feat(brain): bridge Elasticsearch log causes into R3 - #281
Merged
gnanirahulnutakki merged 3 commits intoJul 19, 2026
Conversation
Revalidate bounded search/ecs-v1 facts at the graph boundary, bind native identity to the retained sanitized Pod aggregate, and preserve staleness and caller-declared coverage without retaining raw logs or adding I/O. GSTACK-Checkpoint: 2026-07-18/e14-elasticsearch-r3-bridge#1 Signed-off-by: Gnani Rahul Nutakki <gnani.nutakki@gmail.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe PR connects sanitized Elasticsearch ChangesElasticsearch R3 graph bridge
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant ElasticsearchConnector
participant FromGraphFacts
participant InvestigationBrain
ElasticsearchConnector->>FromGraphFacts: provide bounded derived LogSignal fact
FromGraphFacts->>FromGraphFacts: validate provenance, identity, payload, and Pod scope
FromGraphFacts->>InvestigationBrain: emit sanitized logs.cause observation
InvestigationBrain->>InvestigationBrain: evaluate existing R3 CrashLoop rule
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Member
Author
|
@coderabbitai review |
✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@internal/brain/graph.go`:
- Around line 220-254: Extend the validation in the Elasticsearch log-cause fact
projection to reject any non-empty provenance DeepLink or Collector metadata,
alongside the existing attributes and display checks. Update the validation
block around the entity and fact fields so unexpected provenance metadata
returns the same fail-closed error path.
- Around line 453-459: Update decodeElasticsearchLogCausePayload to validate raw
with utf8.Valid before calling rejectDuplicateGraphJSON, returning the existing
payload-decoding error pattern when the bytes are invalid. Keep duplicate-key
rejection and subsequent decoding unchanged.
In `@sessions/2026-07-18-e14-elasticsearch-r3-bridge.md`:
- Line 101: Update the line beginning “#280, update `#46`” to avoid a malformed
Markdown heading token, using “issue 280” or placing “#280” inline within the
sentence while preserving the existing meaning.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 1dd788ad-9a82-4a7d-9990-45968101caa7
📒 Files selected for processing (13)
README.mddocs/ROADMAP.mddocs/adr/0008-deterministic-advisory-brain.mddocs/specs/E2-readfed-brain-integrations.mdinternal/brain/graph.gointernal/brain/graph_elasticsearch_test.gointernal/brain/testdata/replays/README.mdinternal/brain/testdata/replays/r3-elasticsearch-log-cause.jsoninternal/cli/investigate_test.gointernal/connector/elasticsearch/boundary_test.gointernal/connector/elasticsearch/project.gointernal/connector/elasticsearch/project_test.gosessions/2026-07-18-e14-elasticsearch-r3-bridge.md
Reject unreviewed provenance metadata and malformed UTF-8 before JSON normalization. Add regression coverage and record the hosted-review remediation proof. GSTACK-Checkpoint: 2026-07-18/e14-elasticsearch-r3-bridge#2 Signed-off-by: Gnani Rahul Nutakki <gnani.nutakki@gmail.com>
Member
Author
|
@coderabbitai review |
✅ Action performedReview finished.
|
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@sessions/2026-07-18-e14-elasticsearch-r3-bridge.md`:
- Around line 115-119: Resolve the conflicting brain coverage values between the
earlier checkpoint and this post-remediation matrix entry. If they represent
different runs, identify each by its checkpoint or commit; otherwise, correct
the value so the verification record contains one unambiguous coverage figure.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 93d2fba9-6a77-4329-8cd0-ab22b6fe00d0
📒 Files selected for processing (3)
internal/brain/graph.gointernal/brain/graph_elasticsearch_test.gosessions/2026-07-18-e14-elasticsearch-r3-bridge.md
🚧 Files skipped from review as they are similar to previous changes (2)
- internal/brain/graph_elasticsearch_test.go
- internal/brain/graph.go
Distinguish original feature-head coverage from the post-remediation run so the verification record is unambiguous. GSTACK-Checkpoint: 2026-07-18/e14-elasticsearch-r3-bridge#3 Signed-off-by: Gnani Rahul Nutakki <gnani.nutakki@gmail.com>
Member
Author
|
@coderabbitai review |
✅ Action performedReview finished.
|
This was referenced Jul 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
search/ecs-v1log-cause fact into the deterministic R3 CrashLoop ruleSecurity, reliability, and cost
Raw log messages are classified and discarded by the existing source projector before the brain sees a fact. The bridge retains only exact Pod identity, the closed
logs.causevalue, last classified event time, source, and staleness. It adds no Elasticsearch client, credential, endpoint/index configuration, query execution, retention, correlation, typed intent, mutation, dispatch, cloud resource, egress, or recurring cost.Verification
make ci— zero lint findings, no reachable vulnerabilities, complete race/policy/alert/performance/E2E/build gatemake e2e-isolation— PostgreSQL 18.4 forced RLS plus both 50,000-execution workspace fuzzersmake release-check— reproducible four-platform archives, SPDX SBOMs, Homebrew, amd64/arm64 Hub OCImake e2e-kind— Kubernetes 1.36.1 two-cluster suite in 234.972s with clean teardownCloses #280
Parent: #46
Summary by CodeRabbit
search/ecs-v1log-cause evidence (no direct querying).panic,missing-config,dependency-failure, preserving last-event timing and staleness.