0445b7ed4f
Some checks failed
CI Docker Mining Proof / Linux agent hashrate proof (push) Has been cancelled
Server Reed-Solomon 4+2 shard encode on deploy plans when erasure_lanes_enabled; agents reassemble from parallel lane URLs as staging fallback with BGP/Path Tracer hints.
138 lines
12 KiB
Markdown
138 lines
12 KiB
Markdown
# PROBLEMS.md
|
||
|
||
Open issues only. Fixed items removed. Last sweep: 2026-06-07.
|
||
|
||
## By design / safety
|
||
|
||
| Issue | Notes |
|
||
|-------|-------|
|
||
| **`bof_execute` disabled** | Agent returns explicit error; in-memory BOF execution disabled (`client.go`). |
|
||
| **Process hollowing AMSI/ETW** | Relocation done; Defender/ETW ~50% failure; bypass not implemented (`hollow_windows.go`). |
|
||
| **Cloudflared in-process (non-Windows server)** | Stub on Linux/macOS; use external connector (`AF_TUNNEL_EXTERNAL`) or add launcher. |
|
||
| **macOS camera / GPU miner** | Stubs or partial; Linux has V4L2 + nvidia-smi path. |
|
||
| **KEV heuristics** | Non-Windows agents return `Status: n/a` (Windows-only CVE matching). |
|
||
| **Mesh P2P without `-tags p2p`** | Default build reports 0 peers (`mesh_p2p_stub.go`). |
|
||
| **Linux/macOS GPU RVN mining** | `detectGPU()` may find NVIDIA but miners download Windows `.exe` only. |
|
||
|
||
## Scale limits (hundreds of subnets / 500+ agents)
|
||
|
||
| Area | Notes |
|
||
|------|-------|
|
||
| **Subnet grouping** | Derived from `agents.ip` /24 prefix at query time; no `agents.subnet` column — hundreds of subnets OK via `LIKE` filter + dropdown (not chips). |
|
||
| **Per-agent subnet scan** | Capped at 128 hosts (`MaxSubnetScanHosts`); syscheck uses 20; spread sem=16 per agent. Fleet discovery is incremental (ARP + capped sweep), not full /16. |
|
||
| **`stats_batch` WS** | Server coalesces stats every 250ms into one frame; client applies in single `setAgents` pass with `agentStatsUnchanged` skip. |
|
||
| **Hashrate samples** | One `INSERT` per agent stats tick — dominant DB write at scale; retention/prune policy not automated. |
|
||
| **Stale-agent sweep** | Every 45s calls `ListAgents()` full table scan; acceptable to ~1000 rows, costly beyond without indexed partial query. |
|
||
|
||
## Antivirus / Windows Defender
|
||
|
||
| Topic | Notes |
|
||
|-------|-------|
|
||
| **Why "AV off" fails** | UI toggle often disables **Real-time protection** only. **Tamper Protection**, **cloud-delivered protection**, **Controlled folder access**, **SmartScreen**, and **behavioral** blocks still run. `defender_off` remote action and `SilentAVExclusion` fail without elevation; Tamper Protection reverts `Set-MpPreference`. |
|
||
| **High-friction paths** | GPU subprocess (T-Rex/TRM `.exe` download), garble/obfuscated agent binary, spread/hollow/persistence, `SilentAVExclusion` hidden PowerShell. In-process RandomX (pure Go) has **no external CPU miner exe**. |
|
||
| **Default execution (2026-06-06)** | Forge default is `miner_execution=auto` (full cascade). **AV-Safe** preset still bakes `inprocess` only, GPU off, no hollow/spread. |
|
||
| **Operator tooling** | Calibrate → **Windows Defender Exclusions** generates elevated `.ps1` (manual run). Crucible → **Mining Diagnostics** command returns JSON blockers. |
|
||
| **No silver bullet** | No architecture is 100% invisible. Best combo: in-process CPU + path/process exclusions + dedicated mining hardware for GPU. |
|
||
|
||
## Container Mining
|
||
|
||
| Topic | Notes |
|
||
|-------|-------|
|
||
| **Fallback chain** | `agent/miner/fallback_chain.go` orchestrates container → in-process → GPU (parallel) → Stratum overlay. Failures in `failed_methods[]` on stats WS. 30s cooldown between full re-passes. |
|
||
| **Default execution** | Forge default is `auto` (full chain). `inprocess`/`container`/`subprocess` limit which steps run. |
|
||
| **AV limits (honest)** | Containers are **not** invisible — AV still sees `docker.exe`, image pulls, and container filesystem scans. Legitimate benefit is **isolated workload** and fewer host subprocess spawns (GPU T-Rex/TRM). In-process RandomX has no external CPU miner exe. |
|
||
| **GPU in container** | Linux `--gpus all` stub only; Windows Docker Desktop GPU passthrough is operator-dependent. Host subprocess GPU path remains fallback. |
