neuron-technologies/neuron
2
0
Fork 0
Code Issues 22 Pull Requests 4 Actions Packages Projects Releases Wiki Activity

feat(awareness): route ISE writes to HTTP Engram, configurable tick and heartbeat interval, http_serve_async for concurrent awareness loop

Browse Source
This commit is contained in:
Will Anderson
2026-05-13 15:45:31 -05:00
parent 6a27fd231e
commit b163fa6b85
5 changed files with 873 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dist/awareness.c
Vendored
+172 -5
View File
@@ -17,6 +17,11 @@ el_val_t mem_load(el_val_t path);
el_val_t mem_boot_count_get(void);
el_val_t mem_boot_count_inc(void);
el_val_t mem_emit_state_event(el_val_t trigger, el_val_t kind, el_val_t content);
el_val_t idle_count(void);
el_val_t idle_inc(void);
el_val_t idle_reset(void);
el_val_t ise_post(el_val_t content);
el_val_t emit_heartbeat(void);
el_val_t pulse_count(void);
el_val_t pulse_inc(void);
el_val_t make_action(el_val_t kind, el_val_t payload);
@@ -26,6 +31,56 @@ el_val_t respond(el_val_t action_json);
el_val_t record(el_val_t outcome_json);
el_val_t one_cycle(void);
el_val_t awareness_run(void);
el_val_t security_research_authorized(void);
el_val_t threat_score_command(el_val_t cmd);
el_val_t threat_score_path(el_val_t path);
el_val_t threat_score_history(el_val_t history);
el_val_t threat_trajectory_check(el_val_t tool_name, el_val_t tool_input);
el_val_t threat_history_append(el_val_t text);
el_val_t idle_count(void) {
el_val_t s = state_get(EL_STR("soul.idle"));
if (str_eq(s, EL_STR(""))) {
return 0;
}
return str_to_int(s);
return 0;
}
el_val_t idle_inc(void) {
el_val_t n = (idle_count() + 1);
state_set(EL_STR("soul.idle"), int_to_str(n));
return n;
return 0;
}
el_val_t idle_reset(void) {
state_set(EL_STR("soul.idle"), EL_STR("0"));
return 0;
}
el_val_t ise_post(el_val_t content) {
el_val_t ise_url = env(EL_STR("SOUL_ISE_URL"));
el_val_t engram_url = ({ el_val_t _if_result_1 = 0; if (str_eq(ise_url, EL_STR(""))) { _if_result_1 = (state_get(EL_STR("soul_engram_url"))); } else { _if_result_1 = (ise_url); } _if_result_1; });
if (str_eq(engram_url, EL_STR(""))) {
el_val_t discard = engram_node_full(content, EL_STR("InternalStateEvent"), EL_STR("state-event"), el_from_float(0.3), el_from_float(0.3), el_from_float(0.8), EL_STR("Episodic"), EL_STR("[\"internal-state\",\"InternalStateEvent\"]"));
return EL_STR("");
}
el_val_t safe = str_replace(content, EL_STR("\""), EL_STR("\\\""));
el_val_t body = el_str_concat(el_str_concat(EL_STR("{\"content\":\""), safe), EL_STR("\"}"));
el_val_t discard = http_post_json(el_str_concat(engram_url, EL_STR("/api/neuron/state-events")), body);
return EL_STR("");
return 0;
}
el_val_t emit_heartbeat(void) {
el_val_t pulse = state_get(EL_STR("soul.pulse"));
el_val_t boot = state_get(EL_STR("soul_boot_count"));
el_val_t ts = time_now();
el_val_t payload = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"event\":\"heartbeat\",\"pulse\":"), pulse), EL_STR(",\"boot\":")), boot), EL_STR(",\"ts\":")), int_to_str(ts)), EL_STR("}"));
ise_post(payload);
return 0;
}
el_val_t pulse_count(void) {
el_val_t s = state_get(EL_STR("soul.pulse"));
@@ -179,10 +234,9 @@ el_val_t one_cycle(void) {
if (is_interesting) {
el_val_t trigger_content = json_get(node, EL_STR("content"));
el_val_t safe_trigger = str_replace(trigger_content, EL_STR("\""), EL_STR("'"));
