diff --git a/src/main/daemon/daemon-audit-eligibility-event.test.ts b/src/main/daemon/daemon-audit-eligibility-event.test.ts index 52171e148..13d3e0f39 100644 --- a/src/main/daemon/daemon-audit-eligibility-event.test.ts +++ b/src/main/daemon/daemon-audit-eligibility-event.test.ts @@ -4,7 +4,9 @@ import { join } from 'node:path' import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' import { validate } from '../telemetry/validator' import { recordAuthenticatedInventory, type DaemonAuditContext } from './daemon-audit-classifier' +import type { ExactDaemonIncarnation } from './daemon-incarnation-evidence' import { DaemonPtyAdapter } from './daemon-pty-adapter' +import { PROTOCOL_VERSION } from './daemon-protocol-version' import { DaemonServer } from './daemon-server' import { getDaemonSocketPath } from './daemon-spawner' @@ -25,6 +27,16 @@ const context: DaemonAuditContext = { profileScope: '/profile' } +const exactIncarnation: ExactDaemonIncarnation = { + identity: { + pid: 92_847_561, + startedAtMs: 1_786_000_123_456, + launchNonce: 'private-launch-nonce' + }, + linuxStartTicks: '8642097531', + bootId: 'private-boot-id' +} + beforeEach(() => { trackMock.mockReset() }) @@ -42,12 +54,70 @@ describe('daemon audit eligibility telemetry', () => { reason: 'authenticated_inventory', evidence_sources: ['authenticated_inventory'], protocol_generation: 23, + generation_role: 'legacy', exact_incarnation: 'unavailable', process_reason: null }) + expect(props).not.toHaveProperty('exact_incarnation_correlation') expect(validate('daemon_audit_eligibility', props).ok).toBe(true) }) + it('correlates an exact incarnation across app trackers without raw identity fields', () => { + const currentContext = { ...context, protocolGeneration: PROTOCOL_VERSION } + const firstAppTracker = createDaemonAuditEligibilityTracker() + const secondAppTracker = createDaemonAuditEligibilityTracker() + + firstAppTracker(recordAuthenticatedInventory(currentContext, exactIncarnation)) + secondAppTracker(recordAuthenticatedInventory(currentContext, exactIncarnation)) + secondAppTracker( + recordAuthenticatedInventory(currentContext, { + ...exactIncarnation, + identity: { ...exactIncarnation.identity, launchNonce: 'another-private-launch-nonce' } + }) + ) + + const firstProperties = trackMock.mock.calls[0][1] + const secondProperties = trackMock.mock.calls[1][1] + const replacementProperties = trackMock.mock.calls[2][1] + expect(firstProperties).toMatchObject({ + generation_role: 'current', + exact_incarnation: 'endpoint-identity-linux-ticks', + exact_incarnation_correlation: 'v1:2751326d0f457808fe11a03ce2f6e732' + }) + expect(secondProperties.exact_incarnation_correlation).toBe( + firstProperties.exact_incarnation_correlation + ) + expect(replacementProperties.exact_incarnation_correlation).not.toBe( + firstProperties.exact_incarnation_correlation + ) + expect(validate('daemon_audit_eligibility', firstProperties).ok).toBe(true) + + const serializedProperties = JSON.stringify(firstProperties) + for (const rawIdentity of [ + exactIncarnation.identity.launchNonce, + String(exactIncarnation.identity.pid), + String(exactIncarnation.identity.startedAtMs), + exactIncarnation.linuxStartTicks, + exactIncarnation.bootId + ]) { + expect(serializedProperties).not.toContain(rawIdentity) + } + }) + + it('does not mislabel a future protocol generation as legacy', () => { + const trackEligibility = createDaemonAuditEligibilityTracker() + + expect(() => + trackEligibility( + recordAuthenticatedInventory( + { ...context, protocolGeneration: