feat: harden firewall policies telemetry and operations

Implement reliable agent apply, telemetry v2, analytics retention, guarded rollouts, enrollment, labels and webhooks. Improve ReUI frontend data safety and bounded list loading, and add Docker smoke, recovery and resource checks. Document local verification and pending native acceptance.

packages/db/migrations/012_telemetry_v2.sql

@@ -0,0 +1,41 @@
+-- Baselines and replay watermark outlive raw sample retention and UI resets.
+CREATE TABLE agent_telemetry_state (
+  agent_id TEXT PRIMARY KEY REFERENCES agents(id) ON DELETE CASCADE,
+  sequence INTEGER NOT NULL,
+  report_id TEXT NOT NULL,
+  boot_id TEXT NOT NULL,
+  traffic_epoch TEXT NOT NULL,
+  observed_at TEXT NOT NULL,
+  received_at TEXT NOT NULL,
+  dropped_baseline INTEGER,
+  accepted_baseline INTEGER
+);
+
+ALTER TABLE agents ADD COLUMN telemetry_version INTEGER;
+ALTER TABLE agents ADD COLUMN last_telemetry_at TEXT;
+ALTER TABLE agents ADD COLUMN applied_hash TEXT;
+ALTER TABLE agents ADD COLUMN applied_revision INTEGER;
+ALTER TABLE agents ADD COLUMN desired_hash TEXT;
+ALTER TABLE agents ADD COLUMN desired_hash_generation INTEGER;
+ALTER TABLE agents ADD COLUMN last_policy_delivered_at TEXT;
+ALTER TABLE agents ADD COLUMN capabilities_json TEXT NOT NULL DEFAULT '[]';
+ALTER TABLE agents ADD COLUMN quality_json TEXT NOT NULL DEFAULT '{"partial":true,"truncated":false,"unsupported":["telemetry_v2"],"lost_reports":0}';
+ALTER TABLE agents ADD COLUMN apply_error_json TEXT;
+ALTER TABLE agents ADD COLUMN detail_counts_json TEXT;
+
+ALTER TABLE agent_stats_samples ADD COLUMN telemetry_version INTEGER NOT NULL DEFAULT 1;
+ALTER TABLE agent_stats_samples ADD COLUMN report_id TEXT;
+ALTER TABLE agent_stats_samples ADD COLUMN sequence INTEGER;
+ALTER TABLE agent_stats_samples ADD COLUMN observed_at TEXT;
+ALTER TABLE agent_stats_samples ADD COLUMN interval_ms INTEGER;
+ALTER TABLE agent_stats_samples ADD COLUMN delta_dropped INTEGER;
+ALTER TABLE agent_stats_samples ADD COLUMN delta_accepted INTEGER;
+ALTER TABLE agent_stats_samples ADD COLUMN quality_json TEXT;
+ALTER TABLE agent_stats_samples ADD COLUMN detail_counts_json TEXT;
+CREATE UNIQUE INDEX idx_stats_agent_report ON agent_stats_samples(agent_id, report_id);
+
+ALTER TABLE agent_ip_block_stats ADD COLUMN counter_epoch TEXT;
+ALTER TABLE agent_port_block_stats ADD COLUMN counter_epoch TEXT;
+
+CREATE INDEX idx_ip_stats_last_seen ON agent_ip_block_stats(last_seen_at);
+CREATE INDEX idx_port_stats_last_seen ON agent_port_block_stats(last_seen_at);