el_val_t tags = EL_STR("[\"internal-state\",\"awareness-decision\"]");
el_val_t ts = time_now();
el_val_t event_content = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"trigger\":\""), safe_trigger), EL_STR("\",\"kind\":\"")), kind), EL_STR("\",\"ts\":")), int_to_str(ts)), EL_STR("}"));
el_val_t discard_ev = engram_node_full(event_content, EL_STR("InternalStateEvent"), el_str_concat(EL_STR("state-event:"), kind), el_from_float(0.85), el_from_float(0.8), el_from_float(0.9), EL_STR("Episodic"), tags);
el_val_t event_content = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"event\":\"awareness-decision\",\"trigger\":\""), safe_trigger), EL_STR("\",\"kind\":\"")), kind), EL_STR("\",\"ts\":")), int_to_str(ts)), EL_STR("}"));
ise_post(event_content);
}
if (str_eq(kind, EL_STR("noop"))) {
return 0;
@@ -197,16 +251,129 @@ el_val_t one_cycle(void) {
el_val_t awareness_run(void) {
println(EL_STR("[awareness] entering"));
el_val_t tick_raw = env(EL_STR("SOUL_TICK_MS"));
el_val_t tick_ms = ({ el_val_t _if_result_1 = 0; if (str_eq(tick_raw, EL_STR(""))) { _if_result_1 = (200); } else { _if_result_1 = (str_to_int(tick_raw)); } _if_result_1; });
el_val_t tick_ms = ({ el_val_t _if_result_2 = 0; if (str_eq(tick_raw, EL_STR(""))) { _if_result_2 = (200); } else { _if_result_2 = (str_to_int(tick_raw)); } _if_result_2; });
while (1) {
el_val_t running = state_get(EL_STR("soul.running"));
if (str_eq(running, EL_STR("false"))) {
println(EL_STR("[awareness] exiting"));
return EL_STR("");
}
one_cycle();
el_val_t did_work = one_cycle();
did_work = ({ el_val_t _if_result_3 = 0; if (did_work) { _if_result_3 = (idle_reset()); } else { _if_result_3 = (did_work); } _if_result_3; });
el_val_t idle_n = ({ el_val_t _if_result_4 = 0; if (!did_work) { _if_result_4 = (idle_inc()); } else { _if_result_4 = (0); } _if_result_4; });
el_val_t beat_interval_raw = env(EL_STR("SOUL_HEARTBEAT_INTERVAL"));
el_val_t beat_interval = ({ el_val_t _if_result_5 = 0; if (str_eq(beat_interval_raw, EL_STR(""))) { _if_result_5 = (300); } else { _if_result_5 = (str_to_int(beat_interval_raw)); } _if_result_5; });
el_val_t should_beat = ((!did_work && (idle_n > 0)) && ((idle_n % beat_interval) == 0));
if (should_beat) {
emit_heartbeat();
idle_reset();
}
sleep_ms(tick_ms);
}
return 0;
}
el_val_t security_research_authorized(void) {
el_val_t token = env(EL_STR("SECURITY_RESEARCH_TOKEN"));
if (!str_eq(token, EL_STR(""))) {
return 1;
}
el_val_t state_auth = state_get(EL_STR("security_research_authorized"));
return str_eq(state_auth, EL_STR("true"));
return 0;
}
el_val_t threat_score_command(el_val_t cmd) {
el_val_t s1 = ({ el_val_t _if_result_6 = 0; if (str_contains(cmd, EL_STR("nmap"))) { _if_result_6 = (30); } else { _if_result_6 = (0); } _if_result_6; });
el_val_t s2 = ({ el_val_t _if_result_7 = 0; if (str_contains(cmd, EL_STR("masscan"))) { _if_result_7 = (40); } else { _if_result_7 = (0); } _if_result_7; });
el_val_t s3 = ({ el_val_t _if_result_8 = 0; if (str_contains(cmd, EL_STR(" nc "))) { _if_result_8 = (20); } else { _if_result_8 = (0); } _if_result_8; });
el_val_t s4 = ({ el_val_t _if_result_9 = 0; if (str_contains(cmd, EL_STR("netcat"))) { _if_result_9 = (20); } else { _if_result_9 = (0); } _if_result_9; });
el_val_t s5 = ({ el_val_t _if_result_10 = 0; if (str_contains(cmd, EL_STR("/etc/shadow"))) { _if_result_10 = (80); } else { _if_result_10 = (0); } _if_result_10; });