PROTOCOL_VERSION + 1 }, + exactIncarnation + ) + ) + ).not.toThrow() + expect(trackMock).not.toHaveBeenCalled() + }) + it('cannot affect callers when telemetry throws', () => { trackMock.mockImplementation(() => { throw new Error('transport failed') @@ -83,13 +153,13 @@ describe('daemon audit eligibility telemetry', () => { for (let index = 0; index < 60; index += 1) { nowMs += 1_000 - trackEligibility(recordAuthenticatedInventory(context, null)) + trackEligibility(recordAuthenticatedInventory(context, exactIncarnation)) } expect(trackMock).toHaveBeenCalledOnce() nowMs += 5 * 60_000 - trackEligibility(recordAuthenticatedInventory(context, null)) + trackEligibility(recordAuthenticatedInventory(context, exactIncarnation)) expect(trackMock).toHaveBeenCalledTimes(2) }) diff --git a/src/main/daemon/daemon-audit-eligibility-event.ts b/src/main/daemon/daemon-audit-eligibility-event.ts index 3afaaa8aa..e99ac903e 100644 --- a/src/main/daemon/daemon-audit-eligibility-event.ts +++ b/src/main/daemon/daemon-audit-eligibility-event.ts @@ -1,15 +1,22 @@ +import { createHash } from 'node:crypto' import { track } from '../telemetry/client' import type { EventProps } from '../../shared/telemetry-events' import type { DaemonAuditObservation } from './daemon-audit-classifier' +import { PROTOCOL_VERSION } from './daemon-protocol-version' // Why: a steady daemon repeats a byte-identical observation on every listProcesses call, so // repeats are re-sent only as an occasional heartbeat — the shared per-session telemetry // ceiling is 1,000 events for the whole app and audit data must not crowd it out. const REPEATED_OBSERVATION_INTERVAL_MS = 5 * 60_000 +const INCARNATION_CORRELATION_DOMAIN = 'orca:daemon-audit-eligibility:incarnation:v1' +type AuditEligibilityCommonProperties = Omit< + Extract, { exact_incarnation: 'unavailable' }>, + 'exact_incarnation' +> export function trackDaemonAuditEligibility(observation: DaemonAuditObservation): void { try { - track('daemon_audit_eligibility', auditEligibilityProperties(observation)) + track('daemon_audit_eligibility', auditEligibilityProperties(observation, hashLaunchNonce)) } catch { // Audit telemetry cannot affect daemon availability. } @@ -22,11 +29,13 @@ export function createDaemonAuditEligibilityTracker( ): (observation: DaemonAuditObservation) => void { let lastProperties: string | null = null let lastTrackedAtMs = 0 + const correlateLaunchNonce = createLaunchNonceCorrelationCache() return (observation) => { // Why: the rate-limit bookkeeping runs inside the daemon's inventory path, so it is guarded // together with the emit — audit telemetry cannot affect daemon availability. try { - const properties = JSON.stringify(auditEligibilityProperties(observation)) + const eventProperties = auditEligibilityProperties(observation, correlateLaunchNonce) + const properties = JSON.stringify(eventProperties) const observedAtMs = monotonicNowMs() const elapsedMs = observedAtMs - lastTrackedAtMs if ( @@ -38,7 +47,7 @@ export function createDaemonAuditEligibilityTracker( } lastProperties = properties lastTrackedAtMs = observedAtMs - trackDaemonAuditEligibility(observation) + track('daemon_audit_eligibility', eventProperties) } catch { // Audit telemetry cannot affect daemon availability. } @@ -46,33 +55,73 @@ export function createDaemonAuditEligibilityTracker( } function auditEligibilityProperties( - observation: DaemonAuditObservation + observation: DaemonAuditObservation, + correlateLaunchNonce: (launchNonce: string) => string ): EventProps<'daemon_audit_eligibility'> { - return { + const generationRole = generationRoleForProtocol(observation.context.protocolGeneration) + const commonProperties: AuditEligibilityCommonProperties = { state: observation.state, reason: observation.reason, trigger: observation.trigger, evidence_sources: [...observation.evidenceSources], protocol_generation: observation.context.protocolGeneration, + generation_role: generationRole, provider: observation.context.provider, endpoint_kind: observation.context.endpointKind, profile_scope: observation.context.profileScope ? 'configured' : 'unspecified', - exact_incarnation: exactIncarnationKind(observation), reachability: observation.reachability, inventory_authority: observation.inventoryAuthority, process_liveness: observation.processLiveness, process_reason: observation.processReason, endpoint_state: observation.endpointState } + if (!observation.exactIncarnation) { + return { ...commonProperties, exact_incarnation: 'unavailable' } + } + return { + ...commonProperties, + exact_incarnation: exactIncarnationKind(observation.exactIncarnation), + exact_incarnation_correlation: correlateLaunchNonce( + observation.exactIncarnation.identity.launchNonce + ) + } +} + +function generationRoleForProtocol(protocolGeneration: number): 'current' | 'legacy' { + if (protocolGeneration === PROTOCOL_VERSION) { + return 'current' + } + if (protocolGeneration > 0 && protocolGeneration < PROTOCOL_VERSION) { + return 'legacy' + } + throw new Error('unsupported_daemon_audit_protocol_generation') } function exactIncarnationKind( - observation: DaemonAuditObservation -): 'endpoint-identity' | 'endpoint-identity-linux-ticks' | 'unavailable' { - if (!observation.exactIncarnation) { - return 'unavailable' - } - return observation.exactIncarnation.linuxStartTicks && observation.exactIncarnation.bootId + exactIncarnation: NonNullable +): 'endpoint-identity' | 'endpoint-identity-linux-ticks' { + return exactIncarnation.linuxStartTicks && exactIncarnation.bootId ? 'endpoint-identity-linux-ticks' : 'endpoint-identity' } + +function createLaunchNonceCorrelationCache(): (launchNonce: string) => string { + let cachedNonce: string | null = null + let cachedCorrelation = '' + return (launchNonce) => { + if (launchNonce !== cachedNonce) { + cachedNonce = launchNonce + cachedCorrelation = hashLaunchNonce(launchNonce) + } + return cachedCorrelation + } +} + +function hashLaunchNonce(launchNonce: string): string { + const digest = createHash('sha256') + .update(INCARNATION_CORRELATION_DOMAIN) + .update('\0') + .update(launchNonce) + .digest('hex') + return `v1:${digest.slice(0, 32)}` +} diff --git a/src/main/ipc/telemetry.test.ts b/src/main/ipc/telemetry.test.ts index 1f412a6d0..2645d98df 100644 --- a/src/main/ipc/telemetry.test.ts +++ b/src/main/ipc/telemetry.test.ts @@ -160,6 +160,7 @@ describe('telemetry IPC handlers', () => { count_bucket: 'count_1', bucket_source: 'crossed_now' }) + handler({}, 'daemon_audit_eligibility', {}) expect(trackMock).not.toHaveBeenCalled() expect(getCohortAtEmitMock).not.toHaveBeenCalled() }) diff --git a/src/main/ipc/telemetry.ts b/src/main/ipc/telemetry.ts index 02f1b9e16..c1fe7d0f6 100644 --- a/src/main/ipc/telemetry.ts +++ b/src/main/ipc/telemetry.ts @@ -24,6 +24,7 @@ let storeRef: Store | null = null const MAIN_OWNED_TELEMETRY_EVENTS = new Set([ 'app_starred_orca', + 'daemon_audit_eligibility', 'star_nag_outcome', 'feature_interaction_usage_bucket_reached' ]) diff --git a/src/shared/daemon-audit-eligibility.ts b/src/shared/daemon-audit-eligibility.ts