Add audit-only daemon incarnation evidence (#11606)

* feat(daemon): add audit incarnation evidence

* fix(daemon): isolate audit evidence observers

src/shared/daemon-audit-eligibility.ts

@@ -0,0 +1,81 @@
+export const DAEMON_AUDIT_STATE_VALUES = ['present', 'gone', 'unknown'] as const
+
+export const DAEMON_AUDIT_TRIGGER_VALUES = [
+  'endpoint_identity_changed',
+  'inventory_answered',
+  'inventory_failed',
+  'token_missing_after_authenticated_disconnect',
+  'transport_closed'
+] as const
+
+export const DAEMON_EVIDENCE_SOURCE_VALUES = [
+  'authenticated_inventory',
+  'boot_identity',
+  'endpoint_identity',
+  'endpoint_stat',
+  'linux_proc_stat',
+  'pid_record',
+  'process_command_line',
+  'process_signal',
+  'process_start_time',
+  'token_file',
+  'windows_cim',
+  'windows_named_pipe'
+] as const
+
+export const DAEMON_PROCESS_PRESENT_REASON_VALUES = [
+  'linux_identity_match',
+  'macos_identity_match',
+  'windows_identity_match'
+] as const
+
+export const DAEMON_PROCESS_GONE_REASON_VALUES = [
+  'linux_boot_changed',
+  'linux_start_ticks_mismatch',
+  'linux_zombie',
+  'pid_missing',
+  'windows_creation_time_mismatch',
+  'windows_process_missing'
+] as const
+
+export const DAEMON_PROCESS_UNKNOWN_REASON_VALUES = [
+  'command_line_mismatch',
+  'command_line_unavailable',
+  'exact_identity_unavailable',
+  'inspection_failed',
+  'linux_identity_incomplete',
+  'macos_start_time_mismatch',
+  'permission_denied',
+  'process_start_time_unavailable',
+  'windows_process_start_time_unavailable'
+] as const
+
+export const DAEMON_AUDIT_GONE_REASON_VALUES = [
+  ...DAEMON_PROCESS_GONE_REASON_VALUES,
+  'windows_named_pipe_missing'
+] as const
+
+export const DAEMON_AUDIT_REASON_VALUES = [
+  'authenticated_inventory',
+  'endpoint_identity_changed',
+  'inventory_failed',
+  'token_missing_after_authenticated_disconnect',
+  'transport_closed',
+  ...DAEMON_AUDIT_GONE_REASON_VALUES
+] as const
+
+export const DAEMON_AUDIT_PROCESS_REASON_VALUES = [
+  ...DAEMON_PROCESS_PRESENT_REASON_VALUES,
+  ...DAEMON_PROCESS_GONE_REASON_VALUES,
+  ...DAEMON_PROCESS_UNKNOWN_REASON_VALUES,
+  'windows_named_pipe_missing'
+] as const
+
+export type DaemonAuditState = (typeof DAEMON_AUDIT_STATE_VALUES)[number]
+export type DaemonAuditTrigger = (typeof DAEMON_AUDIT_TRIGGER_VALUES)[number]
+export type DaemonAuditFailureTrigger = Exclude<DaemonAuditTrigger, 'inventory_answered'>
+export type DaemonEvidenceSource = (typeof DAEMON_EVIDENCE_SOURCE_VALUES)[number]
+export type DaemonProcessPresentReason = (typeof DAEMON_PROCESS_PRESENT_REASON_VALUES)[number]
+export type DaemonProcessGoneReason = (typeof DAEMON_PROCESS_GONE_REASON_VALUES)[number]
+export type DaemonProcessUnknownReason = (typeof DAEMON_PROCESS_UNKNOWN_REASON_VALUES)[number]
+export type DaemonAuditGoneReason = (typeof DAEMON_AUDIT_GONE_REASON_VALUES)[number]

src/shared/telemetry-events.ts

@@ -27,6 +27,13 @@ import {
   DAEMON_REPLACE_REASONS,
   DAEMON_RETIRE_REASONS
 } from './daemon-lifecycle-telemetry'
+import {
+  DAEMON_AUDIT_PROCESS_REASON_VALUES,
+  DAEMON_AUDIT_REASON_VALUES,
+  DAEMON_AUDIT_STATE_VALUES,
+  DAEMON_AUDIT_TRIGGER_VALUES,
+  DAEMON_EVIDENCE_SOURCE_VALUES
+} from './daemon-audit-eligibility'
 import { SETUP_SCRIPT_IMPORT_PROVIDERS } from './setup-script-import-providers'
 import { WORKSPACE_SOURCE_VALUES, type WorkspaceSource } from './workspace-source'
 import { appStarSourceSchema } from './gh-star-source'
@@ -418,6 +425,29 @@ const daemonLifecycleSchema = z.discriminatedUnion('transition', [
     .strict()
 ])
 
+const daemonAuditEligibilitySchema = z
+  .object({
+    state: z.enum(DAEMON_AUDIT_STATE_VALUES),
+    reason: z.enum(DAEMON_AUDIT_REASON_VALUES),
+    trigger: z.enum(DAEMON_AUDIT_TRIGGER_VALUES),
+    evidence_sources: z.array(z.enum(DAEMON_EVIDENCE_SOURCE_VALUES)).min(1).max(12),
+    protocol_generation: z.number().int().positive().max(1_000),
+    provider: z.literal('local-daemon'),
+    endpoint_kind: z.enum(['unix-socket', 'windows-named-pipe']),
+    profile_scope: z.enum(['configured', 'unspecified']),
+    exact_incarnation: z.enum([
+      'endpoint-identity',
+      'endpoint-identity-linux-ticks',
+      'unavailable'
+    ]),
+    reachability: z.enum(['authenticated', 'disconnected', 'unknown']),
+    inventory_authority: z.enum(['authoritative', 'unavailable']),
+    process_liveness: z.enum(['present', 'gone', 'unknown']),
+    process_reason: z.enum(DAEMON_AUDIT_PROCESS_REASON_VALUES).nullable(),
+    endpoint_state: z.enum(['missing', 'named-pipe', 'non-socket', 'socket', 'unknown'])
+  })
+  .strict()
+
 // Rollout signal for granting Codex hook trust via codex app-server RPCs
 // instead of Orca's self-computed trusted_hash. `fallback`/`verify_failed`
 // spikes mean the RPC lane is not taking; steady-state ledger skips are not
@@ -1412,6 +1442,7 @@ export const eventSchemas = {
   daemon_start_failed: daemonStartFailedSchema,
   main_thread_hang_detected: mainThreadHangDetectedSchema,
   daemon_lifecycle: daemonLifecycleSchema,
+  daemon_audit_eligibility: daemonAuditEligibilitySchema,
   runtime_rpc_start_failed: runtimeRpcStartFailedSchema,
 
   codex_trust_grant: codexTrustGrantSchema,