Cybersecurity
Endpoint scanning and durable telemetry delivery, with collision-safe SQLite ingestion.
ORIGINAL CONTRIBUTIONS
Crustacian / SYSTEM MAP
SYSTEMS DESIGN & OWNERSHIP
The Rust endpoint produces structured evidence, writes it to a durable NDJSON spool and sends bounded batches. Queue removal depends on a complete acknowledgment; a transport error or partial acknowledgment leaves evidence available for retry.
The receiver validates batch shape, endpoint identity and event IDs before the SQLite transaction. Identical retries are harmless, while conflicting facts under the same identity reject the batch. This separates delivery retry from evidence replacement.
The deterministic replay uses the real spool, loopback HTTP transport and SQLite store. It injects a 503 and incomplete acknowledgment, then retries to exactly one stored event. ClamAV provides malware detection; the original work here is orchestration, transport and evidence handling.
EXPLORE THE ARCHITECTURE
Endpoint filesystem → local spool → loopback ingest behind a separately configured TLS proxy → SQLite. ClamAV is upstream software; no live endpoint connects to this portfolio.
Wrap the independent ClamAV scanner and emit endpoint evidence.
ImplementationCLI invokes clamscan or clamdscan and writes structured scan telemetry.
Security & failure behaviorThe portfolio uses synthetic fixtures. Real scan menus include response modes that are outside the demonstration. Missing scanner or nonexistent paths produce operational errors.
TradeoffClamAV supplies detection; this project supplies orchestration and telemetry.
Retain events until complete acknowledgment.
ImplementationDelivery locks serialize shipment and atomic spool replacement; bounded retries persist scheduling state.
Security & failure behaviorOnly a complete successful response authorizes removing the shipped prefix. Partial acknowledgment, transport errors and backpressure retain queued events.
TradeoffFile-based queues are inspectable but require coordinated writers and storage budgets.
Validate incoming endpoint batches and control request load.
ImplementationLoopback TCP HTTP service checks schemas, body budgets, endpoint identity tokens and in-flight limits.
Security & failure behaviorShared or endpoint-scoped tokens are configurable; public TLS is delegated to a proxy. The native listener refuses non-loopback binds. Malformed batches or token mismatches are rejected; overload returns retry guidance.
TradeoffA small native HTTP implementation reduces dependencies but needs strict framing validation.
Commit accepted events and identify replays.
ImplementationImmediate transactions index endpoint_id and event_id; conflicting duplicate payloads fail.
Security & failure behaviorThe ingest response follows committed persistence; immutable replay identity prevents silent evidence replacement. Database errors or conflicting event IDs fail the batch.
TradeoffSingle-node persistence; distributed replication and production scale remain unverified.
TECHNICAL CASE STUDY
Retain endpoint scan evidence through retries and delivery failures without silently accepting contradictory facts.
ClamAV orchestration, NDJSON transport, stable endpoint/event identity, durable ingestion, and non-destructive fixture verification.
Rust endpoint scanner and spool; authenticated ingest service and SQLite event store. Dependency and platform behavior are scoped to local Linux verification.
Endpoint identities scope event IDs. Import collision validation protects evidence integrity; the portfolio never starts endpoint quarantine or exposes scan administration.
CharlesDerek initial history and MIT attribution; later commits include explicitly named Omniplexs Agent assistance. Third-party ClamAV is a dependency, not an independently authored antivirus engine.
Scanning orchestration, event transport and ingest persistence exist in source. This cycle exercises legacy migration with synthetic JSON fixtures.
Cross-platform execution, production throughput, and integrated Athernex investigation are not established by these tests.
Conflicting identities within import input fail before database creation. Conflicts against persisted evidence roll back the whole transaction; semantic JSON retries remain harmless.
40 tests pass after adding the deterministic exporter: 26 library, 4 CLI, 9 ingest and 1 replay-repeatability test. Build, fmt and strict Clippy pass. Three import-integrity regressions fail against the previous implementation.
Before: legacy import silently discarded conflicting facts and could retain unrelated writes. After: fail-closed collision detection, atomic rollback, and accurate replay counts. Local commit 326fd79.
Independent endpoint and ingest components. The portfolio presents the tested spool/HTTP/SQLite replay; no live endpoint service or privileged scanning interface is exposed.
Semantic JSON comparison avoids treating formatting as evidence changes. Last-write-wins would hide contradictory facts and was rejected.
The Endpoint delivery replay exercises actual durable append, loopback HTTP sender, validation, SQLite commit and acknowledgment compaction. A 503 and incomplete acknowledgment retain the event; replay stores exactly one row. It does not exercise the scanner, TLS, authentication, Athernex, or investigation UI.
ENGINEERING SCOPE
Verified original scanning orchestration and telemetry implementation; ClamAV supplies the antivirus engine.