IPX passive traffic stack: capture proxy -> Hackpert graph -> StarIntel ingest

nsaspy commented

2026-09-02 17:24:37 +00:00

Owner

Outcome

Add the IPX stack to Hackmode: a local proxy/capture boundary records network/application traffic as durable evidence, Hackpert analyzes the capture passively, Common Lisp validates the resulting graph/KB deltas, and accepted observations are projected through Hackmode's canonical StarIntel outbox.

This is a passive-intelligence path. Observing traffic must never implicitly trigger active scanning, exploitation, replay, mutation, or provider execution.

Related expert architecture: #24
Foundation PR: #25

Core flow

client / browser / tool
        |
        v
   IPX capture proxy
        |
        v
append-only capture file/spool
(raw evidence + offsets/digests)
        |
        v
capture parser/tailer actor
        |
        v
typed HTTP/application exchanges
        |
        +----------------------------+
        |                            |
        v                            v
 operational graph/KB       deterministic Hackpert snapshot
                                     |
                                     v
                               SWI-Prolog rules
                                     |
                                     v
                              typed graph delta
                                     |
                                     v
                           Common Lisp acceptance
                                     |
                         +-----------+-----------+
                         |                       |
                         v                       v
                    Tek9/KB state        StarIntel projection
                                                |
                                                v
                                         durable outbox
                                                |
                                                v
                                         starintel-server

Ownership / authority

the capture file/spool is immutable source evidence; analysis never rewrites it;
Common Lisp owns capture lifecycle, parsing, canonical graph/KB mutation, redaction policy, StarIntel projection, and all effects;
Hackpert/Prolog is passive/advisory: classify, correlate, fingerprint, infer, rank, and emit typed graph deltas;
Prolog gets bounded typed projections or references, not arbitrary raw-file authority;
passive findings do not invoke providers or attack engines automatically;
any later active action must cross the normal Hackmode scope/authorization/provider boundary explicitly.

First protocol: HTTP(S)

Start with HTTP request/response exchanges captured through the proxy. Preserve enough evidence to reconstruct provenance without forcing all raw bodies into the KB.

Typed exchange metadata should cover at least:

operation/capture-session ID;
source file identity + byte/record offsets;
request/response correlation ID;
timestamp and duration;
method, scheme, host, port, path/query;
response status;
bounded/redacted headers;
request/response body digest + raw-evidence reference;
content type/length/encoding;
connection/TLS metadata when available;
parser/capture format version.

Later protocol adapters may add WebSocket, SSE, raw TCP, DNS, or other application traces without changing the graph/KB authority model.

Passive Hackpert analysis

Hackpert should be able to derive graph/KB candidates such as:

domains, hosts, URLs, endpoints, parameters and observed values/types;
request -> response -> redirect relationships;
API route and resource relationships;
authentication/session boundaries and login/logout flows;
cookies/tokens as secret-bearing evidence references, not reusable plaintext KB loot;
technology/server/framework fingerprints with evidence;
error/debug responses and potentially interesting behavior;
repeated/variant requests and response-shape changes;
observed forms, inputs, content types and upload surfaces;
endpoint/parameter candidates for later explicitly authorized expert workflows;
traffic-derived findings with confidence/evidence links.

The result is a graph delta with provenance back to the exact capture record(s).

Operational / long-term / global KB

Traffic-derived knowledge follows #24's KB lifecycle:

operational KB: per-operation endpoint graph, parameter observations, fingerprints, failed/successful flows, session relationships;
long-term KB: explicitly promoted reusable fingerprints, parsing patterns, technique constraints, validated workflow fragments;
global KB / looting: explicit export only. Never loot credentials, cookies, bearer tokens, session IDs, private bodies, or other secret material into a global KB.

Secret / privacy boundary

Raw proxy captures may contain credentials and sensitive application data, so they require stronger handling than derived graph facts.

