P1 E14 R3: bridge bounded Elasticsearch log causes into the investigation brain

[gnanirahulnutakki]

Parent and source of truth

Parent: #46 (E14 Investigation Brain). Reviewed source-evidence contract: #214 and internal/connector/elasticsearch protocol search/ecs-v1.

Repository behavior is authoritative:

• internal/connector/elasticsearch.ProjectLogCauses already emits bounded, entity-attached TELEMETRY FactDerived values for the closed logs.cause taxonomy.
• R3 already accepts logs.cause as its TELEMETRY strengthener.
• internal/brain.FromGraphFacts currently ignores Elasticsearch derived facts, so the reviewed projector cannot reach the rule through the graph seam.

Current official Elastic documentation still confirms that selected fields values are returned as arrays, _source: false avoids returning the whole source document, ECS defines orchestrator.cluster.name, Filebeat defines the Kubernetes Pod/namespace/container fields, and allow_partial_search_results=false prevents partial shard results.

Problem

The Wave-1 Elasticsearch projector is landed and post-merge verified, but E14 cannot consume its output. Synthetic replay observations can make R3 confident; the real normalized graph contract cannot. Silently accepting arbitrary TELEMETRY facts would weaken provenance, identity, privacy, and stale-evidence boundaries.

Scope

Add the narrow graph-to-brain bridge for the existing protocol:

• Route exact elasticsearch / search/ecs-v1 LogSignal FactDerived TELEMETRY facts through explicit validation.
• Require source kind and provenance adapter elasticsearch, the exact protocol, LogSignal resource kind, matching scope/namespace/source, an exact Pod entity, no extra resource attributes or display fields, and a canonical SHA-256 native/resource identity.
• Decode a closed, exact-case payload containing key, value, count, first_event_at, last_event_at, and optional container.
• Accept only key=logs.cause and values panic, missing-config, or dependency-failure; validate the source projector bounds and discard count/container metadata after validation.
• Normalize the fact to one Pod-scoped TELEMETRY observation. Preserve the fact's stale flag and cite the last classified event time.
• Preserve caller-declared coverage exactly. Fact presence never invents TELEMETRY coverage.
• Let the existing R3 rule and weights consume the observation; do not add a new rule, change R3's generic hypothesis, or identify a dependency that the fact does not name.

Acceptance criteria

• Each of the three causes survives the real Elasticsearch projector → graph bridge path as one exact Pod-scoped logs.cause observation.
• Combining an exact LIVE CrashLoop Pod observation with fresh declared TELEMETRY coverage and the bridged fact produces the existing R3 verdict with a cited log cause.
• Missing, stale, or unavailable TELEMETRY coverage keeps R3 coverage-honest; fact presence does not infer coverage.
• Cross-workspace, cross-cluster, cross-namespace, cross-Pod, attached-identity ambiguity, source/provenance mismatch, wrong kind/lens/protocol, malformed native ID, and unexpected attributes/display fields fail closed.
• Empty, oversized, duplicate, mixed-case alias, trailing, unknown-field, malformed-type, invalid-count, invalid-time-order/window, unsupported key/value, and invalid optional-container payloads fail closed.
• Exact protocol claims are validated even when other discriminator fields are malformed; unrelated graph facts remain ignored.
• Raw messages, index/document IDs, query text, labels, URLs, credentials, and user data never enter the brain observation, citation, replay, or CLI output.
• The bridge remains deterministic, entity-local, and non-correlating; no fleet-wide cause claim is added.
• Focused graph/evaluator/replay/CLI tests, race tests, adversarial cases, and fuzz coverage pass.
• README is reviewed; ROADMAP, E14 spec/ADR, and a repository session record document the bridge and its nonclaims.
• Full CI, vulnerability, isolation/fuzz, release/SBOM, Helm/OCI, and real Kind gates pass; CodeRabbit and GitHub security queues are clean.

Non-goals

Elasticsearch HTTP/TLS client, endpoint/index configuration, API keys, mapping discovery, query execution, pagination/PIT/scroll, raw-log retention, negative evidence, coverage inference, dependency-node identity, new rule IDs, F14.6 typed intents, alerts, persistence, fleet correlation, mutation, dispatch, or execution.

Security, reliability, and cost

The bridge consumes only the existing sanitized fact and rejects ambiguous provenance or identity. It never sees the raw log response in production. It adds no credential, socket, filesystem, database, process, telemetry export, or write capability. Runtime cost is bounded JSON validation and one in-memory observation per accepted fact; no cloud resource or egress cost is added.

Primary sources

• https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-search
• https://www.elastic.co/docs/reference/elasticsearch/rest-apis/retrieve-selected-fields
• https://www.elastic.co/docs/reference/ecs/ecs-orchestrator
• https://www.elastic.co/docs/reference/beats/filebeat/exported-fields-kubernetes-processor

[gnanirahulnutakki]

R3 Elasticsearch log-cause graph bridging is landed on dev via PR #281.\n\nLanding proof:\n\n- exact signed final PR head: 84d93a93678ed6b17d39b36005f0c40f852feaf1\n- signed security-hardening commit: 5cab98c9ab72b431a18155f1d2afbe3462dc147a\n- merge commit: df28654b87ecfa1e491901ba8a3d718ba0825a49\n- merge parents: prior dev 098b2b80393f66f82cb565743cde5c27c5aa8aa4 plus exact signed head 84d93a93678ed6b17d39b36005f0c40f852feaf1\n- exact PR-head CI: https://github.com/ArdurAI/sith/actions/runs/29667735580\n- exact PR-head CodeQL: https://github.com/ArdurAI/sith/actions/runs/29667734549\n- exact post-merge dev CI: https://github.com/ArdurAI/sith/actions/runs/29668077348\n- exact post-merge CodeQL: https://github.com/ArdurAI/sith/actions/runs/29668077110\n- hosted CodeRabbit: all 4 threads resolved; final review produced no new finding\n- local proof: full CI, forced-RLS plus two 50,000-execution isolation fuzzers, 296,650 bridge fuzz executions, reproducible release/SPDX SBOM/Homebrew/multi-platform OCI, and pinned Kubernetes 1.36.1 two-cluster Kind\n- final open security queues: 0 Dependabot / 0 code scanning / 0 secret scanning\n\nThe bridge remains exact-protocol, Pod-local, coverage-honest, deterministic, read-only, and fail-closed. It retains no raw log material and adds no client, credential, persistence, fleet correlation, typed intent, mutation, dispatch, execution, cloud resource, egress, or recurring cost.\n\nE14 parent #46 remains open. F14.6 and the other adjacent rule candidates are not claimed complete.\n\nDurable record: https://app.notion.com/p/3a12637edb078146a7abf0ad010ea488