packages/db/migrations/013_stats_analytics.sql

@@ -0,0 +1,27 @@
+ALTER TABLE agent_telemetry_state ADD COLUMN dropped_baseline_at TEXT;
+ALTER TABLE agent_telemetry_state ADD COLUMN accepted_baseline_at TEXT;
+ALTER TABLE agent_stats_samples ADD COLUMN dropped_interval_start TEXT;
+ALTER TABLE agent_stats_samples ADD COLUMN accepted_interval_start TEXT;
+ALTER TABLE agent_stats_samples ADD COLUMN dropped_present INTEGER;
+ALTER TABLE agent_stats_samples ADD COLUMN accepted_present INTEGER;
+ALTER TABLE agent_stats_samples ADD COLUMN analytics_processed INTEGER NOT NULL DEFAULT 0;
+CREATE INDEX idx_stats_agent_cursor ON agent_stats_samples(agent_id, recorded_at, id);
+CREATE INDEX idx_stats_recorded_at ON agent_stats_samples(recorded_at);
+CREATE INDEX idx_stats_analytics_pending ON agent_stats_samples(analytics_processed, recorded_at, id);
+
+CREATE TABLE agent_stats_rollups (
+  agent_id TEXT NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
+  resolution TEXT NOT NULL CHECK(resolution IN ('1m','1h','1d')),
+  bucket_start TEXT NOT NULL,
+  packets_dropped REAL NOT NULL DEFAULT 0,
+  packets_accepted REAL NOT NULL DEFAULT 0,
+  dropped_coverage_ms INTEGER NOT NULL DEFAULT 0,
+  accepted_coverage_ms INTEGER NOT NULL DEFAULT 0,
+  partial INTEGER NOT NULL DEFAULT 0,
+  truncated INTEGER NOT NULL DEFAULT 0,
+  estimated INTEGER NOT NULL DEFAULT 0,
+  unsupported_json TEXT NOT NULL DEFAULT '[]',
+  lost_reports INTEGER NOT NULL DEFAULT 0,
+  PRIMARY KEY(agent_id, resolution, bucket_start)
+);
+CREATE INDEX idx_stats_rollups_resolution_time ON agent_stats_rollups(resolution, bucket_start);

packages/db/migrations/014_audit_outbox.sql

@@ -0,0 +1,9 @@
+CREATE TABLE audit_outbox (
+  event_id TEXT PRIMARY KEY NOT NULL,
+  payload_json TEXT NOT NULL CHECK(length(payload_json) <= 16384),
+  attempts INTEGER NOT NULL DEFAULT 0 CHECK(attempts >= 0),
+  next_attempt_ms INTEGER NOT NULL DEFAULT 0,
+  created_at TEXT NOT NULL,
+  last_error TEXT
+);
+CREATE INDEX idx_audit_outbox_due ON audit_outbox(next_attempt_ms, created_at);

packages/db/migrations/015_override_expiry.sql

@@ -0,0 +1,5 @@
+ALTER TABLE ip_overrides ADD COLUMN reason TEXT;
+ALTER TABLE ip_overrides ADD COLUMN created_by_name TEXT;
+ALTER TABLE ip_overrides ADD COLUMN expires_at TEXT;
+ALTER TABLE ip_overrides ADD COLUMN expired_at TEXT;
+CREATE INDEX idx_overrides_agent_expiry ON ip_overrides(agent_id, expired_at, expires_at);

packages/db/migrations/016_webhooks.sql

@@ -0,0 +1,22 @@
+CREATE TABLE webhook_endpoints (
+  id TEXT PRIMARY KEY, name TEXT NOT NULL, url TEXT NOT NULL,
+  secret_cipher TEXT NOT NULL, enabled INTEGER NOT NULL DEFAULT 1,
+  generation INTEGER NOT NULL DEFAULT 1,
+  events_json TEXT NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+);
+CREATE TABLE webhook_deliveries (
+  id TEXT PRIMARY KEY, endpoint_id TEXT NOT NULL REFERENCES webhook_endpoints(id) ON DELETE CASCADE,
+  event_type TEXT NOT NULL, resource_id TEXT NOT NULL, payload_json TEXT NOT NULL,
+  endpoint_generation INTEGER NOT NULL DEFAULT 1,
+  status TEXT NOT NULL DEFAULT 'pending' CHECK(status IN ('pending','dead')),
+  attempts INTEGER NOT NULL DEFAULT 0, next_attempt_at TEXT NOT NULL,
+  created_at TEXT NOT NULL, last_error TEXT
+);
+CREATE INDEX idx_webhook_due ON webhook_deliveries(status,next_attempt_at);
+CREATE TABLE webhook_transitions (
+  endpoint_id TEXT NOT NULL REFERENCES webhook_endpoints(id) ON DELETE CASCADE,
+  event_type TEXT NOT NULL, resource_id TEXT NOT NULL, state TEXT NOT NULL,
+  last_emitted_at TEXT, PRIMARY KEY(endpoint_id,event_type,resource_id)
+);
+CREATE TABLE webhook_metrics (id INTEGER PRIMARY KEY CHECK(id=1), dropped INTEGER NOT NULL DEFAULT 0);
+INSERT INTO webhook_metrics(id) VALUES (1);