Requirements:

configurable header/body capture and size limits;
canonical redaction for derived projections (Authorization, cookies, API keys, common secret fields, etc.);
preserve digests/references so redacted graph facts remain traceable to authorized raw evidence;
do not copy secrets into Prolog source, logs, StarIntel documents, long-term KB, or global KB by default;
local raw-capture retention/deletion policy is explicit and operation-scoped.

File/spool semantics

append-only during capture;
each record has deterministic framing/versioning;
parser can resume from a durable offset/checkpoint;
replaying the same file is idempotent;
truncated/corrupt records are quarantined/inspectable rather than interpreted as successful traffic;
file rotation is supported without losing correlation/provenance;
capture may continue while Hackpert/StarIntel are unavailable.

StarIntel ingest

Hackpert does not write StarIntel documents directly.

Flow:
capture evidence -> typed exchange -> accepted graph/asset/finding -> Hackmode StarIntel projection -> durable outbox -> starintel-server

Ingest should reuse canonical StarIntel document identities and provenance. A Rabbit/HTTP publish is not proof of acceptance; keep the existing durable outbox/ack semantics.

First implementation slices

versioned append-only IPX capture format and capture-session identity
proxy adapter that writes deterministic HTTP request/response records
tail/replay parser actor with checkpoints and quarantine
typed traffic/exchange nodes + edges in the Hackmode execution graph
redaction/body-reference policy
passive Hackpert snapshot facts for exchanges
typed passive-analysis graph delta
Common Lisp acceptance/persistence into operational KB/Tek9
StarIntel projection/outbox for accepted traffic-derived assets/findings/relations
LISH/Emacs controls for capture status, replay, passive analysis, graph inspection, and ingest state

Acceptance proof

Start a capture session for an operation.
Send deterministic fixture HTTP traffic through the proxy.
Capture file contains framed request/response evidence with stable correlation and offsets.
Stop/restart the parser and resume without duplicate graph records.
Hackpert passively derives endpoint/parameter/fingerprint graph facts from the capture.
No provider/tool executes as a side effect of passive analysis.
Common Lisp validates and persists accepted graph deltas.
Secret headers/fields are absent from Prolog projections, normal logs, long-term/global KB, and StarIntel documents by default.
With StarIntel offline, local capture + analysis continue and accepted projections remain in the durable outbox.
On reconnect, StarIntel ingest completes idempotently with provenance back to the capture evidence.
Replaying the same capture does not duplicate logical assets/findings/relations.

Non-goals for the first slice

transparent Internet-wide interception;
automatic active exploitation or replay;
teaching Prolog to mutate capture files or databases;
putting raw secret-bearing capture bodies into global KBs;
inventing a parallel StarIntel schema.

