Project Hackmode assets to canonical StarIntel documents #16

Merged

lost-rob0t merged 7 commits from agent/starintel-document-projection into master

2026-08-16 05:35:56 +00:00

lost-rob0t commented

2026-08-16 05:32:26 +00:00

(Migrated from github.com)

Summary

Completes the canonical runtime/document boundary for #6 by aligning Hackmode local asset identity with the actual star-cl document model and routing existing DNS recon discoveries through the canonical local lifecycle.

Canonical StarIntel projection

Adds starintel-documents.lisp with provider-neutral projection for:

domain -> starintel:domain
resolved host -> starintel:host
URL -> starintel:url

Projection carries Hackmode operation/producer metadata in StarIntel provenance and encodes through starintel:encode.

Unresolved hosts are deliberately not projected yet: star-cl currently hashes host identity from IP only, and empty-IP hosts would collide. lost-rob0t/star-cl#9 tracks the schema fix.

Identity convergence

For assets with a safe StarIntel projection, asset-deterministic-id now uses the projected document's own starintel:doc-id. Local Hackmode and central StarIntel therefore address the same domain/host/URL with the same logical ID.

Unsupported compatibility assets retain deterministic local starintel:digest-id fallback identity; child assets such as ports still require a parent ID.

Recon ingestion boundary

Adds record-recon-asset:

open operation DB -> normalize, deterministic identity, dedupe, persist, generic event, compatibility hook
no operation DB -> normalize + compatibility hook only; no fake persisted event

Existing DNS adapters now use it:

subfinder*
oam-subs*
cert.sh*

This removes ad-hoc sxhash IDs and fixes the oam-subs finish-hook/collection path.

Verification executed

Current head 2d04b1993b9a4349ea77710e0139fbe5261b39b7:

core / common-lisp-core: PASS — executes (asdf:test-system :hackmode) on a clean runner
monorepo / hygiene: PASS

The Common Lisp suite covers canonical domain projection, shared Hackmode/StarIntel ID, v0.9 wire encoding and operation provenance, unresolved-host collision guard, and recon-result persistence/deduplication/event behavior.

Closes #6.
Unresolved-host schema follow-up: lost-rob0t/star-cl#9.
Emacs runtime-client convergence: #17.

## Summary Completes the canonical runtime/document boundary for #6 by aligning Hackmode local asset identity with the actual `star-cl` document model and routing existing DNS recon discoveries through the canonical local lifecycle. ### Canonical StarIntel projection Adds `starintel-documents.lisp` with provider-neutral projection for: - domain -> `starintel:domain` - resolved host -> `starintel:host` - URL -> `starintel:url` Projection carries Hackmode operation/producer metadata in StarIntel provenance and encodes through `starintel:encode`. Unresolved hosts are deliberately not projected yet: `star-cl` currently hashes host identity from IP only, and empty-IP hosts would collide. `lost-rob0t/star-cl#9` tracks the schema fix. ### Identity convergence For assets with a safe StarIntel projection, `asset-deterministic-id` now uses the projected document's own `starintel:doc-id`. Local Hackmode and central StarIntel therefore address the same domain/host/URL with the same logical ID. Unsupported compatibility assets retain deterministic local `starintel:digest-id` fallback identity; child assets such as ports still require a parent ID. ### Recon ingestion boundary Adds `record-recon-asset`: - open operation DB -> normalize, deterministic identity, dedupe, persist, generic event, compatibility hook - no operation DB -> normalize + compatibility hook only; no fake persisted event Existing DNS adapters now use it: - `subfinder*` - `oam-subs*` - `cert.sh*` This removes ad-hoc `sxhash` IDs and fixes the `oam-subs` finish-hook/collection path. ### Verification executed Current head `2d04b1993b9a4349ea77710e0139fbe5261b39b7`: - `core / common-lisp-core`: PASS — executes `(asdf:test-system :hackmode)` on a clean runner - `monorepo / hygiene`: PASS The Common Lisp suite covers canonical domain projection, shared Hackmode/StarIntel ID, v0.9 wire encoding and operation provenance, unresolved-host collision guard, and recon-result persistence/deduplication/event behavior. Closes #6. Unresolved-host schema follow-up: lost-rob0t/star-cl#9. Emacs runtime-client convergence: #17.