Require explicit telemetry source and add Conduit producer mode #5

Merged

ober merged 6 commits from fix/secmon-canonical-source-id into main

2026-09-25 04:49:20 -04:00

ober commented

2026-09-25 04:27:33 -04:00

Owner

Summary

Require an explicit valid telemetry source ID instead of synthesizing jsshd@host.
Add an opt-in Conduit secmon producer mode while preserving the legacy mux default.
Bound child execution, validate the trusted client and endpoint configuration, and accept only definitive Conduit results.

Verification

cargo test --workspace --locked
cargo clippy --workspace --all-targets --all-features -- -D warnings
make verify
Live temporary smoke: SSH authentication rejection produced auth_failed, which the Conduit endpoint stored as sequence 1.

Production source identity and endpoint grant selection remain deployment decisions; this PR does not select them.

## Summary - Require an explicit valid telemetry source ID instead of synthesizing `jsshd@host`. - Add an opt-in Conduit secmon producer mode while preserving the legacy mux default. - Bound child execution, validate the trusted client and endpoint configuration, and accept only definitive Conduit results. ## Verification - `cargo test --workspace --locked` - `cargo clippy --workspace --all-targets --all-features -- -D warnings` - `make verify` - Live temporary smoke: SSH authentication rejection produced `auth_failed`, which the Conduit endpoint stored as sequence 1. Production source identity and endpoint grant selection remain deployment decisions; this PR does not select them.

ober added 4 commits

2026-09-25 04:27:34 -04:00