feat(sentinel): persist alerts as CloudEvent JSONL #6

Merged
dmg merged 1 commits from ticket-349-persist-detection-alerts-as-daily-cloudevent-jsonl into main 2026-10-29 21:57:15 +00:00
Owner

Outcome

Persists every generated Sentinel alert as one CloudEvents 1.0 JSON object in a UTC daily JSONL file, including when no eligible administrator is online.

Behavior

  • writes plugins/PurpurSentinel/events/YYYY-MM-DD.jsonl on one bounded asynchronous writer
  • emits unique structured CloudEvents with RFC 3339 UTC time, stable source/type, subject UUID, and signal-specific bounded evidence
  • omits display names, coordinates, trajectories, inventory contents, IP addresses, and permission state
  • appends across restart, removes an incomplete crash tail, rolls over at UTC midnight, and retains 30 UTC days
  • fails open on queue, directory, write, rollover, retention, and close failures with rate-limited non-sensitive warnings
  • stops acceptance and drains accepted records during bounded orderly shutdown without modifying detection or gameplay

Verification

  • meaningful RED SHA-256 d47457dd71b18d47c7140b91ff63e9835aa89b58c77ac40409b0fd518088c884
  • final post-race-fix clean suite: 117 JVM, 3 native Purpur 26.3, 73 release-tool tests; zero failures/errors/skips
  • production manifest SHA-256 e91a5fe6196190269cbe427251822fa460fc6bf1cbb03488bfb4c8b6c94ae72e
  • test manifest SHA-256 4e3c6f1e152efd7e3c3935845a2c6d1cb9985fb5194185616b3f1afd2f06c788
  • Semgrep: 65 rules over 35 production Java files, zero findings/errors; JSON SHA-256 1482116718e921e0233bb621ebbe71b6391445975b0e5d6db01f2c4fde3fcf55
  • no dependency, workflow, GitOps, installation, or deployment changes

Kaneo: SM-349

## Outcome Persists every generated Sentinel alert as one CloudEvents 1.0 JSON object in a UTC daily JSONL file, including when no eligible administrator is online. ## Behavior - writes `plugins/PurpurSentinel/events/YYYY-MM-DD.jsonl` on one bounded asynchronous writer - emits unique structured CloudEvents with RFC 3339 UTC time, stable source/type, subject UUID, and signal-specific bounded evidence - omits display names, coordinates, trajectories, inventory contents, IP addresses, and permission state - appends across restart, removes an incomplete crash tail, rolls over at UTC midnight, and retains 30 UTC days - fails open on queue, directory, write, rollover, retention, and close failures with rate-limited non-sensitive warnings - stops acceptance and drains accepted records during bounded orderly shutdown without modifying detection or gameplay ## Verification - meaningful RED SHA-256 `d47457dd71b18d47c7140b91ff63e9835aa89b58c77ac40409b0fd518088c884` - final post-race-fix clean suite: 117 JVM, 3 native Purpur 26.3, 73 release-tool tests; zero failures/errors/skips - production manifest SHA-256 `e91a5fe6196190269cbe427251822fa460fc6bf1cbb03488bfb4c8b6c94ae72e` - test manifest SHA-256 `4e3c6f1e152efd7e3c3935845a2c6d1cb9985fb5194185616b3f1afd2f06c788` - Semgrep: 65 rules over 35 production Java files, zero findings/errors; JSON SHA-256 `1482116718e921e0233bb621ebbe71b6391445975b0e5d6db01f2c4fde3fcf55` - no dependency, workflow, GitOps, installation, or deployment changes Kaneo: SM-349
dmg added 1 commit 2026-10-29 21:55:31 +00:00
feat(sentinel): persist alerts as CloudEvent JSONL
CI / build (push) Successful in 1m18s
CI / build (pull_request) Successful in 1m17s
4cebd19250
dmg merged commit 8731548d5a into main 2026-10-29 21:57:15 +00:00
Sign in to join this conversation.
No Reviewers
No labels
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: dmg/purpur-sentinel#6