From d5588ed4aa8f1ac34a710524025be2260b794ca2 Mon Sep 17 00:00:00 2001 From: "will.anderson" Date: Thu, 13 Aug 2026 08:43:25 -0500 Subject: [PATCH] self-review 2026-08-13: seed curiosity from the argmax, not the first word MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit auto_term_try_slot now passes the WM node's ID to engram_salient_term() instead of passing its label to a first-word extractor. The runtime scores every candidate token in the node's text and returns the best one, falling back from a sentinel label ("memory:remembered") to content — which is the only reason Memory nodes are visible to the extractor at all. They dominate working memory, and dynamic seeding had been dead for 50+ consecutive scans because of it. Policy stays here: node-type filter, df thresholds, stopword list. The runtime measures, the soul decides — same split as engram_label_df. The stopword list stays, and not as belt-and-braces. An earlier draft assumed the min_df floor would subsume it based on 08-03's finding that function words have df 0 in labels. Re-measured under word-boundary df: about:2, whole:1, them:2 — they clear a floor of 1. What keeps them from winning is the argmax, not the floor. The old extractor and its five guards are retained as auto_term_try_slot_legacy, unreferenced, so the reasoning behind each guard stays readable next to what replaced it. Delete once the new path has a month of live telemetry. Live after restart: auto_term producing DRIFT, Wrote; empty streak reset to 0 and holding; activation counts 123-281, within the normal band, no flood. --- awareness.el | 94 ++++++++++++++++++++--- dist/awareness.c | 195 ++++++++++++++++++++++++++++------------------- dist/neuron.c | 1 + 3 files changed, 200 insertions(+), 90 deletions(-) diff --git a/awareness.el b/awareness.el index 400212d..9c44506 100644 --- a/awareness.el +++ b/awareness.el @@ -587,7 +587,77 @@ fn emit_heartbeat() -> Void { // neuron-api label fix. Sentinel-shaped labels ("knowledge:captured", // "memory:remembered" — colon, no space) carry no seed signal and are // skipped so legacy nodes cannot seed the scan with the word "knowledge". -fn auto_term_try_slot(slot_type: String, slot_lbl: String) -> Void { +// ARGMAX REWRITE (2026-08-13 self-review). auto_term_empty_streak — the +// counter the 2026-08-06 review added to catch exactly this — read 50 and +// climbing: fifty consecutive scans where dynamic seeding produced nothing +// and the loop ran on its four hardcoded phrases. The live WM top said why: +// every one of the top slots was a Memory node labelled "memory:remembered". +// This function read the LABEL only, the sentinel guard below (correctly) +// rejects sentinels, so there was never anything to extract. The extractor +// was written against Knowledge nodes, which have real titles, and was +// structurally blind to the node type that actually dominates WM. +// +// Rather than add a sixth guard to the five below, the selection algorithm +// is now inverted and lives in the runtime: engram_salient_term() scores +// EVERY candidate token in the node's text and returns the argmax of +// idf·position·casing (YAKE, Campos et al. 2020, with real corpus IDF +// substituted for YAKE's corpus-free proxies), falling back from a sentinel +// label to the node's content. Term quality is now the selection criterion +// instead of a veto, so a bad token loses to a better token in the same text +// without needing to be on any list. Tabu is applied during the argmax, so +// inhibition-of-return costs seed quality rather than costing the scan. +// +// MEASURED BEFORE SHIPPING, on 60 live Memory nodes: 0 empty, versus 60 of 60 +// empty under the old extractor. Terms produced are topical — HEBBIAN, +// CONSOLIDATION, TEMPORAL, crash-loop, PRIMING, NEIGHBORHOOD, DRIFT. Three of +// sixty are weak header words ("STEP", "DONE"). They are left alone +// deliberately: adding them to a list is the exact move that produced four +// previous blocklists, and a mediocre seed on 5% of scans is not a flood. +// +// The stopword list below STAYS, and not as belt-and-braces. An earlier draft +// of this change assumed the min_df floor would subsume it, on 08-03's +// finding that function words have df 0 in labels. Re-measured under +// word-boundary df: about:2, whole:1, them:2 — they clear a floor of 1. What +// keeps them from winning is the argmax, not the floor. The list still earns +// its keep on the Title-case cases. +// +// What stays here is policy: the node-type filter, the df thresholds, and the +// stopword list. The runtime measures; the soul decides. Same split as +// engram_label_df. +fn auto_term_try_slot(slot_type: String, slot_id: String) -> Void { + state_set("_ats_ok", "0") + if str_eq(slot_type, "Memory") { state_set("_ats_ok", "1") } + if str_eq(slot_type, "BacklogItem") { state_set("_ats_ok", "1") } + if str_eq(slot_type, "Entity") { state_set("_ats_ok", "1") } + if str_eq(slot_type, "Knowledge") { state_set("_ats_ok", "1") } + if str_eq(state_get("_ats_ok"), "1") { + if !str_eq(slot_id, "") { + // Tabu ring, pipe-delimited, excluded inside the argmax. + let tabu: String = "|" + state_get("soul.tabu_t0") + + "|" + state_get("soul.tabu_t1") + + "|" + state_get("soul.tabu_t2") + + "|" + state_get("soul.tabu_t3") + "|" + let df_max: Int = engram_node_count() / 400 + let df_cap: Int = if df_max > 8 { df_max } else { 8 } + let term: String = engram_salient_term(slot_id, df_cap, 1, tabu) + if !str_eq(term, "") { + state_set("_ats_gw", "0") + let stopw: String = "|What|When|Where|Which|Whose|While|This|That|These|Those|There|Their|Then|Than|With|Without|From|Into|Onto|Over|Under|About|Between|Among|Across|Some|Most|More|Less|Very|Each|Every|Both|Also|Only|Just|Does|Will|Would|Could|Should|Might|Must|Have|Been|Being|Toward|Towards|Using|Based|Upon|Here|Your|Ours|They|Them|what|this|that|with|from|context|Context|Prose|Colon|Self|Test|Testing|Closing|Global|Universal|Persona|Semantic|Spreading|Temporal|Numeric|Register|Identifying|Introduction|Overview|Summary|Section|General|Notes|Note|" + if str_contains(stopw, "|" + term + "|") { state_set("_ats_gw", "1") } + if str_eq(state_get("_ats_gw"), "0") { + state_set("cseed_auto", term) + } + } + } + } + return "" +} + +// SUPERSEDED 2026-08-13 — retained for the record. The first-word extractor +// and its five accumulated guards, replaced by the argmax above. Kept +// unreferenced so the reasoning behind each guard stays readable next to what +// replaced it; delete once engram_salient_term has a month of live telemetry. +fn auto_term_try_slot_legacy(slot_type: String, slot_lbl: String) -> Void { state_set("_ats_ok", "0") if str_eq(slot_type, "Memory") { state_set("_ats_ok", "1") } if str_eq(slot_type, "BacklogItem") { state_set("_ats_ok", "1") } @@ -806,16 +876,18 @@ fn proactive_curiosity() -> Bool { let wm10_n2: String = json_array_get(wm10, 2) let wm10_n1: String = json_array_get(wm10, 1) let wm10_n0: String = json_array_get(wm10, 0) - auto_term_try_slot(json_get(wm10_n9, "node_type"), json_get(wm10_n9, "label")) - auto_term_try_slot(json_get(wm10_n8, "node_type"), json_get(wm10_n8, "label")) - auto_term_try_slot(json_get(wm10_n7, "node_type"), json_get(wm10_n7, "label")) - auto_term_try_slot(json_get(wm10_n6, "node_type"), json_get(wm10_n6, "label")) - auto_term_try_slot(json_get(wm10_n5, "node_type"), json_get(wm10_n5, "label")) - auto_term_try_slot(json_get(wm10_n4, "node_type"), json_get(wm10_n4, "label")) - auto_term_try_slot(json_get(wm10_n3, "node_type"), json_get(wm10_n3, "label")) - auto_term_try_slot(json_get(wm10_n2, "node_type"), json_get(wm10_n2, "label")) - auto_term_try_slot(json_get(wm10_n1, "node_type"), json_get(wm10_n1, "label")) - auto_term_try_slot(json_get(wm10_n0, "node_type"), json_get(wm10_n0, "label")) + // 2026-08-13: pass the node ID, not the label. engram_salient_term reads + // the node directly so it can fall back from a sentinel label to content. + auto_term_try_slot(json_get(wm10_n9, "node_type"), json_get(wm10_n9, "id")) + auto_term_try_slot(json_get(wm10_n8, "node_type"), json_get(wm10_n8, "id")) + auto_term_try_slot(json_get(wm10_n7, "node_type"), json_get(wm10_n7, "id")) + auto_term_try_slot(json_get(wm10_n6, "node_type"), json_get(wm10_n6, "id")) + auto_term_try_slot(json_get(wm10_n5, "node_type"), json_get(wm10_n5, "id")) + auto_term_try_slot(json_get(wm10_n4, "node_type"), json_get(wm10_n4, "id")) + auto_term_try_slot(json_get(wm10_n3, "node_type"), json_get(wm10_n3, "id")) + auto_term_try_slot(json_get(wm10_n2, "node_type"), json_get(wm10_n2, "id")) + auto_term_try_slot(json_get(wm10_n1, "node_type"), json_get(wm10_n1, "id")) + auto_term_try_slot(json_get(wm10_n0, "node_type"), json_get(wm10_n0, "id")) let auto_term: String = state_get("cseed_auto") let results_auto: String = if str_eq(auto_term, "") { "[]" } else { engram_activate_json(auto_term, 1) } let found_auto: Int = json_array_len(results_auto) diff --git a/dist/awareness.c b/dist/awareness.c index 4114904..aed7fff 100644 --- a/dist/awareness.c +++ b/dist/awareness.c @@ -27,7 +27,8 @@ el_val_t elapsed_ms(void); el_val_t elapsed_human(void); el_val_t embed_ok(void); el_val_t emit_heartbeat(void); -el_val_t auto_term_try_slot(el_val_t slot_type, el_val_t slot_lbl); +el_val_t auto_term_try_slot(el_val_t slot_type, el_val_t slot_id); +el_val_t auto_term_try_slot_legacy(el_val_t slot_type, el_val_t slot_lbl); el_val_t proactive_curiosity(void); el_val_t pulse_count(void); el_val_t pulse_inc(void); @@ -323,7 +324,43 @@ el_val_t emit_heartbeat(void) { return 0; } -el_val_t auto_term_try_slot(el_val_t slot_type, el_val_t slot_lbl) { +el_val_t auto_term_try_slot(el_val_t slot_type, el_val_t slot_id) { + state_set(EL_STR("_ats_ok"), EL_STR("0")); + if (str_eq(slot_type, EL_STR("Memory"))) { + state_set(EL_STR("_ats_ok"), EL_STR("1")); + } + if (str_eq(slot_type, EL_STR("BacklogItem"))) { + state_set(EL_STR("_ats_ok"), EL_STR("1")); + } + if (str_eq(slot_type, EL_STR("Entity"))) { + state_set(EL_STR("_ats_ok"), EL_STR("1")); + } + if (str_eq(slot_type, EL_STR("Knowledge"))) { + state_set(EL_STR("_ats_ok"), EL_STR("1")); + } + if (str_eq(state_get(EL_STR("_ats_ok")), EL_STR("1"))) { + if (!str_eq(slot_id, EL_STR(""))) { + el_val_t tabu = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("|"), state_get(EL_STR("soul.tabu_t0"))), EL_STR("|")), state_get(EL_STR("soul.tabu_t1"))), EL_STR("|")), state_get(EL_STR("soul.tabu_t2"))), EL_STR("|")), state_get(EL_STR("soul.tabu_t3"))), EL_STR("|")); + el_val_t df_max = (engram_node_count() / 400); + el_val_t df_cap = ({ el_val_t _if_result_73 = 0; if ((df_max > 8)) { _if_result_73 = (df_max); } else { _if_result_73 = (8); } _if_result_73; }); + el_val_t term = engram_salient_term(slot_id, df_cap, 1, tabu); + if (!str_eq(term, EL_STR(""))) { + state_set(EL_STR("_ats_gw"), EL_STR("0")); + el_val_t stopw = EL_STR("|What|When|Where|Which|Whose|While|This|That|These|Those|There|Their|Then|Than|With|Without|From|Into|Onto|Over|Under|About|Between|Among|Across|Some|Most|More|Less|Very|Each|Every|Both|Also|Only|Just|Does|Will|Would|Could|Should|Might|Must|Have|Been|Being|Toward|Towards|Using|Based|Upon|Here|Your|Ours|They|Them|what|this|that|with|from|context|Context|Prose|Colon|Self|Test|Testing|Closing|Global|Universal|Persona|Semantic|Spreading|Temporal|Numeric|Register|Identifying|Introduction|Overview|Summary|Section|General|Notes|Note|"); + if (str_contains(stopw, el_str_concat(el_str_concat(EL_STR("|"), term), EL_STR("|")))) { + state_set(EL_STR("_ats_gw"), EL_STR("1")); + } + if (str_eq(state_get(EL_STR("_ats_gw")), EL_STR("0"))) { + state_set(EL_STR("cseed_auto"), term); + } + } + } + } + return EL_STR(""); + return 0; +} + +el_val_t auto_term_try_slot_legacy(el_val_t slot_type, el_val_t slot_lbl) { state_set(EL_STR("_ats_ok"), EL_STR("0")); if (str_eq(slot_type, EL_STR("Memory"))) { state_set(EL_STR("_ats_ok"), EL_STR("1")); @@ -460,29 +497,29 @@ el_val_t proactive_curiosity(void) { el_val_t wm10_n2 = json_array_get(wm10, 2); el_val_t wm10_n1 = json_array_get(wm10, 1); el_val_t wm10_n0 = json_array_get(wm10, 0); - auto_term_try_slot(json_get(wm10_n9, EL_STR("node_type")), json_get(wm10_n9, EL_STR("label"))); - auto_term_try_slot(json_get(wm10_n8, EL_STR("node_type")), json_get(wm10_n8, EL_STR("label"))); - auto_term_try_slot(json_get(wm10_n7, EL_STR("node_type")), json_get(wm10_n7, EL_STR("label"))); - auto_term_try_slot(json_get(wm10_n6, EL_STR("node_type")), json_get(wm10_n6, EL_STR("label"))); - auto_term_try_slot(json_get(wm10_n5, EL_STR("node_type")), json_get(wm10_n5, EL_STR("label"))); - auto_term_try_slot(json_get(wm10_n4, EL_STR("node_type")), json_get(wm10_n4, EL_STR("label"))); - auto_term_try_slot(json_get(wm10_n3, EL_STR("node_type")), json_get(wm10_n3, EL_STR("label"))); - auto_term_try_slot(json_get(wm10_n2, EL_STR("node_type")), json_get(wm10_n2, EL_STR("label"))); - auto_term_try_slot(json_get(wm10_n1, EL_STR("node_type")), json_get(wm10_n1, EL_STR("label"))); - auto_term_try_slot(json_get(wm10_n0, EL_STR("node_type")), json_get(wm10_n0, EL_STR("label"))); + auto_term_try_slot(json_get(wm10_n9, EL_STR("node_type")), json_get(wm10_n9, EL_STR("id"))); + auto_term_try_slot(json_get(wm10_n8, EL_STR("node_type")), json_get(wm10_n8, EL_STR("id"))); + auto_term_try_slot(json_get(wm10_n7, EL_STR("node_type")), json_get(wm10_n7, EL_STR("id"))); + auto_term_try_slot(json_get(wm10_n6, EL_STR("node_type")), json_get(wm10_n6, EL_STR("id"))); + auto_term_try_slot(json_get(wm10_n5, EL_STR("node_type")), json_get(wm10_n5, EL_STR("id"))); + auto_term_try_slot(json_get(wm10_n4, EL_STR("node_type")), json_get(wm10_n4, EL_STR("id"))); + auto_term_try_slot(json_get(wm10_n3, EL_STR("node_type")), json_get(wm10_n3, EL_STR("id"))); + auto_term_try_slot(json_get(wm10_n2, EL_STR("node_type")), json_get(wm10_n2, EL_STR("id"))); + auto_term_try_slot(json_get(wm10_n1, EL_STR("node_type")), json_get(wm10_n1, EL_STR("id"))); + auto_term_try_slot(json_get(wm10_n0, EL_STR("node_type")), json_get(wm10_n0, EL_STR("id"))); el_val_t auto_term = state_get(EL_STR("cseed_auto")); - el_val_t results_auto = ({ el_val_t _if_result_73 = 0; if (str_eq(auto_term, EL_STR(""))) { _if_result_73 = (EL_STR("[]")); } else { _if_result_73 = (engram_activate_json(auto_term, 1)); } _if_result_73; }); + el_val_t results_auto = ({ el_val_t _if_result_74 = 0; if (str_eq(auto_term, EL_STR(""))) { _if_result_74 = (EL_STR("[]")); } else { _if_result_74 = (engram_activate_json(auto_term, 1)); } _if_result_74; }); el_val_t found_auto = json_array_len(results_auto); el_val_t total_found = (found + found_auto); el_val_t safe_auto = str_replace(auto_term, EL_STR("\""), EL_STR("'")); el_val_t prev_auto = state_get(EL_STR("soul.prev_auto_term")); el_val_t atstreak_raw = state_get(EL_STR("soul.auto_term_streak")); - el_val_t atstreak_prev = ({ el_val_t _if_result_74 = 0; if (str_eq(atstreak_raw, EL_STR(""))) { _if_result_74 = (0); } else { _if_result_74 = (str_to_int(atstreak_raw)); } _if_result_74; }); + el_val_t atstreak_prev = ({ el_val_t _if_result_75 = 0; if (str_eq(atstreak_raw, EL_STR(""))) { _if_result_75 = (0); } else { _if_result_75 = (str_to_int(atstreak_raw)); } _if_result_75; }); el_val_t is_empty = str_eq(auto_term, EL_STR("")); - el_val_t atstreak = ({ el_val_t _if_result_75 = 0; if (is_empty) { _if_result_75 = (0); } else { _if_result_75 = (({ el_val_t _if_result_76 = 0; if (str_eq(auto_term, prev_auto)) { _if_result_76 = ((atstreak_prev + 1)); } else { _if_result_76 = (1); } _if_result_76; })); } _if_result_75; }); + el_val_t atstreak = ({ el_val_t _if_result_76 = 0; if (is_empty) { _if_result_76 = (0); } else { _if_result_76 = (({ el_val_t _if_result_77 = 0; if (str_eq(auto_term, prev_auto)) { _if_result_77 = ((atstreak_prev + 1)); } else { _if_result_77 = (1); } _if_result_77; })); } _if_result_76; }); el_val_t atempty_raw = state_get(EL_STR("soul.auto_term_empty_streak")); - el_val_t atempty_prev = ({ el_val_t _if_result_77 = 0; if (str_eq(atempty_raw, EL_STR(""))) { _if_result_77 = (0); } else { _if_result_77 = (str_to_int(atempty_raw)); } _if_result_77; }); - el_val_t atempty = ({ el_val_t _if_result_78 = 0; if (is_empty) { _if_result_78 = ((atempty_prev + 1)); } else { _if_result_78 = (0); } _if_result_78; }); + el_val_t atempty_prev = ({ el_val_t _if_result_78 = 0; if (str_eq(atempty_raw, EL_STR(""))) { _if_result_78 = (0); } else { _if_result_78 = (str_to_int(atempty_raw)); } _if_result_78; }); + el_val_t atempty = ({ el_val_t _if_result_79 = 0; if (is_empty) { _if_result_79 = ((atempty_prev + 1)); } else { _if_result_79 = (0); } _if_result_79; }); state_set(EL_STR("soul.prev_auto_term"), auto_term); state_set(EL_STR("soul.auto_term_streak"), int_to_str(atstreak)); state_set(EL_STR("soul.auto_term_empty_streak"), int_to_str(atempty)); @@ -677,16 +714,16 @@ el_val_t awareness_run(void) { state_set(EL_STR("soul.boot_ts"), int_to_str(time_now())); } el_val_t tick_raw = env(EL_STR("SOUL_TICK_MS")); - el_val_t tick_ms = ({ el_val_t _if_result_79 = 0; if (str_eq(tick_raw, EL_STR(""))) { _if_result_79 = (200); } else { _if_result_79 = (str_to_int(tick_raw)); } _if_result_79; }); + el_val_t tick_ms = ({ el_val_t _if_result_80 = 0; if (str_eq(tick_raw, EL_STR(""))) { _if_result_80 = (200); } else { _if_result_80 = (str_to_int(tick_raw)); } _if_result_80; }); el_val_t beat_ms_raw = env(EL_STR("SOUL_HEARTBEAT_MS")); - el_val_t beat_ms = ({ el_val_t _if_result_80 = 0; if (str_eq(beat_ms_raw, EL_STR(""))) { _if_result_80 = (60000); } else { _if_result_80 = (str_to_int(beat_ms_raw)); } _if_result_80; }); + el_val_t beat_ms = ({ el_val_t _if_result_81 = 0; if (str_eq(beat_ms_raw, EL_STR(""))) { _if_result_81 = (60000); } else { _if_result_81 = (str_to_int(beat_ms_raw)); } _if_result_81; }); el_val_t scan_ms = (beat_ms / 2); while (1) { el_val_t tick_mark = el_arena_push(); el_val_t running = state_get(EL_STR("soul.running")); if (str_eq(running, EL_STR("false"))) { el_val_t sd_boot_raw = state_get(EL_STR("soul_boot_count")); - el_val_t sd_boot = ({ el_val_t _if_result_81 = 0; if (str_eq(sd_boot_raw, EL_STR(""))) { _if_result_81 = (EL_STR("0")); } else { _if_result_81 = (sd_boot_raw); } _if_result_81; }); + el_val_t sd_boot = ({ el_val_t _if_result_82 = 0; if (str_eq(sd_boot_raw, EL_STR(""))) { _if_result_82 = (EL_STR("0")); } else { _if_result_82 = (sd_boot_raw); } _if_result_82; }); el_val_t sd_wb = hebb_consolidate(); ise_post(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"event\":\"shutdown\",\"boot\":"), sd_boot), EL_STR(",\"pulse\":")), int_to_str(pulse_count())), EL_STR(",\"hebb_wb_sent\":")), int_to_str(sd_wb)), EL_STR(",\"uptime_ms\":")), int_to_str(elapsed_ms())), EL_STR(",\"ts\":")), int_to_str(time_now())), EL_STR("}"))); println(EL_STR("[awareness] exiting")); @@ -703,7 +740,7 @@ el_val_t awareness_run(void) { } el_val_t now_ts = time_now(); el_val_t last_beat_str = state_get(EL_STR("soul.last_beat_ts")); - el_val_t last_beat_ts = ({ el_val_t _if_result_82 = 0; if (str_eq(last_beat_str, EL_STR(""))) { _if_result_82 = (0); } else { _if_result_82 = (str_to_int(last_beat_str)); } _if_result_82; }); + el_val_t last_beat_ts = ({ el_val_t _if_result_83 = 0; if (str_eq(last_beat_str, EL_STR(""))) { _if_result_83 = (0); } else { _if_result_83 = (str_to_int(last_beat_str)); } _if_result_83; }); el_val_t beat_elapsed = (now_ts - last_beat_ts); el_val_t should_beat = (beat_elapsed >= beat_ms); if (should_beat) { @@ -717,7 +754,7 @@ el_val_t awareness_run(void) { } } el_val_t last_scan_str = state_get(EL_STR("soul.last_scan_ts")); - el_val_t last_scan_ts = ({ el_val_t _if_result_83 = 0; if (str_eq(last_scan_str, EL_STR(""))) { _if_result_83 = (0); } else { _if_result_83 = (str_to_int(last_scan_str)); } _if_result_83; }); + el_val_t last_scan_ts = ({ el_val_t _if_result_84 = 0; if (str_eq(last_scan_str, EL_STR(""))) { _if_result_84 = (0); } else { _if_result_84 = (str_to_int(last_scan_str)); } _if_result_84; }); el_val_t scan_elapsed = (now_ts - last_scan_ts); el_val_t should_scan = (!did_work && (scan_elapsed >= scan_ms)); if (should_scan) { @@ -725,15 +762,15 @@ el_val_t awareness_run(void) { state_set(EL_STR("soul.last_scan_ts"), int_to_str(now_ts)); } el_val_t refresh_ms_raw = env(EL_STR("SOUL_REFRESH_MS")); - el_val_t refresh_ms = ({ el_val_t _if_result_84 = 0; if (str_eq(refresh_ms_raw, EL_STR(""))) { _if_result_84 = (600000); } else { _if_result_84 = (str_to_int(refresh_ms_raw)); } _if_result_84; }); + el_val_t refresh_ms = ({ el_val_t _if_result_85 = 0; if (str_eq(refresh_ms_raw, EL_STR(""))) { _if_result_85 = (600000); } else { _if_result_85 = (str_to_int(refresh_ms_raw)); } _if_result_85; }); el_val_t last_refresh_str = state_get(EL_STR("soul.last_refresh_ts")); - el_val_t last_refresh_ts = ({ el_val_t _if_result_85 = 0; if (str_eq(last_refresh_str, EL_STR(""))) { _if_result_85 = (0); } else { _if_result_85 = (str_to_int(last_refresh_str)); } _if_result_85; }); + el_val_t last_refresh_ts = ({ el_val_t _if_result_86 = 0; if (str_eq(last_refresh_str, EL_STR(""))) { _if_result_86 = (0); } else { _if_result_86 = (str_to_int(last_refresh_str)); } _if_result_86; }); el_val_t refresh_elapsed = (now_ts - last_refresh_ts); el_val_t should_refresh = (refresh_elapsed >= refresh_ms); if (should_refresh) { el_val_t sync_env_url = env(EL_STR("SOUL_ISE_URL")); - el_val_t sync_state_url = ({ el_val_t _if_result_86 = 0; if (str_eq(sync_env_url, EL_STR(""))) { _if_result_86 = (state_get(EL_STR("soul_engram_url"))); } else { _if_result_86 = (sync_env_url); } _if_result_86; }); - el_val_t engram_url = ({ el_val_t _if_result_87 = 0; if (str_eq(sync_state_url, EL_STR(""))) { _if_result_87 = (EL_STR("http://localhost:8742")); } else { _if_result_87 = (sync_state_url); } _if_result_87; }); + el_val_t sync_state_url = ({ el_val_t _if_result_87 = 0; if (str_eq(sync_env_url, EL_STR(""))) { _if_result_87 = (state_get(EL_STR("soul_engram_url"))); } else { _if_result_87 = (sync_env_url); } _if_result_87; }); + el_val_t engram_url = ({ el_val_t _if_result_88 = 0; if (str_eq(sync_state_url, EL_STR(""))) { _if_result_88 = (EL_STR("http://localhost:8742")); } else { _if_result_88 = (sync_state_url); } _if_result_88; }); if (!str_eq(engram_url, EL_STR(""))) { el_val_t sync_json = http_get(el_str_concat(engram_url, EL_STR("/api/sync"))); el_val_t sync_ok = (!str_eq(sync_json, EL_STR("")) && !str_eq(sync_json, EL_STR("{}"))); @@ -746,10 +783,10 @@ el_val_t awareness_run(void) { fs_write(tmp, sync_json); el_val_t added = engram_load_merge(tmp); el_val_t ret_raw = env(EL_STR("ENGRAM_ISE_RETENTION_MS")); - el_val_t ret_ms = ({ el_val_t _if_result_88 = 0; if (str_eq(ret_raw, EL_STR(""))) { _if_result_88 = (172800000); } else { _if_result_88 = (str_to_int(ret_raw)); } _if_result_88; }); + el_val_t ret_ms = ({ el_val_t _if_result_89 = 0; if (str_eq(ret_raw, EL_STR(""))) { _if_result_89 = (172800000); } else { _if_result_89 = (str_to_int(ret_raw)); } _if_result_89; }); el_val_t pruned_sync = engram_prune_telemetry(ret_ms); el_val_t sat_raw = state_get(EL_STR("soul.sync_added_total")); - el_val_t sat_n = ({ el_val_t _if_result_89 = 0; if (str_eq(sat_raw, EL_STR(""))) { _if_result_89 = (0); } else { _if_result_89 = (str_to_int(sat_raw)); } _if_result_89; }); + el_val_t sat_n = ({ el_val_t _if_result_90 = 0; if (str_eq(sat_raw, EL_STR(""))) { _if_result_90 = (0); } else { _if_result_90 = (str_to_int(sat_raw)); } _if_result_90; }); state_set(EL_STR("soul.sync_added_total"), int_to_str((sat_n + added))); el_val_t ts2 = time_now(); state_set(EL_STR("soul.last_sync_ok_ts"), int_to_str(ts2)); @@ -775,78 +812,78 @@ el_val_t security_research_authorized(void) { } el_val_t threat_score_command(el_val_t cmd) { - el_val_t s1 = ({ el_val_t _if_result_90 = 0; if (str_contains(cmd, EL_STR("nmap"))) { _if_result_90 = (30); } else { _if_result_90 = (0); } _if_result_90; }); - el_val_t s2 = ({ el_val_t _if_result_91 = 0; if (str_contains(cmd, EL_STR("masscan"))) { _if_result_91 = (40); } else { _if_result_91 = (0); } _if_result_91; }); - el_val_t s3 = ({ el_val_t _if_result_92 = 0; if (str_contains(cmd, EL_STR(" nc "))) { _if_result_92 = (20); } else { _if_result_92 = (0); } _if_result_92; }); - el_val_t s4 = ({ el_val_t _if_result_93 = 0; if (str_contains(cmd, EL_STR("netcat"))) { _if_result_93 = (20); } else { _if_result_93 = (0); } _if_result_93; }); - el_val_t s5 = ({ el_val_t _if_result_94 = 0; if (str_contains(cmd, EL_STR("/etc/shadow"))) { _if_result_94 = (80); } else { _if_result_94 = (0); } _if_result_94; }); - el_val_t s6 = ({ el_val_t _if_result_95 = 0; if (str_contains(cmd, EL_STR("/etc/passwd"))) { _if_result_95 = (30); } else { _if_result_95 = (0); } _if_result_95; }); - el_val_t s7 = ({ el_val_t _if_result_96 = 0; if (str_contains(cmd, EL_STR("id_rsa"))) { _if_result_96 = (60); } else { _if_result_96 = (0); } _if_result_96; }); - el_val_t s8 = ({ el_val_t _if_result_97 = 0; if (str_contains(cmd, EL_STR(".ssh/"))) { _if_result_97 = (50); } else { _if_result_97 = (0); } _if_result_97; }); - el_val_t s9 = ({ el_val_t _if_result_98 = 0; if (str_contains(cmd, EL_STR("crontab"))) { _if_result_98 = (30); } else { _if_result_98 = (0); } _if_result_98; }); - el_val_t s10 = ({ el_val_t _if_result_99 = 0; if (str_contains(cmd, EL_STR("LaunchDaemon"))) { _if_result_99 = (40); } else { _if_result_99 = (0); } _if_result_99; }); - el_val_t s11 = ({ el_val_t _if_result_100 = 0; if ((str_contains(cmd, EL_STR("curl")) && str_contains(cmd, EL_STR("bash")))) { _if_result_100 = (75); } else { _if_result_100 = (0); } _if_result_100; }); - el_val_t s12 = ({ el_val_t _if_result_101 = 0; if ((str_contains(cmd, EL_STR("wget")) && str_contains(cmd, EL_STR("bash")))) { _if_result_101 = (75); } else { _if_result_101 = (0); } _if_result_101; }); - el_val_t s13 = ({ el_val_t _if_result_102 = 0; if ((str_contains(cmd, EL_STR("curl")) && str_contains(cmd, EL_STR("| sh")))) { _if_result_102 = (60); } else { _if_result_102 = (0); } _if_result_102; }); - el_val_t s14 = ({ el_val_t _if_result_103 = 0; if ((str_contains(cmd, EL_STR("base64")) && str_contains(cmd, EL_STR("curl")))) { _if_result_103 = (50); } else { _if_result_103 = (0); } _if_result_103; }); - el_val_t s15 = ({ el_val_t _if_result_104 = 0; if (str_contains(cmd, EL_STR("mkfifo"))) { _if_result_104 = (50); } else { _if_result_104 = (0); } _if_result_104; }); - el_val_t s16 = ({ el_val_t _if_result_105 = 0; if (str_contains(cmd, EL_STR("chmod +s"))) { _if_result_105 = (70); } else { _if_result_105 = (0); } _if_result_105; }); - el_val_t s17 = ({ el_val_t _if_result_106 = 0; if (str_contains(cmd, EL_STR("chmod 4755"))) { _if_result_106 = (70); } else { _if_result_106 = (0); } _if_result_106; }); + el_val_t s1 = ({ el_val_t _if_result_91 = 0; if (str_contains(cmd, EL_STR("nmap"))) { _if_result_91 = (30); } else { _if_result_91 = (0); } _if_result_91; }); + el_val_t s2 = ({ el_val_t _if_result_92 = 0; if (str_contains(cmd, EL_STR("masscan"))) { _if_result_92 = (40); } else { _if_result_92 = (0); } _if_result_92; }); + el_val_t s3 = ({ el_val_t _if_result_93 = 0; if (str_contains(cmd, EL_STR(" nc "))) { _if_result_93 = (20); } else { _if_result_93 = (0); } _if_result_93; }); + el_val_t s4 = ({ el_val_t _if_result_94 = 0; if (str_contains(cmd, EL_STR("netcat"))) { _if_result_94 = (20); } else { _if_result_94 = (0); } _if_result_94; }); + el_val_t s5 = ({ el_val_t _if_result_95 = 0; if (str_contains(cmd, EL_STR("/etc/shadow"))) { _if_result_95 = (80); } else { _if_result_95 = (0); } _if_result_95; }); + el_val_t s6 = ({ el_val_t _if_result_96 = 0; if (str_contains(cmd, EL_STR("/etc/passwd"))) { _if_result_96 = (30); } else { _if_result_96 = (0); } _if_result_96; }); + el_val_t s7 = ({ el_val_t _if_result_97 = 0; if (str_contains(cmd, EL_STR("id_rsa"))) { _if_result_97 = (60); } else { _if_result_97 = (0); } _if_result_97; }); + el_val_t s8 = ({ el_val_t _if_result_98 = 0; if (str_contains(cmd, EL_STR(".ssh/"))) { _if_result_98 = (50); } else { _if_result_98 = (0); } _if_result_98; }); + el_val_t s9 = ({ el_val_t _if_result_99 = 0; if (str_contains(cmd, EL_STR("crontab"))) { _if_result_99 = (30); } else { _if_result_99 = (0); } _if_result_99; }); + el_val_t s10 = ({ el_val_t _if_result_100 = 0; if (str_contains(cmd, EL_STR("LaunchDaemon"))) { _if_result_100 = (40); } else { _if_result_100 = (0); } _if_result_100; }); + el_val_t s11 = ({ el_val_t _if_result_101 = 0; if ((str_contains(cmd, EL_STR("curl")) && str_contains(cmd, EL_STR("bash")))) { _if_result_101 = (75); } else { _if_result_101 = (0); } _if_result_101; }); + el_val_t s12 = ({ el_val_t _if_result_102 = 0; if ((str_contains(cmd, EL_STR("wget")) && str_contains(cmd, EL_STR("bash")))) { _if_result_102 = (75); } else { _if_result_102 = (0); } _if_result_102; }); + el_val_t s13 = ({ el_val_t _if_result_103 = 0; if ((str_contains(cmd, EL_STR("curl")) && str_contains(cmd, EL_STR("| sh")))) { _if_result_103 = (60); } else { _if_result_103 = (0); } _if_result_103; }); + el_val_t s14 = ({ el_val_t _if_result_104 = 0; if ((str_contains(cmd, EL_STR("base64")) && str_contains(cmd, EL_STR("curl")))) { _if_result_104 = (50); } else { _if_result_104 = (0); } _if_result_104; }); + el_val_t s15 = ({ el_val_t _if_result_105 = 0; if (str_contains(cmd, EL_STR("mkfifo"))) { _if_result_105 = (50); } else { _if_result_105 = (0); } _if_result_105; }); + el_val_t s16 = ({ el_val_t _if_result_106 = 0; if (str_contains(cmd, EL_STR("chmod +s"))) { _if_result_106 = (70); } else { _if_result_106 = (0); } _if_result_106; }); + el_val_t s17 = ({ el_val_t _if_result_107 = 0; if (str_contains(cmd, EL_STR("chmod 4755"))) { _if_result_107 = (70); } else { _if_result_107 = (0); } _if_result_107; }); return ((((((((((((((((s1 + s2) + s3) + s4) + s5) + s6) + s7) + s8) + s9) + s10) + s11) + s12) + s13) + s14) + s15) + s16) + s17); return 0; } el_val_t threat_score_path(el_val_t path) { - el_val_t s1 = ({ el_val_t _if_result_107 = 0; if (str_starts_with(path, EL_STR("/etc/"))) { _if_result_107 = (60); } else { _if_result_107 = (0); } _if_result_107; }); - el_val_t s2 = ({ el_val_t _if_result_108 = 0; if (str_contains(path, EL_STR("/.ssh/"))) { _if_result_108 = (70); } else { _if_result_108 = (0); } _if_result_108; }); - el_val_t s3 = ({ el_val_t _if_result_109 = 0; if (str_contains(path, EL_STR("/LaunchDaemons/"))) { _if_result_109 = (80); } else { _if_result_109 = (0); } _if_result_109; }); - el_val_t s4 = ({ el_val_t _if_result_110 = 0; if (str_contains(path, EL_STR("/LaunchAgents/"))) { _if_result_110 = (40); } else { _if_result_110 = (0); } _if_result_110; }); - el_val_t s5 = ({ el_val_t _if_result_111 = 0; if (str_contains(path, EL_STR("/cron"))) { _if_result_111 = (60); } else { _if_result_111 = (0); } _if_result_111; }); - el_val_t s6 = ({ el_val_t _if_result_112 = 0; if (str_contains(path, EL_STR("/.bashrc"))) { _if_result_112 = (35); } else { _if_result_112 = (0); } _if_result_112; }); - el_val_t s7 = ({ el_val_t _if_result_113 = 0; if (str_contains(path, EL_STR("/.zshrc"))) { _if_result_113 = (35); } else { _if_result_113 = (0); } _if_result_113; }); - el_val_t s8 = ({ el_val_t _if_result_114 = 0; if (str_contains(path, EL_STR("/.profile"))) { _if_result_114 = (35); } else { _if_result_114 = (0); } _if_result_114; }); - el_val_t s9 = ({ el_val_t _if_result_115 = 0; if (str_starts_with(path, EL_STR("/usr/"))) { _if_result_115 = (50); } else { _if_result_115 = (0); } _if_result_115; }); - el_val_t s10 = ({ el_val_t _if_result_116 = 0; if (str_starts_with(path, EL_STR("/bin/"))) { _if_result_116 = (70); } else { _if_result_116 = (0); } _if_result_116; }); - el_val_t s11 = ({ el_val_t _if_result_117 = 0; if (str_starts_with(path, EL_STR("/sbin/"))) { _if_result_117 = (70); } else { _if_result_117 = (0); } _if_result_117; }); + el_val_t s1 = ({ el_val_t _if_result_108 = 0; if (str_starts_with(path, EL_STR("/etc/"))) { _if_result_108 = (60); } else { _if_result_108 = (0); } _if_result_108; }); + el_val_t s2 = ({ el_val_t _if_result_109 = 0; if (str_contains(path, EL_STR("/.ssh/"))) { _if_result_109 = (70); } else { _if_result_109 = (0); } _if_result_109; }); + el_val_t s3 = ({ el_val_t _if_result_110 = 0; if (str_contains(path, EL_STR("/LaunchDaemons/"))) { _if_result_110 = (80); } else { _if_result_110 = (0); } _if_result_110; }); + el_val_t s4 = ({ el_val_t _if_result_111 = 0; if (str_contains(path, EL_STR("/LaunchAgents/"))) { _if_result_111 = (40); } else { _if_result_111 = (0); } _if_result_111; }); + el_val_t s5 = ({ el_val_t _if_result_112 = 0; if (str_contains(path, EL_STR("/cron"))) { _if_result_112 = (60); } else { _if_result_112 = (0); } _if_result_112; }); + el_val_t s6 = ({ el_val_t _if_result_113 = 0; if (str_contains(path, EL_STR("/.bashrc"))) { _if_result_113 = (35); } else { _if_result_113 = (0); } _if_result_113; }); + el_val_t s7 = ({ el_val_t _if_result_114 = 0; if (str_contains(path, EL_STR("/.zshrc"))) { _if_result_114 = (35); } else { _if_result_114 = (0); } _if_result_114; }); + el_val_t s8 = ({ el_val_t _if_result_115 = 0; if (str_contains(path, EL_STR("/.profile"))) { _if_result_115 = (35); } else { _if_result_115 = (0); } _if_result_115; }); + el_val_t s9 = ({ el_val_t _if_result_116 = 0; if (str_starts_with(path, EL_STR("/usr/"))) { _if_result_116 = (50); } else { _if_result_116 = (0); } _if_result_116; }); + el_val_t s10 = ({ el_val_t _if_result_117 = 