87 lines
5.0 KiB
Markdown
87 lines
5.0 KiB
Markdown
# Bounded diagnostics and policy continuity
|
||
|
||
Browser diagnostics are optional and centrally authorized. They never replace
|
||
the protected durable security audit. This change keeps inspection, release
|
||
checks, audit encryption and `fsync` unchanged.
|
||
|
||
## Browser exports
|
||
|
||
Each signal has one active SDK export and a FIFO bounded by the signed
|
||
`maxQueueSize` in waiting records, plus its active batch. Queue expiry uses the
|
||
original record timestamps; waiting does not refresh authorization or age.
|
||
Overflow, expiry, timeout and cancellation remain actual counted failures.
|
||
The process retains lifetime totals, fixed reason counts and at most 32 cloned
|
||
failure facts, including queue age. Error text, bodies, endpoints and credentials
|
||
are absent. Completed callbacks cannot count twice.
|
||
|
||
Flush calls share one promise per generation. Dispatch waits for the next event
|
||
loop turn after completion because the SDK frees its internal concurrency slot
|
||
after invoking the callback. Real successful HTTP drain tests cover that race,
|
||
including exports arriving during the callback-to-settlement interval.
|
||
|
||
An already verified, unexpired policy can keep diagnostics active through a
|
||
publication when the full exporter configuration and device context remain
|
||
identical, except for policy version. Policy and bookmark signatures and device
|
||
assignment are checked first. Operation contexts are immutable snapshots:
|
||
existing spans and logs keep their original version; new root operations use
|
||
the new version. Explicit operation metadata still overrides defaults.
|
||
|
||
Changed endpoint, mode, sampling, limits, identity or disabled diagnostics still
|
||
cancel active requests and waiting callbacks immediately. Expired previous
|
||
authority cannot use continuity. Cancellation remains visible in lifetime
|
||
failure accounting; it is not silently relabeled as successful delivery.
|
||
|
||
## Protected local development collector
|
||
|
||
The loopback receiver bounds unfinished OTLP requests to eight and their shared
|
||
body buffers to 8 MiB, with a 2 MiB per-body limit. Idle incomplete requests time
|
||
out after ten seconds. Overload returns fixed503; oversized bodies return413.
|
||
Aborts release reservations and remove waiting work. Commit work is serialized
|
||
without changing the encryption, path guards, rotation or synchronous `fsync`.
|
||
HTTP200 still follows actual encrypted persistence; storage failure returns507.
|
||
|
||
Admission summaries expose counts, bytes, queue wait and commit duration. Native
|
||
event-loop delay is metadata only. This is bounded admission and observability,
|
||
not a claim that synchronous disk work has been moved into a worker.
|
||
|
||
Startup verifies an existing exact private directory ACL without resetting it:
|
||
current user owns it, inheritance is disabled, and its sole explicit rule grants
|
||
that user FullControl with file/directory inheritance. Unsafe ACLs require a
|
||
successful protection and verification step or prevent startup. This avoids a
|
||
redundant owner-setting operation that failed under a non-elevated token.
|
||
The existing DPAPI key and encrypted archives remain intact across restart.
|
||
This developer receiver is not a production SIEM or remote collector.
|
||
|
||
## Current Windows evidence
|
||
|
||
The final frozen main/diagnostics source passed:
|
||
|
||
- 784 source tests, zero failures or skips, and ESLint with zero warnings.
|
||
- Actual native clipboard/upload enforcement:17 checks and five additional
|
||
checks after a real process restart;13 public requests, zero confidential
|
||
deliveries and two exactly received public files.
|
||
- Real local Gemma: all four semantic receiver checks, with confidential
|
||
paraphrases blocked and no external model inspection.
|
||
- Window and first-statement dedicated Worker WebTransport attempts through
|
||
three signed policy phases: six Created and six Closed security records,
|
||
zero managed packets/bytes, and three successful public HTTPS submissions.
|
||
- Zero current and lifetime export failures in all those browser processes.
|
||
|
||
Actual semantic file trace `e5ebf887a1ad8d90f065739a86cd2261` shows a9.04s
|
||
request containing several independently inspected representations. Individual
|
||
local stages took1.69–1.93s; semantic stages0.78–1.03s, with audit commit12–16ms.
|
||
These are measured profiling targets, not permission to remove required checks.
|
||
Collector checkpoint:578 commits, zero commit failures/rejections, max queue
|
||
wait14.87ms and max commit42.18ms, with no active or waiting request at inspection.
|
||
|
||
Ignored evidence: `artifacts/diagnostics-continuity-final-suite.log`,
|
||
`context-reuse-{public,mvp,semantic,wt}-native.log`, the corresponding native
|
||
proof JSON files and `diagnostics-continuity-collector-checkpoint.json`.
|
||
Use `node --test --test-concurrency=2 tests/*.test.mjs` for the full Windows suite.
|
||
|
||
Historical failed runs remain retained. Their earlier three2s export timeouts
|
||
cannot be causally explained retroactively by these later successful runs.
|
||
The separately measured SDK drain race and policy-retirement losses have direct
|
||
regression coverage. The native WebRTC engine crash remains a separate open
|
||
Windows MVP gate; see [the current scope](windows-dlp-mvp.md).
|