39b935aeb6
Some checks failed
CI Docker Mining Proof / Linux agent hashrate proof (push) Has been cancelled
Batch fusion now skips preflight/build failures per file, shows skipped count in progress header and log, and documents coverage by removing the deferred PROBLEMS row.
137 lines
11 KiB
Markdown
137 lines
11 KiB
Markdown
# PROBLEMS.md
|
||
|
||
Open issues only. Fixed items removed. Last sweep: 2026-06-07.
|
||
|
||
## By design / safety
|
||
|
||
| Issue | Notes |
|
||
|-------|-------|
|
||
| **`bof_execute` disabled** | Agent returns explicit error; in-memory BOF execution disabled (`client.go`). |
|
||
| **Process hollowing AMSI/ETW** | Relocation done; Defender/ETW ~50% failure; bypass not implemented (`hollow_windows.go`). |
|
||
| **Cloudflared in-process (non-Windows server)** | Stub on Linux/macOS; use external connector (`AF_TUNNEL_EXTERNAL`) or add launcher. |
|
||
| **macOS camera / GPU miner** | Stubs or partial; Linux has V4L2 + nvidia-smi path. |
|
||
| **KEV heuristics** | Non-Windows agents return `Status: n/a` (Windows-only CVE matching). |
|
||
| **Mesh P2P without `-tags p2p`** | Default build reports 0 peers (`mesh_p2p_stub.go`). |
|
||
| **Linux/macOS GPU RVN mining** | `detectGPU()` may find NVIDIA but miners download Windows `.exe` only. |
|
||
|
||
## Scale limits (hundreds of subnets / 500+ agents)
|
||
|
||
| Area | Notes |
|
||
|------|-------|
|
||
| **Subnet grouping** | Derived from `agents.ip` /24 prefix at query time; no `agents.subnet` column — hundreds of subnets OK via `LIKE` filter + dropdown (not chips). |
|
||
| **Per-agent subnet scan** | Capped at 128 hosts (`MaxSubnetScanHosts`); syscheck uses 20; spread sem=16 per agent. Fleet discovery is incremental (ARP + capped sweep), not full /16. |
|
||
| **`stats_batch` WS** | Server coalesces stats every 250ms into one frame; client applies in single `setAgents` pass with `agentStatsUnchanged` skip. |
|
||
| **Hashrate samples** | One `INSERT` per agent stats tick — dominant DB write at scale; retention/prune policy not automated. |
|
||
| **Stale-agent sweep** | Every 45s calls `ListAgents()` full table scan; acceptable to ~1000 rows, costly beyond without indexed partial query. |
|
||
|
||
## Antivirus / Windows Defender
|
||
|
||
| Topic | Notes |
|
||
|-------|-------|
|
||
| **Why "AV off" fails** | UI toggle often disables **Real-time protection** only. **Tamper Protection**, **cloud-delivered protection**, **Controlled folder access**, **SmartScreen**, and **behavioral** blocks still run. `defender_off` remote action and `SilentAVExclusion` fail without elevation; Tamper Protection reverts `Set-MpPreference`. |
|
||
| **High-friction paths** | GPU subprocess (T-Rex/TRM `.exe` download), garble/obfuscated agent binary, spread/hollow/persistence, `SilentAVExclusion` hidden PowerShell. In-process RandomX (pure Go) has **no external CPU miner exe**. |
|
||
| **Default execution (2026-06-06)** | Forge default is `miner_execution=auto` (full cascade). **AV-Safe** preset still bakes `inprocess` only, GPU off, no hollow/spread. |
|
||
| **Operator tooling** | Calibrate → **Windows Defender Exclusions** generates elevated `.ps1` (manual run). Crucible → **Mining Diagnostics** command returns JSON blockers. |
|
||
| **No silver bullet** | No architecture is 100% invisible. Best combo: in-process CPU + path/process exclusions + dedicated mining hardware for GPU. |
|
||
|
||
## Container Mining
|
||
|
||
| Topic | Notes |
|
||
|-------|-------|
|
||
| **Fallback chain** | `agent/miner/fallback_chain.go` orchestrates container → in-process → GPU (parallel) → Stratum overlay. Failures in `failed_methods[]` on stats WS. 30s cooldown between full re-passes. |
|
||
| **Default execution** | Forge default is `auto` (full chain). `inprocess`/`container`/`subprocess` limit which steps run. |
|
||
| **AV limits (honest)** | Containers are **not** invisible — AV still sees `docker.exe`, image pulls, and container filesystem scans. Legitimate benefit is **isolated workload** and fewer host subprocess spawns (GPU T-Rex/TRM). In-process RandomX has no external CPU miner exe. |