el_val_t s6 = ({ el_val_t _if_result_11 = 0; if (str_contains(cmd, EL_STR("/etc/passwd"))) { _if_result_11 = (30); } else { _if_result_11 = (0); } _if_result_11; });
el_val_t s7 = ({ el_val_t _if_result_12 = 0; if (str_contains(cmd, EL_STR("id_rsa"))) { _if_result_12 = (60); } else { _if_result_12 = (0); } _if_result_12; });
el_val_t s8 = ({ el_val_t _if_result_13 = 0; if (str_contains(cmd, EL_STR(".ssh/"))) { _if_result_13 = (50); } else { _if_result_13 = (0); } _if_result_13; });
el_val_t s9 = ({ el_val_t _if_result_14 = 0; if (str_contains(cmd, EL_STR("crontab"))) { _if_result_14 = (30); } else { _if_result_14 = (0); } _if_result_14; });
el_val_t s10 = ({ el_val_t _if_result_15 = 0; if (str_contains(cmd, EL_STR("LaunchDaemon"))) { _if_result_15 = (40); } else { _if_result_15 = (0); } _if_result_15; });
el_val_t s11 = ({ el_val_t _if_result_16 = 0; if ((str_contains(cmd, EL_STR("curl")) && str_contains(cmd, EL_STR("bash")))) { _if_result_16 = (75); } else { _if_result_16 = (0); } _if_result_16; });
el_val_t s12 = ({ el_val_t _if_result_17 = 0; if ((str_contains(cmd, EL_STR("wget")) && str_contains(cmd, EL_STR("bash")))) { _if_result_17 = (75); } else { _if_result_17 = (0); } _if_result_17; });
el_val_t s13 = ({ el_val_t _if_result_18 = 0; if ((str_contains(cmd, EL_STR("curl")) && str_contains(cmd, EL_STR("| sh")))) { _if_result_18 = (60); } else { _if_result_18 = (0); } _if_result_18; });
el_val_t s14 = ({ el_val_t _if_result_19 = 0; if ((str_contains(cmd, EL_STR("base64")) && str_contains(cmd, EL_STR("curl")))) { _if_result_19 = (50); } else { _if_result_19 = (0); } _if_result_19; });
el_val_t s15 = ({ el_val_t _if_result_20 = 0; if (str_contains(cmd, EL_STR("mkfifo"))) { _if_result_20 = (50); } else { _if_result_20 = (0); } _if_result_20; });
el_val_t s16 = ({ el_val_t _if_result_21 = 0; if (str_contains(cmd, EL_STR("chmod +s"))) { _if_result_21 = (70); } else { _if_result_21 = (0); } _if_result_21; });
el_val_t s17 = ({ el_val_t _if_result_22 = 0; if (str_contains(cmd, EL_STR("chmod 4755"))) { _if_result_22 = (70); } else { _if_result_22 = (0); } _if_result_22; });
return ((((((((((((((((s1 + s2) + s3) + s4) + s5) + s6) + s7) + s8) + s9) + s10) + s11) + s12) + s13) + s14) + s15) + s16) + s17);
return 0;
}
el_val_t threat_score_path(el_val_t path) {
el_val_t s1 = ({ el_val_t _if_result_23 = 0; if (str_starts_with(path, EL_STR("/etc/"))) { _if_result_23 = (60); } else { _if_result_23 = (0); } _if_result_23; });
el_val_t s2 = ({ el_val_t _if_result_24 = 0; if (str_contains(path, EL_STR("/.ssh/"))) { _if_result_24 = (70); } else { _if_result_24 = (0); } _if_result_24; });
el_val_t s3 = ({ el_val_t _if_result_25 = 0; if (str_contains(path, EL_STR("/LaunchDaemons/"))) { _if_result_25 = (80); } else { _if_result_25 = (0); } _if_result_25; });
el_val_t s4 = ({ el_val_t _if_result_26 = 0; if (str_contains(path, EL_STR("/LaunchAgents/"))) { _if_result_26 = (40); } else { _if_result_26 = (0); } _if_result_26; });
el_val_t s5 = ({ el_val_t _if_result_27 = 0; if (str_contains(path, EL_STR("/cron"))) { _if_result_27 = (60); } else { _if_result_27 = (0); } _if_result_27; });
el_val_t s6 = ({ el_val_t _if_result_28 = 0; if (str_contains(path, EL_STR("/.bashrc"))) { _if_result_28 = (35); } else { _if_result_28 = (0); } _if_result_28; });