## Outcome Add the **IPX stack** to Hackmode: a local proxy/capture boundary records network/application traffic as durable evidence, Hackpert analyzes the capture **passively**, Common Lisp validates the resulting graph/KB deltas, and accepted observations are projected through Hackmode's canonical StarIntel outbox. This is a passive-intelligence path. Observing traffic must never implicitly trigger active scanning, exploitation, replay, mutation, or provider execution. Related expert architecture: #24 Foundation PR: #25 ## Core flow ```text client / browser / tool | v IPX capture proxy | v append-only capture file/spool (raw evidence + offsets/digests) | v capture parser/tailer actor | v typed HTTP/application exchanges | +----------------------------+ | | v v operational graph/KB deterministic Hackpert snapshot | v SWI-Prolog rules | v typed graph delta | v Common Lisp acceptance | +-----------+-----------+ | | v v Tek9/KB state StarIntel projection | v durable outbox | v starintel-server ``` ## Ownership / authority - the capture file/spool is immutable source evidence; analysis never rewrites it; - Common Lisp owns capture lifecycle, parsing, canonical graph/KB mutation, redaction policy, StarIntel projection, and all effects; - Hackpert/Prolog is passive/advisory: classify, correlate, fingerprint, infer, rank, and emit typed graph deltas; - Prolog gets bounded typed projections or references, **not arbitrary raw-file authority**; - passive findings do not invoke providers or attack engines automatically; - any later active action must cross the normal Hackmode scope/authorization/provider boundary explicitly. ## First protocol: HTTP(S) Start with HTTP request/response exchanges captured through the proxy. Preserve enough evidence to reconstruct provenance without forcing all raw bodies into the KB. Typed exchange metadata should cover at least: - operation/capture-session ID; - source file identity + byte/record offsets; - request/response correlation ID; - timestamp and duration; - method, scheme, host, port, path/query; - response status; - bounded/redacted headers; - request/response body digest + raw-evidence reference; - content type/length/encoding; - connection/TLS metadata when available; - parser/capture format version. Later protocol adapters may add WebSocket, SSE, raw TCP, DNS, or other application traces without changing the graph/KB authority model. ## Passive Hackpert analysis Hackpert should be able to derive graph/KB candidates such as: - domains, hosts, URLs, endpoints, parameters and observed values/types; - request -> response -> redirect relationships; - API route and resource relationships; - authentication/session boundaries and login/logout flows; - cookies/tokens **as secret-bearing evidence references, not reusable plaintext KB loot**; - technology/server/framework fingerprints with evidence; - error/debug responses and potentially interesting behavior; - repeated/variant requests and response-shape changes; - observed forms, inputs, content types and upload surfaces; - endpoint/parameter candidates for later explicitly authorized expert workflows; - traffic-derived findings with confidence/evidence links. The result is a graph delta with provenance back to the exact capture record(s). ## Operational / long-term / global KB Traffic-derived knowledge follows #24's KB lifecycle: - **operational KB:** per-operation endpoint graph, parameter observations, fingerprints, failed/successful flows, session relationships; - **long-term KB:** explicitly promoted reusable fingerprints, parsing patterns, technique constraints, validated workflow fragments; - **global KB / looting:** explicit export only. Never loot credentials, cookies, bearer tokens, session IDs, private bodies, or other secret material into a global KB. ## Secret / privacy boundary Raw proxy captures may contain credentials and sensitive application data, so they require stronger handling than derived graph facts. Requirements: - configurable header/body capture and size limits; - canonical redaction for derived projections (`Authorization`, cookies, API keys, common secret fields, etc.); - preserve digests/references so redacted graph facts remain traceable to authorized raw evidence; - do not copy secrets into Prolog source, logs, StarIntel documents, long-term KB, or global KB by default; - local raw-capture retention/deletion policy is explicit and operation-scoped. ## File/spool semantics - append-only during capture; - each record has deterministic framing/versioning; - parser can resume from a durable offset/checkpoint; - replaying the same file is idempotent; - truncated/corrupt records are quarantined/inspectable rather than interpreted as successful traffic; - file rotation is supported without losing correlation/provenance; - capture may continue while Hackpert/StarIntel are unavailable. ## StarIntel ingest Hackpert does **not** write StarIntel documents directly. Flow: `capture evidence -> typed exchange -> accepted graph/asset/finding -> Hackmode StarIntel projection -> durable outbox -> starintel-server` Ingest should reuse canonical StarIntel document identities and provenance. A Rabbit/HTTP publish is not proof of acceptance; keep the existing durable outbox/ack semantics. ## First implementation slices - [ ] versioned append-only IPX capture format and capture-session identity - [ ] proxy adapter that writes deterministic HTTP request/response records - [ ] tail/replay parser actor with checkpoints and quarantine - [ ] typed traffic/exchange nodes + edges in the Hackmode execution graph - [ ] redaction/body-reference policy - [ ] passive Hackpert snapshot facts for exchanges - [ ] typed passive-analysis graph delta - [ ] Common Lisp acceptance/persistence into operational KB/Tek9 - [ ] StarIntel projection/outbox for accepted traffic-derived assets/findings/relations - [ ] LISH/Emacs controls for capture status, replay, passive analysis, graph inspection, and ingest state ## Acceptance proof 1. Start a capture session for an operation. 2. Send deterministic fixture HTTP traffic through the proxy. 3. Capture file contains framed request/response evidence with stable correlation and offsets. 4. Stop/restart the parser and resume without duplicate graph records. 5. Hackpert passively derives endpoint/parameter/fingerprint graph facts from the capture. 6. No provider/tool executes as a side effect of passive analysis. 7. Common Lisp validates and persists accepted graph deltas. 8. Secret headers/fields are absent from Prolog projections, normal logs, long-term/global KB, and StarIntel documents by default. 9. With StarIntel offline, local capture + analysis continue and accepted projections remain in the durable outbox. 10. On reconnect, StarIntel ingest completes idempotently with provenance back to the capture evidence. 11. Replaying the same capture does not duplicate logical assets/findings/relations. ## Non-goals for the first slice - transparent Internet-wide interception; - automatic active exploitation or replay; - teaching Prolog to mutate capture files or databases; - putting raw secret-bearing capture bodies into global KBs; - inventing a parallel StarIntel schema.