|
||
| **GPU in container** | Linux `--gpus all` stub only; Windows Docker Desktop GPU passthrough is operator-dependent. Host subprocess GPU path remains fallback. |
|
||
| **Worker image** | `aetherforge/agent-worker:latest` (override `AETHERFORGE_MINER_IMAGE`). Build from `docker/Dockerfile.agent`; not auto-pulled in MVP. |
|
||
| **Deferred** | Container hashrate on dashboard (host reports 0 CPU H/s while container mines); auto-build/push worker image in forge; Podman rootless on Windows. |
|
||
|
||
## Architecture deferred (large)
|
||
|
||
| Area | Notes |
|
||
|------|-------|
|
||
| **`tunnel_stream`** | Server-side TCP reverse relay documented as future (`README.md`). |
|
||
| **Path Tracer sessions** | `TraceSession` in handler RAM; restart loses state; no DB persistence or startup sweep. |
|
||
| **Non-Windows Path Tracer parity** | `pathtracer_stub.go` errors on `wg_setup`; chains are Windows-agent focused. |
|
||
| **NAT / symmetric UDP** | UPnP + DB IP fallback; no STUN/TURN or post-config connectivity probe. |
|
||
| **Fixed WireGuard port 51820** | Same UDP port all hops; multi-agent behind one NAT may conflict. |
|
||
| **Agent display name vs hostname** | WS `UpsertAgent` preserves operator rename when `name != hostname`; reconnect with hostname only keeps DB label. |
|
||
| **WireGuard auto-download (Windows)** | `ensureWGExe()` on first Path Tracer use; heavy, may need admin; pre-install recommended. |
|
||
| **Monolithic WebSocket context** | All `useWebSocket()` consumers re-render on any WS change; split contexts/selectors deferred. |
|
||
| **`CruciblePage` size (~2k lines)** | Terminal + fleet + tabs in one component; section split/memo deferred. |
|
||
| **WS `init` ships full fleet** | Dashboard connect still loads all agents in one JSON blob; pagination is REST-only (`?limit=&offset=`). |
|
||
| **SQLite single-writer ceiling** | `SetMaxOpenConns(1)` + WAL; sustained 1000+ agents with per-tick DB writes may SQLITE_BUSY; consider Postgres or write batching at 1000+. |
|
||
| **In-memory WS agent state** | Hub maps (`agentCapabilities`, `agentLogs`, DNS cache) grow O(agents); no eviction on disconnect beyond log trim. |
|
||
| **Fleet topology 3D cap** | `FleetTopologyMap` renders at most 200 nodes; larger fleets need subnet-grouped view or server-side aggregation. |
|
||
| **Crucible roster pagination** | Roster paginates 80 cards/page; bulk select-all still operates on filtered set in memory. |
|
||
| **No CI HTTP forge** | `e2e-validate.ps1 -ForgeAgent` manual; live compile needs `LIVE_FORGE=1` + `-tags liveforge`. |
|
||
| **Non-Windows forge host** | PE disguise / osslsigncode signing platform-limited by design. |
|
||
| **Mac PathForge runtime** | `.command` curl `/api/download/agent-mac`; needs reachable `server_url` + binary on server. |
|
||
| **Terminal virtualization** | 400-line DOM cap only; full virtual scrollback deferred. |
|
||
| **Vite chunk weight** | `three` + vendor warnings; FleetTopologyMap lazy but heavy first open. |
|
||
| **Erasure-coded multi-lane propagation** | Brainstorm only — no Reed–Solomon shard encode/decode, no parallel lane redundancy beyond existing single-lane spread + BGP router hints; do not half-ship without agent staging + server reassembly design. |
|
||
|
||
## Open bugs / behavior
|
||
|
||
| Issue | Notes |
|
||
|-------|-------|
|
||
| **Unknown Unix CPU stats stub** | `cpu_stub.go` may return 0 and break idle-mining guard on exotic platforms. |
|
||
| **Linux headless screenshot** | Needs `xvfb` + scrot or custom `command` in containers. |
|
||
|
||
## UX / visual (unfixed DV)
|
||
|
||
| ID | Issue |
|
||
|----|-------|
|
||
| DV-01 | Neon cyan fragmentation (`#00f5ff`, `#0ff` vs token `#00e8f5`) across several components. |
|
||
| DV-02 | Page header patterns diverge (Build Manager, Path Tracer green title, Forge naming). |
