Fimeg/RedFlag
Watch
1
0
Fork
You've already forked RedFlag
 0
Code Releases Activity

RAF: convert [[wiki-links]] to standard markdown for GitHub rendering

Browse source
This commit is contained in:
Fimeg 2026-06-11 11:47:44 -04:00
commit 47fe315e8f
15 changed files with 126 additions and 126 deletions
Download patch file Download diff file Expand all files Collapse all files

14
RAF/components/02-agent.md
View file

@ -6,7 +6,7 @@
## Doctrine
The agent does not track lifecycle states, make policy decisions, or hold install privileges on gated ecosystems. The server owns every state transition. The agent's only autonomous decisions are: verify this signature, check this nonce, reject this replay. See [[core/02-architecture-decisions]].
The agent does not track lifecycle states, make policy decisions, or hold install privileges on gated ecosystems. The server owns every state transition. The agent's only autonomous decisions are: verify this signature, check this nonce, reject this replay. See [core/02-architecture-decisions](core/02-architecture-decisions.md).
---
@ -73,9 +73,9 @@ agent/
Discovery (scan, dry-run, hash-resolve) always runs unprivileged through `DiscoveryRunner`. Sudoers grants only discovery commands plus the single helper invocation line — zero sudo otherwise.
**Cross-references:**
- [[security/05-supply-chain-gate]] (token contract)
- [[flows/02-command-execution]] (command path)
- [[flows/07-process-scan]] (process explorer flow)
- [security/05-supply-chain-gate](security/05-supply-chain-gate.md) (token contract)
- [flows/02-command-execution](flows/02-command-execution.md) (command path)
- [flows/07-process-scan](flows/07-process-scan.md) (process explorer flow)
---
@ -87,14 +87,14 @@ Discovery (scan, dry-run, hash-resolve) always runs unprivileged through `Discov
- Signing-required is doctrine, not config. There is no skip path.
**Cross-references:**
- [[verification/02-agent-verification]] (full pipeline)
- [[verification/04-replay-protection]]
- [verification/02-agent-verification](verification/02-agent-verification.md) (full pipeline)
- [verification/04-replay-protection](verification/04-replay-protection.md)
---
## Resilience Machinery
- **Instance lock** — `Global\RedFlagAgent_v1` mutex / flock; prevents two agents racing one `config.json` and burning refresh-token rotations ([[security/03-refresh-tokens]])
- **Instance lock** — `Global\RedFlagAgent_v1` mutex / flock; prevents two agents racing one `config.json` and burning refresh-token rotations ([security/03-refresh-tokens](security/03-refresh-tokens.md))
- **Circuit breakers** — fragile scanners (notably WUA) trip open instead of hammering; health reported to server
- **TeeLogger** — every loop event goes to both structured local log and server-bound buffer; tracker save failures tee inward (ETHOS #1)
- **At-least-once acks** — `acknowledgment/tracker.go` persists until the server confirms result-recorded