Enum Event 

pub enum Event {
    Beat {
        pid: u32,
        status: Status,
        payload: u32,
        nonce: u64,
        origin: BeatOrigin,
        pid_ns_inode: Option<u64>,
        observer_ns: u64,
    },
    Stall {
        pid: u32,
        last_nonce: u64,
        last_ns: u64,
        origin: BeatOrigin,
        pid_ns_inode: Option<u64>,
        observer_ns: u64,
    },
    Decode(DecodeError, u64),
    AuthFailure {
        claimed_pid: u32,
        observer_ns: u64,
    },
    OriginConflict {
        claimed_pid: u32,
        observed_origin: BeatOrigin,
        slot_origin: BeatOrigin,
        observer_ns: u64,
    },
    NamespaceConflict {
        claimed_pid: u32,
        observed_ns_inode: Option<u64>,
        observer_ns_inode: Option<u64>,
        observer_ns: u64,
    },
    Io(Error, u64),
    CtrlTruncated(Error, u64),
}

Event surfaced by Observer::poll.

Each call to poll returns at most one event. Unknown-pid overflow and out-of-order beats are silently dropped at this layer; the bench / metrics sessions can layer counters on top without changing this enum.

Variants

Beat

A well-formed beat was accepted for a tracked pid.

Fields

pid: u32

OS process id of the emitting agent.

status: Status

Decoded health status of the beat.

payload: u32

Application-defined payload carried by the beat.

nonce: u64

Monotonic nonce of the beat.

origin: BeatOrigin

Transport-class classification of the beat (see BeatOrigin). Recovery commands consult this to refuse firing on non-kernel-attested origins.

pid_ns_inode: Option<u64>

Kernel-attested PID-namespace inode of the sender (Linux only). None for non-Linux platforms, UDP transports, or when the peer’s /proc/<pid>/ns/pid was unreadable.

observer_ns: u64

Observer-local timestamp (ns since Observer start) when this event was produced.

Stall

A tracked pid has not beaten within the configured threshold and the observer has not yet surfaced a stall event for this silence run.

Fields

pid: u32

OS process id of the silent agent.

last_nonce: u64

Last nonce observed for this pid.

last_ns: u64

Observer-local timestamp (ns since Observer start) of the last accepted beat for this pid.

origin: BeatOrigin

Transport origin pinned by the slot’s first beat. Recovery refuses to spawn for NetworkUnverified unless the operator has explicitly opted in via --i-accept-recovery-on-unauthenticated-transport.

pid_ns_inode: Option<u64>

PID-namespace inode pinned by the slot’s first beat (Linux only). Used by main.rs to construct the recovery StallSource: a Some(_) value that differs from the observer’s namespace inode indicates a cross-namespace agent and gates recovery refusal.

observer_ns: u64

Observer-local timestamp (ns since Observer start) when this stall event was produced.

Decode(DecodeError, u64)

A 32-byte payload arrived but failed VLP decoding.

AuthFailure

Frame decoded but the frame.pid does not match the kernel-verified peer PID of the sender. The claimed pid is preserved so exporters can record what the frame claimed to be.

Fields

claimed_pid: u32

The pid the frame on the wire claimed to be.

observer_ns: u64

Observer-local timestamp (ns since Observer start) when this event was produced.

OriginConflict

A beat arrived for an already-tracked pid, but its transport origin disagreed with the origin pinned by the slot’s first beat. The slot was not mutated; the beat was dropped. First-origin-wins prevents an attacker on an untrusted transport from “tainting” a slot that legitimately belongs to a kernel-attested agent.

Fields

claimed_pid: u32

The pid claimed by the dropped beat (same as the existing slot’s pid).

observed_origin: BeatOrigin

Transport origin observed on this datagram.

slot_origin: BeatOrigin

Origin pinned by the slot (the one that “won” the conflict).

observer_ns: u64

Observer-local timestamp (ns since Observer start) when this event was produced.

NamespaceConflict

A kernel-attested beat arrived whose peer PID-namespace inode differs from the observer’s namespace (Linux only). Recovery for the associated pid cannot safely fire because the pid is in a different namespace — kill(2) and systemctl would target the wrong process. The beat was dropped at receive; the tracker was not modified.

Fields

claimed_pid: u32

The pid claimed by the dropped beat.

observed_ns_inode: Option<u64>

PID-namespace inode of the sender (Linux only; None when /proc/<peer_pid>/ns/pid was unreadable).

observer_ns_inode: Option<u64>

The observer’s own PID-namespace inode (cached at startup; None when /proc/self/ns/pid is unreadable, which usually means the platform isn’t Linux).

observer_ns: u64

Observer-local timestamp (ns since Observer start) when this event was produced.

Io(Error, u64)

Receiving from a listener failed with an error other than WouldBlock / TimedOut.

CtrlTruncated(Error, u64)

Ancillary data truncated by the kernel (MSG_CTRUNC on Linux). Indicates the kernel’s ancillary-data buffer was too small for the per-message metadata — a kernel-level buffer sizing issue.

Trait Implementations

impl Debug for Event

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.