nsaspy commented

2026-09-02 17:24:44 +00:00

Author

Owner

Database/execution-graph prerequisite merged via #84 as d39fdafe627bc3363ef89fc02a96fa931c9b07f6.

Completed owned slice:

typed :http-exchange evidence records persist in the existing operation-scoped Tek9 execution graph; no second graph/database;
stable identity is operation + capture session + exchange ID, so identical replay remains idempotent through the existing replay-safe persistence boundary;
bounded HTTP metadata is retained (method/scheme/host/port/path/status/timing) together with body digests, raw spool evidence reference, observation time, and parser provenance; raw bodies are not copied into graph records;
typed reads use the existing operation execution snapshot API with :http-exchange filtering;
invalid port/status/scheme/timing metadata fails closed.

RED 0b1cde84cf1986588d8aea42a6a650327295e247: core failed at the newly required database regression while monorepo and agent-framework-boundary passed.
GREEN exact implementation head e29ad25cb3592ad52071f535ef5633423ecb5ccb: core, monorepo, and agent-framework-boundary all passed; PR was mergeable with zero reviews/threads before expected-head squash merge.

Consumer-side capture/parser/Hackpert wiring remains outside the database worker.

Database/execution-graph prerequisite merged via #84 as `d39fdafe627bc3363ef89fc02a96fa931c9b07f6`. Completed owned slice: - typed `:http-exchange` evidence records persist in the existing operation-scoped Tek9 execution graph; no second graph/database; - stable identity is operation + capture session + exchange ID, so identical replay remains idempotent through the existing replay-safe persistence boundary; - bounded HTTP metadata is retained (method/scheme/host/port/path/status/timing) together with body digests, raw spool evidence reference, observation time, and parser provenance; raw bodies are not copied into graph records; - typed reads use the existing operation execution snapshot API with `:http-exchange` filtering; - invalid port/status/scheme/timing metadata fails closed. RED `0b1cde84cf1986588d8aea42a6a650327295e247`: core failed at the newly required database regression while monorepo and agent-framework-boundary passed. GREEN exact implementation head `e29ad25cb3592ad52071f535ef5633423ecb5ccb`: core, monorepo, and agent-framework-boundary all passed; PR was mergeable with zero reviews/threads before expected-head squash merge. Consumer-side capture/parser/Hackpert wiring remains outside the database worker.

nsaspy commented

2026-09-02 17:24:45 +00:00

Author

Owner

Hackpert passive HTTP-evidence projection merged via #86 at a858a6f4fd3e2192dc0a3d98901f62d29784672d.

Database #84 supplied the canonical typed HTTP exchange record. Hackpert now projects that record into a dedicated bounded http_exchange(...) Prolog fact carrying operation/capture/exchange identity plus method/scheme/host/port/path/status/body digests/observed time/duration. The raw capture evidence reference and generic payload/provenance serialization are intentionally excluded from Prolog.

This is projection-only passive reasoning input: no provider execution, capture implementation, database mutation, StarIntel product work, or second scheduler/effect path was added.

