Description
Remediate byte-retention, SQLite isolation, ingress WAL ownership, and configured-file size findings while preserving existing durable formats and operator workflows.
Acceptance Criteria
- #1 Attacker-controlled retained fields have explicit byte bounds across dedup, event, enrich, and flow stores
- #2 Distinct tailnet names cannot resolve to the same SQLite database filename
- #3 Ingress WAL rejects foreign-owned pre-existing state directories
- #4 Configured state and credential file reads enforce byte ceilings and regular-file expectations where applicable
Definition of Done
- #1 go build ./… && go vet ./… && go test -race ./…
- #2 golangci-lint run
- #3 scripts/regen-generated.sh (only if a generated artifact’s inputs changed)
Implementation Plan
Implement byte-budget normalization at every retention seam, collision-resistant SQLite identity with fail-closed legacy handling, UID ownership checks, and bounded held-descriptor file reads; verify with focused race tests.
Resume only to clear the shared full-suite workflow-contract gate; no retained-state implementation changes.
Implementation Notes
Retained-state and persistence tests, including Windows cross-compilation, pass. Final go test -race ./… is blocked only by unchanged internal/ci workflow-contract assertions outside this lane.
Shared workflow-contract blocker cleared: full build, vet, race suite, lint, and actionlint passed on 2026-08-25.
Final Summary
Added fixed-byte retention budgets, collision-resistant and identity-bound SQLite storage with fail-closed legacy handling, WAL UID checks, and bounded held-descriptor file reads.
The complete repository gate now passes.