Report blocked attacks, with rule-scoped evidence - #200

Merged

patchstackdave merged 33 commits into

mainfrom

feat/detection-reporting-enrolment

Sep 1, 2026

Commits on Aug 31, 2026

Gate security-event reporting on platform enrolment, not a config flag

patchstackdave
and
claude
committed
8277789
Carry the reporting state to the platform, and keep it current

patchstackdave
and
claude
committed
6788616
Acknowledge the settled reporting state, and disclose the new default

patchstackdave
and
claude
committed
6d2d5b8
Count capability acknowledgements apart from event delivery

patchstackdave
and
claude
committed
c227e04
Acknowledge the settled state after a refresh, not only after boot

patchstackdave
and
claude
committed
5f3fe5b
Resolve a client address from what the runtime observed, with its provenance

patchstackdave
and
claude
committed
1411e8b
Validate every field of a trust policy, and keep an IPv6 zone or refuse it

patchstackdave
and
claude
committed
d49614c
Read a trust policy and a forwarded header from own properties only

patchstackdave
and
claude
committed
088e43a
Refuse a mapped IPv4 address that carries a zone

patchstackdave
and
claude
committed
99ce09d

Commits on Sep 1, 2026

Resolve the client address once per request, and share it

patchstackdave
and
claude
committed
ec6740b
Carry every addressable field, and the resolved address, all the way through

patchstackdave
and
claude
committed
2f24e72
Keep raw evidence, and let no callback rewrite what the platform is told

patchstackdave
and
claude
committed
2fc0cb8
Narrow the callback's view of a rule, and take raw evidence only from the request

patchstackdave
and
claude
committed
b1f9579
Take request evidence only from the request, and record the address change for Node

patchstackdave
and
claude
committed
66c2665
Take an inherited request field only from a framework accessor

patchstackdave
and
claude
committed
27d5421
Retry a security event that is worth retrying, once, under one key

patchstackdave
and
claude
committed
063e800
Leave nothing outstanding when reporting stops, and bound a request in bytes

patchstackdave
and
claude
committed
c2d692d
Authenticate a detection on its own, and let a shutdown wait for the drain

patchstackdave
and
claude
committed
794e23b
End the drain when the shutdown budget runs out, and wait for every buffer

patchstackdave
and
claude
committed
4dd329e
Bound the block log's shutdown, and track the sends a queue no longer knows about

patchstackdave
and
claude
committed
4c4f7f6
Give the block log a controller that exists before a shutdown needs it

patchstackdave
and
claude
committed
9717dbf
Let a shutdown own the block log's queue from the moment it begins

patchstackdave
and
claude
committed
7e8d69e
Derive what a rule permits to be captured, and capture nothing yet

patchstackdave
and
claude
committed
615311c
Take capture permissions from the rule contract, and publish the opt-in

patchstackdave
and
claude
committed
554bf7d
Read the evidence a plan permits, from the reading the match was decided by

patchstackdave
and
claude
committed
84f13e4
Send the evidence a rule permitted, and say so in the shipped docs

patchstackdave
and
claude
committed
200af7f
Report the settled baseline, bound evidence at the wire, and say so everywhere

patchstackdave
and
claude
committed
a2a363b
Carry the baseline on every runtime and phase, and validate what reaches the wire

patchstackdave
and
claude
committed
df45589
Read a capture's own fields only, and state the egress baseline as its own

patchstackdave
and
claude
committed
de617f3
State the shared baseline once, the phase-specific fields twice, and name a query parameter as the guard does

patchstackdave
and
claude
committed
1ed9a41
Say what queryKeysOf returns

patchstackdave
and
claude
committed
eacf012
Refuse to publish while the server side is not ready

patchstackdave
and
claude
committed
b3645d7
Note the reporting release dependencies where a release is cut

patchstackdave
and
claude
committed
9e5a351

Navigation Menu

Report blocked attacks, with rule-scoped evidence - #200

Report blocked attacks, with rule-scoped evidence#200
patchstackdave merged 33 commits into
mainfrom
feat/detection-reporting-enrolment

Commits on Aug 31, 2026

Gate security-event reporting on platform enrolment, not a config flag

Carry the reporting state to the platform, and keep it current

Acknowledge the settled reporting state, and disclose the new default

Count capability acknowledgements apart from event delivery

Acknowledge the settled state after a refresh, not only after boot

Resolve a client address from what the runtime observed, with its provenance

Validate every field of a trust policy, and keep an IPv6 zone or refuse it

Read a trust policy and a forwarded header from own properties only

Refuse a mapped IPv4 address that carries a zone

Commits on Sep 1, 2026

Resolve the client address once per request, and share it

Carry every addressable field, and the resolved address, all the way through

Keep raw evidence, and let no callback rewrite what the platform is told

Narrow the callback's view of a rule, and take raw evidence only from the request

Take request evidence only from the request, and record the address change for Node

Take an inherited request field only from a framework accessor

Retry a security event that is worth retrying, once, under one key

Leave nothing outstanding when reporting stops, and bound a request in bytes

Authenticate a detection on its own, and let a shutdown wait for the drain

End the drain when the shutdown budget runs out, and wait for every buffer

Bound the block log's shutdown, and track the sends a queue no longer knows about

Give the block log a controller that exists before a shutdown needs it

Let a shutdown own the block log's queue from the moment it begins

Derive what a rule permits to be captured, and capture nothing yet

Take capture permissions from the rule contract, and publish the opt-in

Read the evidence a plan permits, from the reading the match was decided by

Send the evidence a rule permitted, and say so in the shipped docs

Report the settled baseline, bound evidence at the wire, and say so everywhere

Carry the baseline on every runtime and phase, and validate what reaches the wire

Read a capture's own fields only, and state the egress baseline as its own

State the shared baseline once, the phase-specific fields twice, and name a query parameter as the guard does

Say what queryKeysOf returns

Refuse to publish while the server side is not ready

Note the reporting release dependencies where a release is cut