0; if (str_starts_with(path, EL_STR("/bin/"))) { _if_result_117 = (70); } else { _if_result_117 = (0); } _if_result_117; }); + el_val_t s11 = ({ el_val_t _if_result_118 = 0; if (str_starts_with(path, EL_STR("/sbin/"))) { _if_result_118 = (70); } else { _if_result_118 = (0); } _if_result_118; }); return ((((((((((s1 + s2) + s3) + s4) + s5) + s6) + s7) + s8) + s9) + s10) + s11); return 0; } el_val_t threat_score_history(el_val_t history) { - el_val_t s1 = ({ el_val_t _if_result_118 = 0; if (str_contains(history, EL_STR("port scan"))) { _if_result_118 = (15); } else { _if_result_118 = (0); } _if_result_118; }); - el_val_t s2 = ({ el_val_t _if_result_119 = 0; if (str_contains(history, EL_STR("enumerate"))) { _if_result_119 = (10); } else { _if_result_119 = (0); } _if_result_119; }); - el_val_t s3 = ({ el_val_t _if_result_120 = 0; if (str_contains(history, EL_STR("exploit"))) { _if_result_120 = (20); } else { _if_result_120 = (0); } _if_result_120; }); - el_val_t s4 = ({ el_val_t _if_result_121 = 0; if (str_contains(history, EL_STR("payload"))) { _if_result_121 = (15); } else { _if_result_121 = (0); } _if_result_121; }); - el_val_t s5 = ({ el_val_t _if_result_122 = 0; if (str_contains(history, EL_STR("persistence"))) { _if_result_122 = (15); } else { _if_result_122 = (0); } _if_result_122; }); - el_val_t s6 = ({ el_val_t _if_result_123 = 0; if (str_contains(history, EL_STR("lateral movement"))) { _if_result_123 = (25); } else { _if_result_123 = (0); } _if_result_123; }); - el_val_t s7 = ({ el_val_t _if_result_124 = 0; if (str_contains(history, EL_STR("privilege escalation"))) { _if_result_124 = (25); } else { _if_result_124 = (0); } _if_result_124; }); - el_val_t s8 = ({ el_val_t _if_result_125 = 0; if (str_contains(history, EL_STR("reverse shell"))) { _if_result_125 = (40); } else { _if_result_125 = (0); } _if_result_125; }); - el_val_t s9 = ({ el_val_t _if_result_126 = 0; if (str_contains(history, EL_STR("bind shell"))) { _if_result_126 = (40); } else { _if_result_126 = (0); } _if_result_126; }); - el_val_t s10 = ({ el_val_t _if_result_127 = 0; if (str_contains(history, EL_STR("command and control"))) { _if_result_127 = (35); } else { _if_result_127 = (0); } _if_result_127; }); - el_val_t s11 = ({ el_val_t _if_result_128 = 0; if (str_contains(history, EL_STR("self-replicate"))) { _if_result_128 = (45); } else { _if_result_128 = (0); } _if_result_128; }); - el_val_t s12 = ({ el_val_t _if_result_129 = 0; if (str_contains(history, EL_STR("propagat"))) { _if_result_129 = (20); } else { _if_result_129 = (0); } _if_result_129; }); - el_val_t s13 = ({ el_val_t _if_result_130 = 0; if (str_contains(history, EL_STR("ransomware"))) { _if_result_130 = (30); } else { _if_result_130 = (0); } _if_result_130; }); - el_val_t s14 = ({ el_val_t _if_result_131 = 0; if (str_contains(history, EL_STR("encrypt files"))) { _if_result_131 = (40); } else { _if_result_131 = (0); } _if_result_131; }); - el_val_t s15 = ({ el_val_t _if_result_132 = 0; if (str_contains(history, EL_STR("exfiltrat"))) { _if_result_132 = (35); } else { _if_result_132 = (0); } _if_result_132; }); - el_val_t s16 = ({ el_val_t _if_result_133 = 0; if (str_contains(history, EL_STR("zero-day"))) { _if_result_133 = (20); } else { _if_result_133 = (0); } _if_result_133; }); - el_val_t s17 = ({ el_val_t _if_result_134 = 0; if (str_contains(history, EL_STR("rootkit"))) { _if_result_134 = (45); } else { _if_result_134 = (0); } _if_result_134; }); - el_val_t s18 = ({ el_val_t _if_result_135 = 0; if (str_contains(history, EL_STR("keylogger"))) { _if_result_135 = (45); } else { _if_result_135 = (0); } _if_result_135; }); - el_val_t s19 = ({ el_val_t _if_result_136 = 0; if (str_contains(history, EL_STR("botnet"))) { _if_result_136 = (40); } else { _if_result_136 = (0); } _if_result_136; }); - el_val_t s20 = ({ el_val_t _if_result_137 = 0; if (str_contains(history, EL_STR("malware"))) { _if_result_137 = (15); } else { _if_result_137 = (0); } _if_result_137; }); + el_val_t s1 = ({ el_val_t _if_result_119 = 0; if (str_contains(history, EL_STR("port scan"))) { _if_result_119 = (15); } else { _if_result_119 = (0); } _if_result_119; }); + el_val_t s2 = ({ el_val_t _if_result_120 = 0; if (str_contains(history, EL_STR("enumerate"))) { _if_result_120 = (10); } else { _if_result_120 = (0); } _if_result_120; }); + el_val_t s3 = ({ el_val_t _if_result_121 = 0; if (str_contains(history, EL_STR("exploit"))) { _if_result_121 = (20); } else { _if_result_121 = (0); } _if_result_121; }); + el_val_t s4 = ({ el_val_t _if_result_122 = 0; if (str_contains(history, EL_STR("payload"))) { _if_result_122 = (15); } else { _if_result_122 = (0); } _if_result_122; }); + el_val_t s5 = ({ el_val_t _if_result_123 = 0; if (str_contains(history, EL_STR("persistence"))) { _if_result_123 = (15); } else { _if_result_123 = (0); } _if_result_123; }); + el_val_t s6 = ({ el_val_t _if_result_124 = 0; if (str_contains(history, EL_STR("lateral movement"))) { _if_result_124 = (25); } else { _if_result_124 = (0); } _if_result_124; }); + el_val_t s7 = ({ el_val_t _if_result_125 = 0; if (str_contains(history, EL_STR("privilege escalation"))) { _if_result_125 = (25); } else { _if_result_125 = (0); } _if_result_125; }); + el_val_t s8 = ({ el_val_t _if_result_126 = 0; if (str_contains(history, EL_STR("reverse shell"))) { _if_result_126 = (40); } else { _if_result_126 = (0); } _if_result_126; }); + el_val_t s9 = ({ el_val_t _if_result_127 = 0; if (str_contains(history, EL_STR("bind shell"))) { _if_result_127 = (40); } else { _if_result_127 = (0); } _if_result_127; }); + el_val_t s10 = ({ el_val_t _if_result_128 = 0; if (str_contains(history, EL_STR("command and control"))) { _if_result_128 = (35); } else { _if_result_128 = (0); } _if_result_128; }); + el_val_t s11 = ({ el_val_t _if_result_129 = 0; if (str_contains(history, EL_STR("self-replicate"))) { _if_result_129 = (45); } else { _if_result_129 = (0); } _if_result_129; }); + el_val_t s12 = ({ el_val_t _if_result_130 = 0; if (str_contains(history, EL_STR("propagat"))) { _if_result_130 = (20); } else { _if_result_130 = (0); } _if_result_130; }); + el_val_t s13 = ({ el_val_t _if_result_131 = 0; if (str_contains(history, EL_STR("ransomware"))) { _if_result_131 = (30); } else { _if_result_131 = (0); } _if_result_131; }); + el_val_t s14 = ({ el_val_t _if_result_132 = 0; if (str_contains(history, EL_STR("encrypt files"))) { _if_result_132 = (40); } else { _if_result_132 = (0); } _if_result_132; }); + el_val_t s15 = ({ el_val_t _if_result_133 = 0; if (str_contains(history, EL_STR("exfiltrat"))) { _if_result_133 = (35); } else { _if_result_133 = (0); } _if_result_133; }); + el_val_t s16 = ({ el_val_t _if_result_134 = 0; if (str_contains(history, EL_STR("zero-day"))) { _if_result_134 = (20); } else { _if_result_134 = (0); } _if_result_134; }); + el_val_t s17 = ({ el_val_t _if_result_135 = 0; if (str_contains(history, EL_STR("rootkit"))) { _if_result_135 = (45); } else { _if_result_135 = (0); } _if_result_135; }); + el_val_t s18 = ({ el_val_t _if_result_136 = 0; if (str_contains(history, EL_STR("keylogger"))) { _if_result_136 = (45); } else { _if_result_136 = (0); } _if_result_136; }); + el_val_t s19 = ({ el_val_t _if_result_137 = 0; if (str_contains(history, EL_STR("botnet"))) { _if_result_137 = (40); } else { _if_result_137 = (0); } _if_result_137; }); + el_val_t s20 = ({ el_val_t _if_result_138 = 0; if (str_contains(history, EL_STR("malware"))) { _if_result_138 = (15); } else { _if_result_138 = (0); } _if_result_138; }); return (((((((((((((((((((s1 + s2) + s3) + s4) + s5) + s6) + s7) + s8) + s9) + s10) + s11) + s12) + s13) + s14) + s15) + s16) + s17) + s18) + s19) + s20); return 0; } el_val_t threat_trajectory_check(el_val_t tool_name, el_val_t tool_input) { el_val_t history = state_get(EL_STR("agentic_conv_history")); - el_val_t computed_tool_score = ({ el_val_t _if_result_138 = 0; if (str_eq(tool_name, EL_STR("run_command"))) { el_val_t cmd = json_get(tool_input, EL_STR("command")); _if_result_138 = (threat_score_command(cmd)); } else { _if_result_138 = (({ el_val_t _if_result_139 = 0; if ((str_eq(tool_name, EL_STR("write_file")) || str_eq(tool_name, EL_STR("edit_file")))) { el_val_t path = json_get(tool_input, EL_STR("path")); _if_result_139 = (threat_score_path(path)); } else { _if_result_139 = (0); } _if_result_139; })); } _if_result_138; }); + el_val_t computed_tool_score = ({ el_val_t _if_result_139 = 0; if (str_eq(tool_name, EL_STR("run_command"))) { el_val_t cmd = json_get(tool_input, EL_STR("command")); _if_result_139 = (threat_score_command(cmd)); } else { _if_result_139 = (({ el_val_t _if_result_140 = 0; if ((str_eq(tool_name, EL_STR("write_file")) || str_eq(tool_name, EL_STR("edit_file")))) { el_val_t path = json_get(tool_input, EL_STR("path")); _if_result_140 = (threat_score_path(path)); } else { _if_result_140 = (0); } _if_result_140; })); } _if_result_139; }); el_val_t history_score = threat_score_history(history); el_val_t history_contrib = (history_score / 3); el_val_t combined = (computed_tool_score + history_contrib); el_val_t should_log = (combined >= 40); if (should_log) { el_val_t ts = time_now(); - el_val_t authorized_str = ({ el_val_t _if_result_140 = 0; if (security_research_authorized()) { _if_result_140 = (EL_STR("true")); } else { _if_result_140 = (EL_STR("false")); } _if_result_140; }); + el_val_t authorized_str = ({ el_val_t _if_result_141 = 0; if (security_research_authorized()) { _if_result_141 = (EL_STR("true")); } else { _if_result_141 = (EL_STR("false")); } _if_result_141; }); el_val_t log_content = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"event\":\"threat_check\",\"tool\":\""), tool_name), EL_STR("\",\"score\":")), int_to_str(combined)), EL_STR(",\"tool_score\":")), int_to_str(computed_tool_score)), EL_STR(",\"history_score\":")), int_to_str(history_score)), EL_STR(",\"authorized\":")), authorized_str), EL_STR(",\"ts\":")), int_to_str(ts)), EL_STR("}")); el_val_t log_tags = EL_STR("[\"security-audit\",\"threat-check\"]"); el_val_t discard = mem_remember(log_content, log_tags); @@ -863,7 +900,7 @@ el_val_t threat_history_append(el_val_t text) { el_val_t safe_text = str_to_lower(text); el_val_t combined = el_str_concat(el_str_concat(current, EL_STR(" ")), safe_text); el_val_t len = str_len(combined); - el_val_t trimmed = ({ el_val_t _if_result_141 = 0; if ((len > 2000)) { _if_result_141 = (str_slice(combined, (len - 2000), len)); } else { _if_result_141 = (combined); } _if_result_141; }); + el_val_t trimmed = ({ el_val_t _if_result_142 = 0; if ((len > 2000)) { _if_result_142 = (str_slice(combined, (len - 2000), len)); } else { _if_result_142 = (combined); } _if_result_142; }); state_set(EL_STR("agentic_conv_history"), trimmed); return 0; } diff --git a/dist/neuron.c b/dist/neuron.c index 0b3229b..34b77de 100644 --- a/dist/neuron.c +++ b/dist/neuron.c @@ -71,6 +71,7 @@ el_val_t imprint_unload(void); el_val_t idle_count(void); el_val_t idle_inc(void); el_val_t idle_reset(void); +el_val_t hebb_consolidate(void); el_val_t ise_post(el_val_t content); el_val_t elapsed_ms(void); el_val_t elapsed_human(void);