packages/db/migrations/017_policy_snapshots.sql

@@ -0,0 +1,42 @@
+CREATE TABLE policy_snapshots (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  source_agent_id TEXT,
+  source_generation INTEGER NOT NULL,
+  hash TEXT NOT NULL,
+  content_hash TEXT NOT NULL UNIQUE,
+  payload_json TEXT NOT NULL CHECK(length(CAST(payload_json AS BLOB)) <= 8388608),
+  payload_bytes INTEGER NOT NULL CHECK(payload_bytes >= 0 AND payload_bytes <= 8388608),
+  created_at TEXT NOT NULL
+);
+CREATE TABLE policy_rollouts (
+  id TEXT PRIMARY KEY,
+  snapshot_id TEXT NOT NULL REFERENCES policy_snapshots(id),
+  state TEXT NOT NULL CHECK(state IN ('canary','confirmed','rolled_back')),
+  version INTEGER NOT NULL DEFAULT 1,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+CREATE TABLE policy_rollout_targets (
+  rollout_id TEXT NOT NULL REFERENCES policy_rollouts(id) ON DELETE CASCADE,
+  agent_id TEXT NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
+  previous_snapshot_id TEXT NOT NULL REFERENCES policy_snapshots(id),
+  baseline_generation INTEGER NOT NULL,
+  previous_delivered_hash TEXT,
+  previous_delivered_revision INTEGER,
+  previous_applied_hash TEXT,
+  previous_applied_revision INTEGER,
+  is_canary INTEGER NOT NULL CHECK(is_canary IN (0,1)),
+  phase TEXT NOT NULL CHECK(phase IN ('pending','candidate','rollback','released')),
+  desired_revision INTEGER,
+  activated_at TEXT,
+  PRIMARY KEY(rollout_id,agent_id)
+);
+CREATE TABLE policy_pins (
+  agent_id TEXT PRIMARY KEY REFERENCES agents(id) ON DELETE CASCADE,
+  snapshot_id TEXT NOT NULL REFERENCES policy_snapshots(id),
+  rollout_id TEXT NOT NULL REFERENCES policy_rollouts(id)
+);
+CREATE INDEX idx_policy_rollout_targets_agent ON policy_rollout_targets(agent_id);
+CREATE INDEX idx_policy_rollouts_created ON policy_rollouts(created_at,id);
+CREATE INDEX idx_policy_snapshots_created ON policy_snapshots(created_at,id);

packages/db/migrations/018_agent_credentials.sql

@@ -0,0 +1,19 @@
+ALTER TABLE agent_install_links ADD COLUMN expires_at TEXT;
+ALTER TABLE agent_install_links ADD COLUMN consumed_at TEXT;
+ALTER TABLE agent_install_links ADD COLUMN consumed_token_hash TEXT;
+UPDATE agent_install_links SET expires_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '+1 day') WHERE expires_at IS NULL;
+CREATE TABLE agent_token_rotations (
+  agent_id TEXT PRIMARY KEY REFERENCES agents(id) ON DELETE CASCADE,
+  request_id TEXT NOT NULL UNIQUE,
+  created_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  completed_at TEXT,
+  previous_token_hash TEXT,
+  next_token_hash TEXT
+);
+CREATE TABLE agent_credential_receipts (
+  agent_id TEXT PRIMARY KEY REFERENCES agents(id) ON DELETE CASCADE,
+  request_id TEXT NOT NULL,
+  token_hash TEXT NOT NULL,
+  completed_at TEXT NOT NULL
+);

packages/db/migrations/019_agent_labels.sql

@@ -0,0 +1,13 @@
+CREATE TABLE agent_labels_catalog (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL CHECK(length(name) BETWEEN 1 AND 64),
+  name_key TEXT NOT NULL UNIQUE,
+  color TEXT,
+  created_at TEXT NOT NULL
+);
+CREATE TABLE agent_labels (
+  agent_id TEXT NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
+  label_id TEXT NOT NULL REFERENCES agent_labels_catalog(id) ON DELETE CASCADE,
+  PRIMARY KEY(agent_id,label_id)
+);
+CREATE INDEX idx_agent_labels_label ON agent_labels(label_id,agent_id);