AetherForge/PROBLEMS.md

PROBLEMS.md

Open issues only. Fixed items removed. Last sweep: 2026-06-07.

No open code issues

Automatable gaps are closed; remaining items below are by-design limits, architecture deferrals, or manual/live operator work. Regression tables and counts: Go server 1007, agent 680, Vitest 867, Playwright 32 — see tests/README.md.

By design / safety

Issue	Notes
bof_execute disabled	Agent returns explicit error; in-memory BOF execution disabled (client.go).
Process hollowing AMSI/ETW	Relocation done; Defender/ETW ~50% failure; bypass not implemented (hollow_windows.go).
Cloudflared in-process (non-Windows server)	Stub on Linux/macOS; use external connector (AF_TUNNEL_EXTERNAL) or add launcher.
macOS camera / GPU miner	Stubs or partial; Linux has V4L2 + nvidia-smi path.
KEV heuristics	Non-Windows agents return Status: n/a (Windows-only CVE matching).
Mesh P2P without -tags p2p	Default build reports 0 peers (mesh_p2p_stub.go).
Linux/macOS GPU RVN mining	detectGPU() may find NVIDIA but miners download Windows .exe only.

Scale limits (hundreds of subnets / 500+ agents)

Area	Notes
Subnet grouping	Derived from agents.ip /24 prefix at query time; no agents.subnet column - hundreds of subnets OK via LIKE filter + dropdown (not chips).
Per-agent subnet scan	Capped at 128 hosts (MaxSubnetScanHosts); syscheck uses 20 (SyscheckSubnetScanCap); spread sem=16 (SpreadConcurrencyCap). Fleet discovery is incremental (ARP + capped sweep), not full /16.
Subnet discovery server store	subnet_discoveries SQLite table; agent WS subnet_recon_report ingest; dashboard GET /api/v1/recon/discovered-hosts + subnet_discovery_update broadcast. Agent auth marks matching IP agent_online. Covered by -SubnetRecon api/db gates.
stats_batch WS	Server coalesces stats every 250ms (StatsBatchCoalesceInterval) into one frame; client applies in single setAgents pass with agentStatsUnchanged skip.
Hashrate samples	One INSERT per agent stats tick - dominant DB write at scale. Automated purge via StartRetentionJobs (default 168h, stats_retention_hours).
Stale-agent sweep	Every 45s (StaleAgentSweepInterval) queries status='online' AND last_seen < cutoff (ListStaleOnlineAgents, composite index) - not a full-table scan. Still O(stale-online) broadcasts per sweep.

Container Mining

Topic	Notes
Fallback chain	agent/miner/fallback_chain.go orchestrates container → in-process → GPU (parallel) → Stratum overlay. Failures in failed_methods[] on stats WS (tested). 30s cooldown between full re-passes (DefaultChainCooldown, RestartChain clears).
Default execution	Forge default is auto (full chain). inprocess/container/subprocess limit which steps run. Forge shows worker-image build hint when auto/container selected.
AV limits (honest)	Containers are not invisible - AV still sees docker.exe, image pulls, and container filesystem scans. Legitimate benefit is isolated workload and fewer host subprocess spawns (GPU T-Rex/TRM). In-process RandomX has no external CPU miner exe.
GPU in container	Linux --gpus all stub only; Windows Docker Desktop GPU passthrough is operator-dependent. Host subprocess GPU path remains fallback.
Worker image	aetherforge/agent-worker:latest (override AETHERFORGE_MINER_IMAGE). Build from docker/Dockerfile.agent; Forge live notice + FieldHint on Miner Execution.
Container hashrate	Host relays container worker H/s via MINER_STATS_FILE + ProbeHashrate() when hostMiningDisabled (dashboard no longer stuck at 0).
Deferred	Auto-build/push worker image in forge; Podman rootless on Windows.

Architecture deferred (large)