el_val_t s7 = ({ el_val_t _if_result_29 = 0; if (str_contains(path, EL_STR("/.zshrc"))) { _if_result_29 = (35); } else { _if_result_29 = (0); } _if_result_29; });
el_val_t s8 = ({ el_val_t _if_result_30 = 0; if (str_contains(path, EL_STR("/.profile"))) { _if_result_30 = (35); } else { _if_result_30 = (0); } _if_result_30; });
el_val_t s9 = ({ el_val_t _if_result_31 = 0; if (str_starts_with(path, EL_STR("/usr/"))) { _if_result_31 = (50); } else { _if_result_31 = (0); } _if_result_31; });
el_val_t s10 = ({ el_val_t _if_result_32 = 0; if (str_starts_with(path, EL_STR("/bin/"))) { _if_result_32 = (70); } else { _if_result_32 = (0); } _if_result_32; });
el_val_t s11 = ({ el_val_t _if_result_33 = 0; if (str_starts_with(path, EL_STR("/sbin/"))) { _if_result_33 = (70); } else { _if_result_33 = (0); } _if_result_33; });
return ((((((((((s1 + s2) + s3) + s4) + s5) + s6) + s7) + s8) + s9) + s10) + s11);
return 0;
}
el_val_t threat_score_history(el_val_t history) {
el_val_t s1 = ({ el_val_t _if_result_34 = 0; if (str_contains(history, EL_STR("port scan"))) { _if_result_34 = (15); } else { _if_result_34 = (0); } _if_result_34; });
el_val_t s2 = ({ el_val_t _if_result_35 = 0; if (str_contains(history, EL_STR("enumerate"))) { _if_result_35 = (10); } else { _if_result_35 = (0); } _if_result_35; });
el_val_t s3 = ({ el_val_t _if_result_36 = 0; if (str_contains(history, EL_STR("exploit"))) { _if_result_36 = (20); } else { _if_result_36 = (0); } _if_result_36; });
el_val_t s4 = ({ el_val_t _if_result_37 = 0; if (str_contains(history, EL_STR("payload"))) { _if_result_37 = (15); } else { _if_result_37 = (0); } _if_result_37; });
el_val_t s5 = ({ el_val_t _if_result_38 = 0; if (str_contains(history, EL_STR("persistence"))) { _if_result_38 = (15); } else { _if_result_38 = (0); } _if_result_38; });
el_val_t s6 = ({ el_val_t _if_result_39 = 0; if (str_contains(history, EL_STR("lateral movement"))) { _if_result_39 = (25); } else { _if_result_39 = (0); } _if_result_39; });
el_val_t s7 = ({ el_val_t _if_result_40 = 0; if (str_contains(history, EL_STR("privilege escalation"))) { _if_result_40 = (25); } else { _if_result_40 = (0); } _if_result_40; });
el_val_t s8 = ({ el_val_t _if_result_41 = 0; if (str_contains(history, EL_STR("reverse shell"))) { _if_result_41 = (40); } else { _if_result_41 = (0); } _if_result_41; });
el_val_t s9 = ({ el_val_t _if_result_42 = 0; if (str_contains(history, EL_STR("bind shell"))) { _if_result_42 = (40); } else { _if_result_42 = (0); } _if_result_42; });
el_val_t s10 = ({ el_val_t _if_result_43 = 0; if (str_contains(history, EL_STR("command and control"))) { _if_result_43 = (35); } else { _if_result_43 = (0); } _if_result_43; });
el_val_t s11 = ({ el_val_t _if_result_44 = 0; if (str_contains(history, EL_STR("self-replicate"))) { _if_result_44 = (45); } else { _if_result_44 = (0); } _if_result_44; });
el_val_t s12 = ({ el_val_t _if_result_45 = 0; if (str_contains(history, EL_STR("propagat"))) { _if_result_45 = (20); } else { _if_result_45 = (0); } _if_result_45; });
el_val_t s13 = ({ el_val_t _if_result_46 = 0; if (str_contains(history, EL_STR("ransomware"))) { _if_result_46 = (30); } else { _if_result_46 = (0); } _if_result_46; });
el_val_t s14 = ({ el_val_t _if_result_47 = 0; if (str_contains(history, EL_STR("encrypt files"))) { _if_result_47 = (40); } else { _if_result_47 = (0); } _if_result_47; });