|
||
| **Worker image** | `aetherforge/agent-worker:latest` (override `AETHERFORGE_MINER_IMAGE`). Build from `docker/Dockerfile.agent`; not auto-pulled in MVP. |
|
||
| **Deferred** | Container hashrate on dashboard (host reports 0 CPU H/s while container mines); auto-build/push worker image in forge; Podman rootless on Windows. |
|
||
|
||
## Architecture deferred (large)
|
||
|
||
| Area | Notes |
|
||
|------|-------|
|
||
| **`tunnel_stream`** | Server-side TCP reverse relay documented as future (`README.md`). |
|
||
| **Path Tracer sessions** | `TraceSession` in handler RAM; restart loses state; no DB persistence or startup sweep. |
|
||
| **Non-Windows Path Tracer parity** | `pathtracer_stub.go` errors on `wg_setup`; chains are Windows-agent focused. |
|
||
| **NAT / symmetric UDP** | UPnP + DB IP fallback; no STUN/TURN or post-config connectivity probe. |
|
||
| **Fixed WireGuard port 51820** | Same UDP port all hops; multi-agent behind one NAT may conflict. |
|
||
| **Agent display name vs hostname** | WS `UpsertAgent` preserves operator rename when `name != hostname`; reconnect with hostname only keeps DB label. |
|
||
| **WireGuard auto-download (Windows)** | `ensureWGExe()` on first Path Tracer use; heavy, may need admin; pre-install recommended. |
|
||
| **Monolithic WebSocket context** | All `useWebSocket()` consumers re-render on any WS change; split contexts/selectors deferred. |
|
||
| **`CruciblePage` size (~2k lines)** | Terminal + fleet + tabs in one component; section split/memo deferred. |
|
||
| **WS `init` ships full fleet** | Dashboard connect still loads all agents in one JSON blob; pagination is REST-only (`?limit=&offset=`). |
|
||
| **SQLite single-writer ceiling** | `SetMaxOpenConns(1)` + WAL; sustained 1000+ agents with per-tick DB writes may SQLITE_BUSY; consider Postgres or write batching at 1000+. |
|
||
| **In-memory WS agent state** | Hub maps (`agentCapabilities`, `agentLogs`, DNS cache) grow O(agents); no eviction on disconnect beyond log trim. |
|
||
| **Fleet topology 3D cap** | `FleetTopologyMap` renders at most 200 nodes; larger fleets need subnet-grouped view or server-side aggregation. |
|
||
| **Crucible roster pagination** | Roster paginates 80 cards/page; bulk select-all still operates on filtered set in memory. |
|
||
| **No CI HTTP forge** | `e2e-validate.ps1 -ForgeAgent` manual; live compile needs `LIVE_FORGE=1` + `-tags liveforge`. |
|
||
| **Non-Windows forge host** | PE disguise / osslsigncode signing platform-limited by design. |
|
||
| **Mac PathForge runtime** | `.command` curl `/api/download/agent-mac`; needs reachable `server_url` + binary on server. |
|
||
| **Terminal virtualization** | 400-line DOM cap only; full virtual scrollback deferred. |
|
||
| **Vite chunk weight** | `three` + vendor warnings; FleetTopologyMap lazy but heavy first open. |
|
||
|
||
## Open bugs / behavior
|
||
|
||
| Issue | Notes |
|
||
|-------|-------|
|
||
| **Unknown Unix CPU stats stub** | `cpu_stub.go` may return 0 and break idle-mining guard on exotic platforms. |
|
||
| **Linux headless screenshot** | Needs `xvfb` + scrot or custom `command` in containers. |
|
||
|
||
## UX / visual (unfixed DV)
|
||
|
||
| ID | Issue |
|
||
|----|-------|
|
||
| DV-01 | Neon cyan fragmentation (`#00f5ff`, `#0ff` vs token `#00e8f5`) across several components. |
|
||
| DV-02 | Page header patterns diverge (Build Manager, Path Tracer green title, Forge naming). |
|
||
| DV-03 | `SacredPageHeader` unused (dead CSS path). |
|
||
| DV-04 | `Pages.css` duplicate `.empty-state` / `.page-header h1` override order. |
|
||
| DV-07 | Path Tracer visual island (`#00ffaa`) vs operator-deck chrome. |
|
||
| DV-09 | Dead chart badge styles in wealth-deck CSS. |
|
||
| DV-13 | Dark-only; no light / `prefers-color-scheme` path. |
|
||
| DV-14 | Sidebar footer hard-coded `v0.0.1`. |
|
||
|
||
## Help / product copy gaps
|
||
|
||
| ID | Issue |
|
||
|----|-------|
|
||
| UH-03 | Emberwake / War Room widgets need `HelpTip` parity with Command Deck funnel. |
|
||
| UH-04 | Mission Deck minimal operator guidance. |
|
||
| UH-05 | Builder advanced forge sections missing some `HelpTip` keys (`docAnchors.test` gap list). |
|
||
|
||
## Test gaps / noise
|
||
|
||
| Item | Notes |
|
||