RED 1dfcedf3c41173078d47cf4c58da87b7fb757552: exact-head core failed on the missing typed HTTP fact while monorepo and agent-framework-boundary passed.
GREEN exact head 750ea18f813909b53cef4ec3d89be13888b74923: core, monorepo, and agent-framework-boundary all passed twice across the identical-head draft/non-draft PR transition. PR #86 was mergeable with zero reviews and zero unresolved review threads before expected-head squash merge.

Draft #85 was closed only because the ready-for-review GraphQL mutation hit the connector's known fullDatabaseId incompatibility; #86 reused the identical green head.

Hackpert passive HTTP-evidence projection merged via #86 at `a858a6f4fd3e2192dc0a3d98901f62d29784672d`. Database #84 supplied the canonical typed HTTP exchange record. Hackpert now projects that record into a dedicated bounded `http_exchange(...)` Prolog fact carrying operation/capture/exchange identity plus method/scheme/host/port/path/status/body digests/observed time/duration. The raw capture evidence reference and generic payload/provenance serialization are intentionally excluded from Prolog. This is projection-only passive reasoning input: no provider execution, capture implementation, database mutation, StarIntel product work, or second scheduler/effect path was added. RED `1dfcedf3c41173078d47cf4c58da87b7fb757552`: exact-head core failed on the missing typed HTTP fact while monorepo and agent-framework-boundary passed. GREEN exact head `750ea18f813909b53cef4ec3d89be13888b74923`: core, monorepo, and agent-framework-boundary all passed twice across the identical-head draft/non-draft PR transition. PR #86 was mergeable with zero reviews and zero unresolved review threads before expected-head squash merge. Draft #85 was closed only because the ready-for-review GraphQL mutation hit the connector's known `fullDatabaseId` incompatibility; #86 reused the identical green head.

nsaspy commented

2026-09-02 17:24:45 +00:00

Author

Owner

Database handoff: PR #87 merged the durable replay-checkpoint prerequisite into the canonical operation-scoped Tek9 execution graph. Capture checkpoints are immutable typed records scoped by operation + capture session + source, carry framing/provenance plus optional last-record evidence, replay idempotently, and expose a deterministic latest-checkpoint read by greatest durable offset. Same source/session/offset with changed content is protected by the existing replay-conflict boundary. Parser/tailer ownership can now resume only after its last committed framed record; parser actor, capture format, quarantine, and Hackpert consumption remain separate slices.

nsaspy commented

2026-09-02 17:24:45 +00:00

Author

Owner

Database handoff: PR #93 merged malformed/truncated capture quarantine into the canonical operation-scoped Tek9 execution graph as b2ffadaf951038d742774061915cdc531d425eff. Quarantine records are immutable typed :capture-quarantine evidence scoped by operation + capture session + source, retain offset/length, failure reason, raw-evidence reference, framing version, and parser provenance, replay idempotently, and read back in durable offset order. Exact PR head 38ed0b4633eca913b6310f9a420639b1159c8188 passed core, monorepo, and agent-framework-boundary; master was unchanged, the PR was mergeable, and it had zero reviews/threads before expected-head squash merge. Parser/tailer logic remains outside this database slice.

Database handoff: PR #93 merged malformed/truncated capture quarantine into the canonical operation-scoped Tek9 execution graph as `b2ffadaf951038d742774061915cdc531d425eff`. Quarantine records are immutable typed `:capture-quarantine` evidence scoped by operation + capture session + source, retain offset/length, failure reason, raw-evidence reference, framing version, and parser provenance, replay idempotently, and read back in durable offset order. Exact PR head `38ed0b4633eca913b6310f9a420639b1159c8188` passed core, monorepo, and agent-framework-boundary; master was unchanged, the PR was mergeable, and it had zero reviews/threads before expected-head squash merge. Parser/tailer logic remains outside this database slice.

nsaspy commented

2026-09-02 17:24:45 +00:00

Author

Owner

Database slice merged via #96 (f67a114d66856699a75ae04f5000844049635712). Canonical Tek9 execution-graph persistence now includes immutable, operation/capture-scoped capture-source rotation lineage with deterministic replay identity and durable-offset ordering. Parser/tailer ownership stays outside the database boundary: consumers should persist the rotation record when a predecessor source closes/rotates and then resume the successor source using the existing checkpoint/quarantine contracts. No shadow persistence authority was introduced.