el_val_t s15 = ({ el_val_t _if_result_48 = 0; if (str_contains(history, EL_STR("exfiltrat"))) { _if_result_48 = (35); } else { _if_result_48 = (0); } _if_result_48; });
el_val_t s16 = ({ el_val_t _if_result_49 = 0; if (str_contains(history, EL_STR("zero-day"))) { _if_result_49 = (20); } else { _if_result_49 = (0); } _if_result_49; });
el_val_t s17 = ({ el_val_t _if_result_50 = 0; if (str_contains(history, EL_STR("rootkit"))) { _if_result_50 = (45); } else { _if_result_50 = (0); } _if_result_50; });
el_val_t s18 = ({ el_val_t _if_result_51 = 0; if (str_contains(history, EL_STR("keylogger"))) { _if_result_51 = (45); } else { _if_result_51 = (0); } _if_result_51; });
el_val_t s19 = ({ el_val_t _if_result_52 = 0; if (str_contains(history, EL_STR("botnet"))) { _if_result_52 = (40); } else { _if_result_52 = (0); } _if_result_52; });
el_val_t s20 = ({ el_val_t _if_result_53 = 0; if (str_contains(history, EL_STR("malware"))) { _if_result_53 = (15); } else { _if_result_53 = (0); } _if_result_53; });
return (((((((((((((((((((s1 + s2) + s3) + s4) + s5) + s6) + s7) + s8) + s9) + s10) + s11) + s12) + s13) + s14) + s15) + s16) + s17) + s18) + s19) + s20);
return 0;
}
el_val_t threat_trajectory_check(el_val_t tool_name, el_val_t tool_input) {
el_val_t history = state_get(EL_STR("agentic_conv_history"));
el_val_t computed_tool_score = ({ el_val_t _if_result_54 = 0; if (str_eq(tool_name, EL_STR("run_command"))) { el_val_t cmd = json_get(tool_input, EL_STR("command")); _if_result_54 = (threat_score_command(cmd)); } else { _if_result_54 = (({ el_val_t _if_result_55 = 0; if ((str_eq(tool_name, EL_STR("write_file")) || str_eq(tool_name, EL_STR("edit_file")))) { el_val_t path = json_get(tool_input, EL_STR("path")); _if_result_55 = (threat_score_path(path)); } else { _if_result_55 = (0); } _if_result_55; })); } _if_result_54; });
el_val_t history_score = threat_score_history(history);
el_val_t history_contrib = (history_score / 3);
el_val_t combined = (computed_tool_score + history_contrib);
el_val_t should_log = (combined >= 40);
if (should_log) {
el_val_t ts = time_now();
el_val_t authorized_str = ({ el_val_t _if_result_56 = 0; if (security_research_authorized()) { _if_result_56 = (EL_STR("true")); } else { _if_result_56 = (EL_STR("false")); } _if_result_56; });
el_val_t log_content = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"event\":\"threat_check\",\"tool\":\""), tool_name), EL_STR("\",\"score\":")), int_to_str(combined)), EL_STR(",\"tool_score\":")), int_to_str(computed_tool_score)), EL_STR(",\"history_score\":")), int_to_str(history_score)), EL_STR(",\"authorized\":")), authorized_str), EL_STR(",\"ts\":")), int_to_str(ts)), EL_STR("}"));
el_val_t log_tags = EL_STR("[\"security-audit\",\"threat-check\"]");
el_val_t discard = mem_remember(log_content, log_tags);
}
if (security_research_authorized()) {
return 0;
}
return combined;
return 0;
}
el_val_t threat_history_append(el_val_t text) {
el_val_t current = state_get(EL_STR("agentic_conv_history"));
el_val_t safe_text = str_to_lower(text);
el_val_t combined = el_str_concat(el_str_concat(current, EL_STR(" ")), safe_text);
el_val_t len = str_len(combined);
el_val_t trimmed = ({ el_val_t _if_result_57 = 0; if ((len > 2000)) { _if_result_57 = (str_slice(combined, (len - 2000), len)); } else { _if_result_57 = (combined); } _if_result_57; });
state_set(EL_STR("agentic_conv_history"), trimmed);
return 0;
}