Versioned mitmproxy addon -> provider-neutral IPX spool contract #36

New issue

Closed

opened 2026-09-02 17:24:36 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-02 17:24:36 +00:00

Owner

Outcome

Implement the thin mitmproxy addon/spool adapter beneath #135. It converts intercepted HTTP(S) traffic into deterministic, versioned, append-only IPX records that the existing Hackmode parser/persistence path can ingest.

Owning RAGE lane

Provider/runtime/tool worker, with database-worker review of the typed storage boundary.

Fence

The Python addon MUST NOT import/write Tek9, mutate KB state, call StarIntel directly, or run Hackpert. It writes source evidence only.

Dependencies

#26
#135
current typed :http-exchange, checkpoint, quarantine, and source-rotation persistence contracts

Record contract

Include capture-session/source identity, deterministic exchange/correlation identity, framing/version, durable offsets, timestamps/duration, method/scheme/host/port/path/query, status, bounded/redacted headers, content metadata, body digests/raw-evidence references, TLS/connection metadata when available, and capture-provider/version provenance.

Raw secret-bearing bodies/headers must not be promoted into normal graph/KB fields. Use evidence refs/digests under the existing redaction policy.

Spool semantics

append-only while active;
deterministic framing;
crash/truncation detectable by parser;
replay idempotent;
rotation compatible with existing lineage records;
parser can checkpoint only after accepted framed records;
provider-neutral enough that future adapters can produce the same canonical exchange shape.

RED-first tests

Deterministic addon fixtures for request/response pairing, body digests, redaction, malformed/truncated records, restart/replay, and rotation.

Acceptance proof

Send fixture traffic through mitmproxy, inspect only the spool, then ingest it through Hackmode and prove the resulting canonical typed HTTP exchange round-trips with stable identity and provenance while the addon itself has no persistence authority.

## Outcome Implement the thin mitmproxy addon/spool adapter beneath #135. It converts intercepted HTTP(S) traffic into deterministic, versioned, append-only IPX records that the existing Hackmode parser/persistence path can ingest. ## Owning RAGE lane Provider/runtime/tool worker, with database-worker review of the typed storage boundary. ## Fence The Python addon MUST NOT import/write Tek9, mutate KB state, call StarIntel directly, or run Hackpert. It writes source evidence only. ## Dependencies - #26 - #135 - current typed `:http-exchange`, checkpoint, quarantine, and source-rotation persistence contracts ## Record contract Include capture-session/source identity, deterministic exchange/correlation identity, framing/version, durable offsets, timestamps/duration, method/scheme/host/port/path/query, status, bounded/redacted headers, content metadata, body digests/raw-evidence references, TLS/connection metadata when available, and capture-provider/version provenance. Raw secret-bearing bodies/headers must not be promoted into normal graph/KB fields. Use evidence refs/digests under the existing redaction policy. ## Spool semantics - append-only while active; - deterministic framing; - crash/truncation detectable by parser; - replay idempotent; - rotation compatible with existing lineage records; - parser can checkpoint only after accepted framed records; - provider-neutral enough that future adapters can produce the same canonical exchange shape. ## RED-first tests Deterministic addon fixtures for request/response pairing, body digests, redaction, malformed/truncated records, restart/replay, and rotation. ## Acceptance proof Send fixture traffic through mitmproxy, inspect only the spool, then ingest it through Hackmode and prove the resulting canonical typed HTTP exchange round-trips with stable identity and provenance while the addon itself has no persistence authority.

nsaspy closed this issue

2026-09-02 17:24:36 +00:00

nsaspy referenced this issue

2026-09-04 20:37:21 +00:00

Keep RAGE entirely inside Agent Zero #133

nsaspy referenced this issue

2026-09-04 20:37:22 +00:00

Add two non-overlapping Hackmode Auto-RAGE development workers #136