Area	Notes
tunnel_stream	Server-side TCP reverse relay documented as future (README.md).
Path Tracer sessions	TraceSession in handler RAM; restart loses state; no DB persistence or startup sweep.
Non-Windows Path Tracer parity	pathtracer_stub.go errors on wg_setup; chains are Windows-agent focused.
NAT / symmetric UDP	UPnP + DB IP fallback; no STUN/TURN or post-config connectivity probe.
Fixed WireGuard port 51820	Same UDP port all hops; multi-agent behind one NAT may conflict.
Agent display name vs hostname	WS UpsertAgent preserves operator rename when name != hostname; reconnect with hostname only keeps DB label.
WireGuard auto-download (Windows)	ensureWGExe() on first Path Tracer use; heavy, may need admin; pre-install recommended.
Monolithic WebSocket context	All useWebSocket() consumers re-render on any WS change; split contexts/selectors deferred.
CruciblePage size (~2k lines)	Terminal + fleet + tabs in one component; section split/memo deferred.
WS init ships full fleet	Dashboard connect still loads all agents in one JSON blob; pagination is REST-only (?limit=&offset=).
SQLite single-writer ceiling	SetMaxOpenConns(1) + WAL; sustained 1000+ agents with per-tick DB writes may SQLITE_BUSY; consider Postgres or write batching at 1000+.
In-memory WS agent state	Hub maps (agentCapabilities, agentLogs, DNS cache) grow O(agents); no eviction on disconnect beyond log trim.
Fleet topology 3D cap	FleetTopologyMap renders at most 200 nodes; larger fleets need subnet-grouped view or server-side aggregation.
Crucible roster pagination	Roster paginates 80 cards/page; bulk select-all still operates on filtered set in memory.
No CI HTTP forge	e2e-validate.ps1 -ForgeAgent manual; live compile needs LIVE_FORGE=1 + -tags liveforge.
Non-Windows forge host	PE disguise / osslsigncode signing platform-limited by design.
Mac PathForge runtime	.command curl /api/download/agent-mac; needs reachable server_url + binary on server.
Terminal virtualization	400-line DOM cap only; full virtual scrollback deferred.
Vite chunk weight	three + vendor warnings; FleetTopologyMap lazy but heavy first open.

AWS cloud features (honest operator scope)

Area	Notes
S3 + CloudFront erasure swarm	Deploy plans can upload RS 4+2 shards when AF_AWS_* / AF_CLOUDFRONT_* env creds and Calibrate bucket/domain are set. Test connection and IAM/bucket policy JSON are local-only (no AWS API from the server except optional S3 HeadBucket when creds present).
SSM ssm_document spread lane	Emberwake SSM panel exports document + run-command CLI for owned EC2; agents execute curl against your deck. Requires operator AWS CLI + IAM on instances (managed instance profile).
Launch Template strain genesis	Crucible/forge exports launch-template.json, user-data.sh, ASG example for horizontal EC2 genesis auth (join_lane=launch_template). Operator applies in their AWS account.
Cloud spread kits	Emberwake Cloud Spread panel ZIPs templates (S3/CloudFront, MinIO, Cloud Map snippets). Connection test is HTTP reachability only.
Policy snapshot / EventBridge fan-out	Public policy-snapshot/{token} + fan-out ZIP for degraded agents; relay URL is operator-deployed Lambda/EventBridge—server does not call AWS APIs.
Fargate burst campaign	Optional burst seeder task definition export; not auto-provisioned—operator ECS/Fargate + creds required.
Live AWS validation	Full gate needs operator IAM (s3:PutObject, CloudFront signing keys, SSM SendCommand on fleet). CI/automation covers mocks; no shared AWS account in repo.

Manual / live / honest partial

Item	Notes
Live S3 PutObject + CloudFront signed magnets	CI mocks AttachS3Swarm inject store; operator AF_AWS_* / AF_CLOUDFRONT_* + bucket policy required for real shard upload.
SSM SendCommand on owned EC2	Emberwake exports document + run-command CLI only; server never calls AWS SSM APIs.
Fargate ECS RunTask burst	Task-definition ZIP + campaign sync tested; operator applies ECS/Fargate in their VPC.
EventBridge policy fan-out Lambda	Fan-out ZIP + public snapshot URL tested; relay Lambda/EventBridge is operator-deployed.
Cloud Map route_via on deploy plans	Agent registry fetch tested; server AttachCloudMapRouteVia wiring deferred (skipped Go tests).
Cloud venue on live EC2	IMDS tag inference tested with inject; real g4dn/spot/batch labels need AWS instances.
Onion contingency LLM invoke	Deterministic persona branch compose in CI; live court LLM on every exhaust tick not automated.
P2 spread lanes (manual only)	Live Docker/Podman start; real WinRM/GPO/systemd/crontab on remote hosts; live BITS/curl; live multi-hop discover→spread without Playwright stub.
Deploy Recon port scan / crawl	TCP port dial and same-origin HTTP crawl execute on the dashboard host (Go server), not from fleet agents. Firewall path must allow the server to reach the owned target.
Deploy Recon SSRF	UI copies SSRF probe URLs; no automated form submit — operator pastes probe URL into owned target fields manually to validate server-side fetch to install.sh.

Do not commit

• data/login-credentials.json, data/users.json, and other local secrets.