index 4e89af300..4a5d28ca7 100644 --- a/src/shared/daemon-audit-eligibility.ts +++ b/src/shared/daemon-audit-eligibility.ts @@ -1,5 +1,7 @@ export const DAEMON_AUDIT_STATE_VALUES = ['present', 'gone', 'unknown'] as const +export const DAEMON_AUDIT_GENERATION_ROLE_VALUES = ['current', 'legacy'] as const + export const DAEMON_AUDIT_TRIGGER_VALUES = [ 'inventory_answered', 'inventory_failed', diff --git a/src/shared/telemetry-events.ts b/src/shared/telemetry-events.ts index 18f7cd898..490bb162a 100644 --- a/src/shared/telemetry-events.ts +++ b/src/shared/telemetry-events.ts @@ -28,6 +28,7 @@ import { DAEMON_RETIRE_REASONS } from './daemon-lifecycle-telemetry' import { + DAEMON_AUDIT_GENERATION_ROLE_VALUES, DAEMON_AUDIT_PROCESS_REASON_VALUES, DAEMON_AUDIT_REASON_VALUES, DAEMON_AUDIT_STATE_VALUES, @@ -419,28 +420,38 @@ const daemonLifecycleSchema = z.discriminatedUnion('transition', [ .strict() ]) -const daemonAuditEligibilitySchema = z - .object({ - state: z.enum(DAEMON_AUDIT_STATE_VALUES), - reason: z.enum(DAEMON_AUDIT_REASON_VALUES), - trigger: z.enum(DAEMON_AUDIT_TRIGGER_VALUES), - evidence_sources: z.array(z.enum(DAEMON_EVIDENCE_SOURCE_VALUES)).min(1).max(12), - protocol_generation: z.number().int().positive().max(1_000), - provider: z.literal('local-daemon'), - endpoint_kind: z.enum(['unix-socket', 'windows-named-pipe']), - profile_scope: z.enum(['configured', 'unspecified']), - exact_incarnation: z.enum([ - 'endpoint-identity', - 'endpoint-identity-linux-ticks', - 'unavailable' - ]), - reachability: z.enum(['authenticated', 'disconnected', 'unknown']), - inventory_authority: z.enum(['authoritative', 'unavailable']), - process_liveness: z.enum(['present', 'gone', 'unknown']), - process_reason: z.enum(DAEMON_AUDIT_PROCESS_REASON_VALUES).nullable(), - endpoint_state: z.enum(['missing', 'named-pipe', 'non-socket', 'socket', 'unknown']) - }) - .strict() +const daemonAuditEligibilityBaseSchema = z.object({ + state: z.enum(DAEMON_AUDIT_STATE_VALUES), + reason: z.enum(DAEMON_AUDIT_REASON_VALUES), + trigger: z.enum(DAEMON_AUDIT_TRIGGER_VALUES), + evidence_sources: z.array(z.enum(DAEMON_EVIDENCE_SOURCE_VALUES)).min(1).max(12), + protocol_generation: z.number().int().positive().max(1_000), + generation_role: z.enum(DAEMON_AUDIT_GENERATION_ROLE_VALUES), + provider: z.literal('local-daemon'), + endpoint_kind: z.enum(['unix-socket', 'windows-named-pipe']), + profile_scope: z.enum(['configured', 'unspecified']), + reachability: z.enum(['authenticated', 'disconnected', 'unknown']), + inventory_authority: z.enum(['authoritative', 'unavailable']), + process_liveness: z.enum(['present', 'gone', 'unknown']), + process_reason: z.enum(DAEMON_AUDIT_PROCESS_REASON_VALUES).nullable(), + endpoint_state: z.enum(['missing', 'named-pipe', 'non-socket', 'socket', 'unknown']) +}) + +const daemonAuditEligibilitySchema = z.discriminatedUnion('exact_incarnation', [ + daemonAuditEligibilityBaseSchema + .extend({ + exact_incarnation: z.literal('endpoint-identity'), + exact_incarnation_correlation: z.string().regex(/^v1:[0-9a-f]{32}$/) + }) + .strict(), + daemonAuditEligibilityBaseSchema + .extend({ + exact_incarnation: z.literal('endpoint-identity-linux-ticks'), + exact_incarnation_correlation: z.string().regex(/^v1:[0-9a-f]{32}$/) + }) + .strict(), + daemonAuditEligibilityBaseSchema.extend({ exact_incarnation: z.literal('unavailable') }).strict() +]) // Rollout signal for granting Codex hook trust via codex app-server RPCs // instead of Orca's self-computed trusted_hash. `fallback`/`verify_failed`