The v1 agent wire contract

(PR #22, flow-collection gaps). Additive fields under decision 6, no field renumbered or retyped. ReportFlowsRequest gains repeated EvidenceGap gaps: each gap is an interval [from, to) with a kind (source overrun, source restart, buffer overflow, truncated table dump), the source that lost the evidence (unspecified for a loss that is not one source's), and a count where one is known. Every loss the agent can detect, the buffer's dropped windows included, is expressed this one way. Gaps ride the next window rather than a schedule of their own, and a window may carry gaps and no records; delivery is at least once, like the records', and the reporting workload is the connection credential's. Heartbeat gains source_overruns, the live count beside dropped_flow_records. FlowRecord.connection_count is documented as the connections opened, or found live when the source subscribed, in the window, which is what the agent's table dump at every subscribe produces. The core decisions stand.

(PR #23, conformance-audit absorption). One additive enum value under decision 6, nothing renumbered or retyped: EvidenceGapKind gains EVIDENCE_GAP_KIND_WINDOW_OVERFLOW, the agent's open aggregation window held as many distinct keys as it allows and observations for new keys were dropped, with the observations dropped as its count (ADR-0019 as amended). The core decisions stand.

(PR #81, clock-skew detection). One additive field under decision 6, nothing renumbered or retyped: ReportFlowsRequest gains sent_at, the sender's clock when it sent the request, stamped on every request immediately before it is sent, a retried window included. It carries the agent's clock for skew detection: the control plane compares it with the instant it received the request, and a difference beyond twice the flow aggregation window (a named constant in internal/ingest, not configuration) is skew. An agent whose clock has drifted stamps every window it reports with that clock, so its flows land at the wrong times without anything saying so; the skew is recorded on the workload in Postgres (ADR-0017) and surfaced, a WARN log line naming the workload and the offset and a note beside the workload's flows, and the window is stored as reported, never refused. The window bounds cannot carry this: the agent holds closed windows in its buffer while the control plane is unreachable and delivers them when it returns (ADR-0019), so late delivery of buffered windows is expected and is not skew. A request without sent_at, from an agent that predates the field, is judged by its window's end and only for a clock running ahead, since a window cannot legitimately arrive before it ends. The core decisions stand.

(PR #90, rejected windows). One additive enum value under decision 6, nothing renumbered or retyped: EvidenceGapKind gains EVIDENCE_GAP_KIND_WINDOW_REJECTED, the control plane refused a closed window as malformed (InvalidArgument) and the agent dropped it, over the window's bounds with its records as the count (ADR-0019 as amended). A refused window can never be accepted, and retried as the oldest window it held every later window behind it until the agent restarted: one malformed window cost all telemetry after it, with nothing saying so (issue #86). Every other failure is still retried with backoff, because a window delivered late is legitimate (ADR-0019). The control plane reads a report's clock before it validates the window's bounds, so a report refused for its bounds still records the skew that likely inverted them; sent_at is independent of the bounds. The core decisions stand.

(PR #95, owned-table presence, issue #64). One additive field under decision 3 and one additive enum value under decision 6, nothing renumbered or retyped. Heartbeat gains owned_table, an OwnedTableState: whether the Innerwall-owned firewall table is in the kernel, read when the heartbeat is composed (PRESENT, ABSENT, or UNSPECIFIED from an agent that predates the field, one that has installed nothing, or a read that failed). The local kill switch deletes the table without the daemon or the control plane (ADR-0011) and changes no version, so an acknowledged version kept saying a host enforced what it no longer held: the console showed a kill-switched host enforced and synced until an operator happened to push a policy. The read is part of composing the heartbeat, on the heartbeat's own schedule, the way an inventory report reads the host's listening services; it adds no timer and asks the control plane nothing, so ADR-0002's no-polling rule and its one recorded host-local exception are untouched, and the removal is reported within one heartbeat interval. The agent never reinstalls the table because it found it gone, since removing it is the kill switch; its next apply or restart reinstalls it, as before. The control plane records the state on the workload in Postgres (ADR-0017), keeps the last known state when a heartbeat does not know, and treats an applied acknowledgement as the table installed. EvidenceGapKind gains EVIDENCE_GAP_KIND_TABLE_REMOVED: observation and the classification its connection marks carry die with the table, so the interval from the last instant the agent knew the table present to its reinstallation is an evidence gap, not one source's and without a count, shipped in pieces with every window that closes while it lasts so that a long removal is never read as a quiet host (ADR-0019 as amended). The core decisions stand.

(PR #102, issue #93): an expired credential may renew. Clarification of decision 1, corrected in place. The boundary between the two services stands as decided: EnrollmentService takes a token and nothing else, and every AgentService method requires a verified workload credential. What is new is one per-method distinction inside AgentService, on the credential's validity period alone: RenewCredential accepts a credential expired within the renewal grace, and every other method requires one within its validity. Default-deny holds, since a method added later requires a valid credential unless it is named as renewal is. ADR-0016 as amended carries the rule and its reasoning.

(PR #125, a silent agent, issue #114). One additive enum value under decision 6, nothing renumbered or retyped: EvidenceGapKind gains EVIDENCE_GAP_KIND_AGENT_SILENT, the control plane received no flow report from the workload for longer than the telemetry-liveness allowance and no window delivered afterwards covered the interval (ADR-0019 as amended). Unlike every earlier kind it is never sent by an agent — an agent cannot observe its own absence — and ingest refuses a report that claims it; the value lives in the wire enum because the stored gaps, the read model, and the operator surface speak this one enum, and reserving the number keeps a future agent from minting it to mean something else. Decision 6's rule that a loss "is never inferred from silence" stands for the agent's own reporting: the agent still infers nothing; the control plane states only what it directly observed — its own receipts — and the interval is bounded by them. The core decisions stand.