skbx Arc / mission control

Experimental · local-first · missionq/0.1.0

Three hosts.
One bounded
mission.

Arc coordinates packet evidence from Linux sensors you control. It shows what each host observed, what can be correlated across hosts, and where the evidence still ends.

Run the local demo Read the architecture
Arc Mission Constellation showing a request correlated from a developer laptop through an edge gateway to an application host, where a Netfilter drop is observed and the mission remains partial
03 sensors · 08 receipts partial · loss 14

The governing rule

Correlation is useful.
It is not observation.

Every native traceq artifact remains authoritative for its own host. Arc writes a separate mission record and labels every cross-host relationship by the evidence that supports it.

Evidence vocabulary

Four words.
Four different claims.

01 / HOST RECEIPT

Observed

A sensor recorded this kernel event inside its own bounded capture.

02 / ROUTE RELATIONSHIP

Correlated

Compatible tuple, packet length, clock interval, and one-to-one assignment support the relationship.

03 / WEAKER BASIS

Candidate

The time and flow fit, but packet metadata differs. Arc preserves the weaker claim.

04 / NO CLAIM

Unknown

An artifact is missing or no viable observation pair exists. The gap stays visible.

One mission, bounded end to end

Plans go out.
Receipts come back.

  1. 01
    Register

    An outbound-only sensor reports identity, kernel release, capabilities, and clock uncertainty.

  2. 02
    Lease

    Arc issues an idempotent assignment with exact duration, event, byte, filter, and probe bounds.

  3. 03
    Validate

    The complete traceq artifact is checked before Arc indexes a single receipt.

  4. 04
    Correlate

    Adjacent sensors are matched deterministically; loss and clock uncertainty stay attached.

Website request / timeout

The request arrived.
The local path ended.

In the seeded mission, the application host records SKB_DROP_REASON_NETFILTER_DROP. That is direct local evidence. The same artifact reports 14 recursion misses, so Arc refuses to call the mission complete.

Finding
Netfilter drop observed
Artifacts
03 / 03 received
Mission
Partial, not complete

Rootless evaluation

Put mission control on your loopback.

Clone the repository, run the seeded control plane, and explore the complete sensor → assignment → artifact → correlation lifecycle without attaching BPF programs.

$ cargo run -p skbx-arc -- serve --demo

Then open http://127.0.0.1:7878

Lab boundary

A vertical slice,
not a fleet promise.

BUILT NOW
  • Loopback-first Arc service
  • In-memory mission state
  • Rootless fixture agent
  • Validated artifact ingestion
  • Deterministic correlation
PRODUCTION GATES
  • Mutual TLS and operator identity
  • Durable mission and artifact storage
  • Signed, policy-checked assignments
  • Privilege-separated live capture
  • Fleet reconciliation and audit logs

Start from evidence

See the mission.
Inspect every receipt.

Inspect Arc source Open the website request field guide