|
||
| DV-03 | `SacredPageHeader` unused (dead CSS path). |
|
||
| DV-04 | `Pages.css` duplicate `.empty-state` / `.page-header h1` override order. |
|
||
| DV-07 | Path Tracer visual island (`#00ffaa`) vs operator-deck chrome. |
|
||
| DV-09 | Dead chart badge styles in wealth-deck CSS. |
|
||
| DV-13 | Dark-only; no light / `prefers-color-scheme` path. |
|
||
| DV-14 | Sidebar footer hard-coded `v0.0.1`. |
|
||
|
||
## Help / product copy gaps
|
||
|
||
| ID | Issue |
|
||
|----|-------|
|
||
| UH-03 | Emberwake / War Room widgets need `HelpTip` parity with Command Deck funnel. |
|
||
| UH-04 | Mission Deck minimal operator guidance. |
|
||
| UH-05 | Builder advanced forge sections missing some `HelpTip` keys (`docAnchors.test` gap list). |
|
||
|
||
## Test gaps / noise
|
||
|
||
| Item | Notes |
|
||
|------|-------|
|
||
| **P1 covered (2026-06-07)** | 14-tier spread chain, triple-onion gates, fleet recon, Fleet AI control, personas, phenotype, failure atlas, court, clearance L0–L4 — Go + Vitest (**740** frontend tests); see `tests/README.md` |
|
||
| **Fleet evolution covered (2026-06-07)** | Seeder/miner split, atlas gossip, genetic breeding, BGP spread router, genealogy telemetry (non-blocking auth), court retry L4, hashrate/subnet gates, APK scout, persona temperament, WSUS mimic — Go + Vitest **740** + Playwright phase 8; master table in `tests/README.md` |
|
||
| **P2 covered (2026-06-07)** | Mock `MiningChainRunner` lifecycle (`mining_chain_lifecycle_test.go`); spread lane templates + dispatch (`spread_lanes_test.go`, `winrm_spread_test.go`, staging/BITS mocks); Path Forge API + Forge UI incl. cancel/batch race (`pathforge_test.go`, `BuilderPage.test.tsx`); WS/beacon + file upload round-trips (`ws_beacon_integration_test.go` server+agent); flaky WS/spread-gate tests stabilized (`ed9c90a`); Playwright LOTL onion + discover→spread stub E2E (`lotl-timeline.spec.ts`, `discover-spread.spec.ts`); Vitest **740** — see `tests/README.md` § P2 |
|
||
| **P2 remaining** | Live Docker/Podman container start; real WinRM/GPO/systemd/crontab on remote hosts; live BITS/curl on target OS; live multi-hop discover→spread E2E (non-stub) |
|
||
| Agent pathtracer Go tests | Stub + Windows command routing expanded; full `wg_setup` on real hosts still manual. |
|
||
| Client WS/beacon paths | httptest round-trips covered; live TLS/mesh beacon still manual. |
|
||
| Path Tracer 2s REST poll | No WS hop progress; acceptable latency, extra load while tracing. |
|
||
| Emberwake double feed | 15s client poll + 30s server war-room broadcast; prefer WS-only. |
|
||
| `SystemStatusBar` REST poll | `listAgents` every 15s duplicates WS fleet stream. |
|
||
| Builder / dashboard failure tests | Vitest emits ECONNREFUSED stderr on happy-dom; tests pass. |
|
||
| Download mock pattern | Prefer separate `vi.fn()` per `api/download` export to avoid flakes. |
|
||
|
||
## Product decisions (document-only)
|
||
|
||
| Topic | Notes |
|
||
|-------|-------|
|
||
| Dual storage sync | Session vs localStorage; `aetherforge-auth` on logout; no full cross-tab policy. |
|
||
| MatrixRain / CursorFire | Layout mounts effects on all routes; route-gating deferred. |
|
||
| CI scope | `.github/workflows/ci-docker-mining.yml` only; no root Makefile test target. |
|
||
|
||
## Scrubbed 2026-06-07 (prod garbage removed)
|
||
|
||
| Item | Action |
|
||
|------|--------|
|
||
| `agent/config/builtin.go` XMR/RVN wallets | Cleared — dev builtin no longer ships third-party addresses |
|
||
| `server/config.go` builtin Cloudflare token | Removed — connector requires env/config/`cloudflared-token.txt` |
|
||
| `data-e2e/`, `music/`, `scratch/` in repo | Untracked + `.gitignore` (E2E wallet stays in `docker/` + `e2e-validate.ps1` only) |
|
||
| Mission Deck forge bar | Replaced client-side stage timer with server `GET /builder/progress/{token}` poll |
|
||
|
||
## Do not commit
|
||
|
||
- `data/login-credentials.json`, `data/users.json`, and other local secrets.
|