|------|-------|
|
||
| **P1 covered (2026-06-07)** | 14-tier spread chain, triple-onion gates, fleet recon, Fleet AI control, personas, phenotype, failure atlas, court, clearance L0–L4 — Go + Vitest (**740** frontend tests); see `tests/README.md` |
|
||
| **Fleet evolution covered (2026-06-07)** | Seeder/miner split, atlas gossip, genetic breeding, BGP spread router, genealogy telemetry (non-blocking auth), court retry L4, hashrate/subnet gates, APK scout, persona temperament, WSUS mimic — Go + Vitest **740** + Playwright phase 8; master table in `tests/README.md` |
|
||
| **P2 covered (2026-06-07)** | Mock `MiningChainRunner` lifecycle (`mining_chain_lifecycle_test.go`); spread lane templates + dispatch (`spread_lanes_test.go`, `winrm_spread_test.go`, staging/BITS mocks); Path Forge API + Forge UI incl. cancel/batch race (`pathforge_test.go`, `BuilderPage.test.tsx`); WS/beacon + file upload round-trips (`ws_beacon_integration_test.go` server+agent); flaky WS/spread-gate tests stabilized (`ed9c90a`); Playwright LOTL onion + discover→spread stub E2E (`lotl-timeline.spec.ts`, `discover-spread.spec.ts`); Vitest **740** — see `tests/README.md` § P2 |
|
||
| **Erasure-coded multi-lane propagation (foundation 2026-06-07)** | **Partial / honest foundation** — server `internal/erasure/` Reed–Solomon 4+2 encode + in-memory shard store + `/api/v1/public/erasure-shard/{token}/{index}`; signed deploy plans attach `erasure_plan` when Calibrate `server.erasure_lanes_enabled`; agent `deploy/erasure_staging.go` reassembles from parallel lane URLs as fallback when primary staging fails; BGP `spread_route_hint` + Path Tracer show `erasure_lanes_enabled`. **Not shipped:** live parallel lane orchestration, seeder-side shard fan-out, or erasure-first (non-fallback) spread E2E. |
|
||
| **P2 remaining (manual only)** | Live Docker/Podman container start on operator host; real WinRM/GPO/systemd/crontab execution on remote owned hosts; live BITS/curl against non-mock C2 endpoints; live multi-hop discover→spread without Playwright stub |
|
||
| **P2 automatable (2026-06-07)** | Mock container/podman exec (`container_launcher_test.go`, `runtime_detect_test.go`); BITS/curl `HiddenRun` mocks (`bits_windows_test.go`, `staging_chain_test.go`); WinRM/GPO/systemd httptest + mock execute (`deploy_plan_integration_test.go`, `discover_join_test.go`); multi-hop discover→spread Playwright stub chain (`discover-spread-stub.ts`, `discover-spread.spec.ts`) |
|
||
| Agent pathtracer Go tests | Stub + Windows command routing expanded; full `wg_setup` on real hosts still manual. |
|
||
| Client WS/beacon paths | httptest round-trips covered; live TLS/mesh beacon still manual. |
|
||
| Path Tracer 2s REST poll | No WS hop progress; acceptable latency, extra load while tracing. |
|
||
| Emberwake double feed | 15s client poll + 30s server war-room broadcast; prefer WS-only. |
|
||
| `SystemStatusBar` REST poll | `listAgents` every 15s duplicates WS fleet stream. |
|
||
| Builder / dashboard failure tests | Vitest emits ECONNREFUSED stderr on happy-dom; tests pass. |
|
||
| Download mock pattern | Prefer separate `vi.fn()` per `api/download` export to avoid flakes. |
|
||
|
||
## Product decisions (document-only)
|
||
|
||
| Topic | Notes |
|
||
|-------|-------|
|
||
| Dual storage sync | Session vs localStorage; `aetherforge-auth` on logout; no full cross-tab policy. |
|
||
| MatrixRain / CursorFire | Layout mounts effects on all routes; route-gating deferred. |
|
||
| CI scope | `.github/workflows/ci-docker-mining.yml` only; no root Makefile test target. |
|
||
|
||
## Scrubbed 2026-06-07 (prod garbage removed)
|
||
|
||
| Item | Action |
|
||
|------|--------|
|
||
| `agent/config/builtin.go` XMR/RVN wallets | Cleared — dev builtin no longer ships third-party addresses |
|
||
| `server/config.go` builtin Cloudflare token | Removed — connector requires env/config/`cloudflared-token.txt` |
|
||
| `data-e2e/`, `music/`, `scratch/` in repo | Untracked + `.gitignore` (E2E wallet stays in `docker/` + `e2e-validate.ps1` only) |
|
||
| Mission Deck forge bar | Replaced client-side stage timer with server `GET /builder/progress/{token}` poll |
|
||
|
||
## Do not commit
|
||
|
||
- `data/login-credentials.json`, `data/users.json`, and other local secrets.
|