (str_slice(combined, (len - 2000), len)); } else { _if_result_81 = (combined); } _if_result_81; });
state_set(EL_STR("agentic_conv_history"), trimmed); state_set(EL_STR("agentic_conv_history"), trimmed);
return 0; return 0;
} }