flock_tap: audit-integrity + data-minimization for cloud-vs-local verdicts #3

2026-07-22T16:05:22Z

Trilltechnician commented

2026-07-22 16:05:22 +00:00

Makes the passive tap a defensible auditing instrument for the cloud-vs-local question while shrinking what it retains about bystanders. Nothing here widens third-party capture.

What changed

Unified verdict vocabulary — one private _classify() folds flow-stat and device-level signals into exactly one of CLOUD_CONNECTED / LOCAL_STATION / INDETERMINATE; classify_device/classify_camera are thin wrappers. The old divergent return sets fell out of summary buckets so totals never reconciled.
Report counts reconcile — counts_reconcile asserts cloud+local+indeterminate == total_ips_tracked.
Explainable cloud verdicts — records contacted known-Flock IPs and surfaces CLOUD_IP(...) evidence plus a TLS_CATEGORY(...) fallback; no unexplained verdict.
Bounded captures — per-device raw sample lists cap at max_samples (default 500, --tap-max-samples); exact integer counters stay precise past the cap.
Bystander protection — FRP auth stores a descriptor (matched keyword + payload length) instead of raw payload bytes; optional --tap-redact-ips salt-hashes non-Flock destination IPs (known-Flock IPs stay legible).
Metadata-only destination_summary per cloud device (DNS names, TLS SNIs, known-Flock IPs) — who it talks to, never payload contents.

Tests extend the merged suite (39 pass): vocabulary agreement, bucket reconciliation, indeterminate counting, CLOUD_IP evidence, sample capping vs exact counters, FRP descriptor, IP redaction, metadata-only summary. Stale-vocabulary assertions updated to INDETERMINATE.

Stacked on the merged #1/#2; base = main.

Makes the passive tap a defensible auditing instrument for the cloud-vs-local question while shrinking what it retains about bystanders. Nothing here widens third-party capture. **What changed** - **Unified verdict vocabulary** — one private `_classify()` folds flow-stat and device-level signals into exactly one of CLOUD_CONNECTED / LOCAL_STATION / INDETERMINATE; `classify_device`/`classify_camera` are thin wrappers. The old divergent return sets fell out of summary buckets so totals never reconciled. - **Report counts reconcile** — `counts_reconcile` asserts cloud+local+indeterminate == total_ips_tracked. - **Explainable cloud verdicts** — records contacted known-Flock IPs and surfaces `CLOUD_IP(...)` evidence plus a `TLS_CATEGORY(...)` fallback; no unexplained verdict. - **Bounded captures** — per-device raw sample lists cap at `max_samples` (default 500, `--tap-max-samples`); exact integer counters stay precise past the cap. - **Bystander protection** — FRP auth stores a descriptor (matched keyword + payload length) instead of raw payload bytes; optional `--tap-redact-ips` salt-hashes non-Flock destination IPs (known-Flock IPs stay legible). - **Metadata-only `destination_summary`** per cloud device (DNS names, TLS SNIs, known-Flock IPs) — who it talks to, never payload contents. **Tests** extend the merged suite (39 pass): vocabulary agreement, bucket reconciliation, indeterminate counting, CLOUD_IP evidence, sample capping vs exact counters, FRP descriptor, IP redaction, metadata-only summary. Stale-vocabulary assertions updated to INDETERMINATE. Stacked on the merged #1/#2; base = main.

Trilltechnician added 1 commit 2026-07-22 16:05:23 +00:00

flock_tap: audit-integrity + data-minimization for cloud-vs-local verdicts 51ba69a541

Makes the passive tap a defensible auditing instrument for the
"does this camera phone home to Flock?" question, while shrinking what it
retains about bystanders. Nothing here widens third-party capture.

- Unified verdict vocabulary. A single private _classify() folds flow-stat
  and device-level signals into exactly one of CLOUD_CONNECTED /
  LOCAL_STATION / INDETERMINATE. classify_device/classify_camera become thin
  wrappers. Previously the two classifiers returned divergent sets
  (OFFLINE_OR_UNMONITORED, NO_DATA, UNKNOWN) that fell out of every summary
  bucket, so totals never reconciled.
- Report counts now reconcile. Summary buckets partition every tracked IP;
  counts_reconcile asserts cloud+local+indeterminate == total_ips_tracked.
- Explainable cloud verdicts. Record known-Flock IPs a device contacted
  (cloud_ip_contacts) and surface CLOUD_IP(...) evidence, plus a
  TLS_CATEGORY(...) fallback, so a cloud verdict is never unexplained.
- Bounded captures. Per-device raw sample lists cap at max_samples
  (default 500, --tap-max-samples). Exact integer counters increment
  regardless, so verdict inputs and report totals stay precise past the cap.
- Bystander protection. FRP auth detection stores a non-content descriptor
  (matched keyword + payload length) instead of 64 raw payload bytes.
  Optional --tap-redact-ips salt-hashes non-Flock destination IPs in stored
  samples; known-Flock IPs stay legible so cloud evidence is readable.
- Metadata-only destination_summary per cloud device (DNS names, TLS SNIs,
  known-Flock IPs) — who it talks to, never payload contents.

Tests extend the merged suite with audit-integrity coverage (vocabulary
agreement, bucket reconciliation, indeterminate counting, CLOUD_IP evidence,
sample capping vs exact counters, FRP descriptor, IP redaction,
metadata-only summary). Stale-vocabulary assertions updated to INDETERMINATE.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ek0ms savi0r commented

2026-07-22 21:37:34 +00:00

hell yee ninja lfg thank you!!

ek0ms savi0r merged commit cb7704e269 into main

2026-07-22 21:37:40 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: ek0mssavi0r/Flock_SCAN#3

Allow edits from maintainers