Database slice merged via #96 (`f67a114d66856699a75ae04f5000844049635712`). Canonical Tek9 execution-graph persistence now includes immutable, operation/capture-scoped capture-source rotation lineage with deterministic replay identity and durable-offset ordering. Parser/tailer ownership stays outside the database boundary: consumers should persist the rotation record when a predecessor source closes/rotates and then resume the successor source using the existing checkpoint/quarantine contracts. No shadow persistence authority was introduced.

nsaspy commented

2026-09-02 17:24:45 +00:00

Author

Owner

Database/graph progress: merged #105 as 3ca1da553db6c2218a16524f7b8e7b204686b25d to reject divergent capture-source rotation forks inside the canonical Tek9 execution-graph write transaction.

Contract:

scope is operation + capture session + predecessor source;
exact deterministic replay remains accepted;
a second different successor for the same predecessor fails closed with persistence-replay-conflict;
validation and persistence are serialized in the same Tek9 write transaction, so concurrent/replayed writers cannot create ambiguous restart lineage;
no parser actor state store, shadow graph/KB, second database, Hackpert consumer logic, or StarIntel product work was added.

RED regression: 96a7c2d3fb58056a4969d8eb824619190213adf3.
GREEN exact PR head: 340dde0d0d798ba65e5a68d52565111681fa228b; core, monorepo, and agent-framework-boundary all passed, with zero reviews/threads before expected-head squash merge.

Parser/tailer handoff: treat the predecessor->successor rotation relation as a single-valued durable lineage edge. Replaying the same edge is safe; discovering a contradictory successor is an explicit persistence conflict to quarantine/escalate rather than silently choosing one.

Database/graph progress: merged #105 as `3ca1da553db6c2218a16524f7b8e7b204686b25d` to reject divergent capture-source rotation forks inside the canonical Tek9 execution-graph write transaction. Contract: - scope is operation + capture session + predecessor source; - exact deterministic replay remains accepted; - a second different successor for the same predecessor fails closed with `persistence-replay-conflict`; - validation and persistence are serialized in the same Tek9 write transaction, so concurrent/replayed writers cannot create ambiguous restart lineage; - no parser actor state store, shadow graph/KB, second database, Hackpert consumer logic, or StarIntel product work was added. RED regression: `96a7c2d3fb58056a4969d8eb824619190213adf3`. GREEN exact PR head: `340dde0d0d798ba65e5a68d52565111681fa228b`; `core`, `monorepo`, and `agent-framework-boundary` all passed, with zero reviews/threads before expected-head squash merge. Parser/tailer handoff: treat the predecessor->successor rotation relation as a single-valued durable lineage edge. Replaying the same edge is safe; discovering a contradictory successor is an explicit persistence conflict to quarantine/escalate rather than silently choosing one.

nsaspy commented

2026-09-02 17:24:45 +00:00

Author

Owner

Operator direction recorded in #133: make one operation-scoped mitmproxy/mitmdump service the default HTTP capture path, with HTTP-capable providers routed through it where protocol semantics permit. Keep this issue's IPX spool -> checkpoint/quarantine/rotation -> typed :http-exchange persistence as the single capture authority; the proxy addon/process writes the spool and never Tek9 directly.

Important transport invariant added in #133: full TLS interception and end-to-end curl/browser TLS impersonation are mutually different modes. Capture provenance must say intercept vs tunnel/direct rather than claiming both decrypted traffic and the original client's origin-side TLS fingerprint.

ZAP should reuse this capture path for outbound traffic instead of introducing a second HTTP-history ingestion pipeline. ZAP-specific alert/spider/scan control remains #21/#22.

Operator direction recorded in #133: make one operation-scoped mitmproxy/mitmdump service the default HTTP capture path, with HTTP-capable providers routed through it where protocol semantics permit. Keep this issue's IPX spool -> checkpoint/quarantine/rotation -> typed `:http-exchange` persistence as the single capture authority; the proxy addon/process writes the spool and never Tek9 directly. Important transport invariant added in #133: full TLS interception and end-to-end curl/browser TLS impersonation are mutually different modes. Capture provenance must say `intercept` vs `tunnel`/direct rather than claiming both decrypted traffic and the original client's origin-side TLS fingerprint. ZAP should reuse this capture path for outbound traffic instead of introducing a second HTTP-history ingestion pipeline. ZAP-specific alert/spider/scan control remains #21/#22.

nsaspy commented

2026-09-02 17:24:45 +00:00

Author

Owner

Concrete implementation children now exist for the capture half:

#135 supervised mitmproxy/mitmdump lifecycle
#136 deterministic versioned mitmproxy -> IPX spool adapter
#137 runtime transport/capture + browser-profile policy
#139 ZAP traffic chaining through the same canonical IPX path

Database checkpoint/quarantine/rotation/http-exchange persistence remains canonical; provider/addon workers must not write Tek9 directly.

Concrete implementation children now exist for the capture half: - #135 supervised mitmproxy/mitmdump lifecycle - #136 deterministic versioned mitmproxy -> IPX spool adapter - #137 runtime transport/capture + browser-profile policy - #139 ZAP traffic chaining through the same canonical IPX path Database checkpoint/quarantine/rotation/http-exchange persistence remains canonical; provider/addon workers must not write Tek9 directly.

nsaspy commented

2026-09-02 17:24:45 +00:00

Author

Owner

Database/capture persistence slice landed via #174 (6f40a4461809d6509ea8c7f02afcc1db0ce58b31).

RED: test-only a438518b59adb7c437f6f84c22e65631a5baa4c1 failed the repository-native Common Lisp gate after dependencies installed because HACKMODE:REPLAY-IPX-HTTP-SPOOL was absent.

GREEN: exact implementation head 898b5f85d35947cec9debd3b05f597a119cc130a passed Common Lisp core, hygiene, and the product/framework boundary. The landed replay boundary reads binary byte offsets, validates operation/capture-session/source identity, persists canonical typed :http-exchange records, resumes from durable checkpoints, quarantines malformed complete frames while advancing past them, and quarantines truncated final frames without advancing the checkpoint. Persistence failures propagate rather than being mislabeled as corrupt source evidence.

The lossless IPX spool remains source evidence authority; no second operation DB/graph/KB/scheduler was introduced.

#26 remains open for its broader remaining tailer/analysis/operator-control work.

Database/capture persistence slice landed via #174 (`6f40a4461809d6509ea8c7f02afcc1db0ce58b31`). RED: test-only `a438518b59adb7c437f6f84c22e65631a5baa4c1` failed the repository-native Common Lisp gate after dependencies installed because `HACKMODE:REPLAY-IPX-HTTP-SPOOL` was absent. GREEN: exact implementation head `898b5f85d35947cec9debd3b05f597a119cc130a` passed Common Lisp core, hygiene, and the product/framework boundary. The landed replay boundary reads binary byte offsets, validates operation/capture-session/source identity, persists canonical typed `:http-exchange` records, resumes from durable checkpoints, quarantines malformed complete frames while advancing past them, and quarantines truncated final frames without advancing the checkpoint. Persistence failures propagate rather than being mislabeled as corrupt source evidence. The lossless IPX spool remains source evidence authority; no second operation DB/graph/KB/scheduler was introduced. #26 remains open for its broader remaining tailer/analysis/operator-control work.

nsaspy referenced this issue

2026-09-02 17:24:45 +00:00

Implement Hackpert active engine orchestration and canonical state mutation #49