feat(engine): corroborate drop-then-execute (JEF-321)

[thejefflarson]

Summary

Adds the drop-then-execute cross-signal corroboration shape flagged by JEF-321 (Retire-Falco G5): a ProcessExec of a path RECENTLY FileWrite-n by the SAME workload, on a proven internet-facing foothold entry — the classic "drop a payload under a benign-looking path (e.g. /tmp), then run it" pattern.

Today neither behavior alone corroborates: an ordinary ProcessExec is not a notable_exec (shell/pkg-mgr) and an ordinary /tmp FileWrite is not an alarming_write (sensitive-path). Only the correlation of the two on the same path is the tell — which the flat, context-free per-behavior corroborates predicate can't express (it only ever sees one behavior at a time).

Where the cross-signal state lives (per the ticket's ask)

No new store was introduced. The entry's own runtime: &[RuntimeSignal] slice — already resolved once per entry via entry_runtime — is itself a bounded, time-windowed per-workload record: it's fed from RuntimeEvents (engine/src/engine/observe/runtime.rs), which is TTL'd (runtime_window(), default 1800s / 30 min) and capped at MAX_EVENTS = 4096 globally, with per-batch (1024) and per-peer rate limits on ingest. That existing bound is the "recent writes to match the exec against" the ticket calls for.

On top of that I added DROP_EXEC_WINDOW = 300s (5 min) — narrower than the general runtime TTL — so a write and an exec of the same path minutes apart reads as one drop-and-run act, while the same path written and re-run much later (a build cache, a rotated log) does not. The match also requires the write to be AT OR BEFORE the exec (ordering matters).

New function drop_then_execute in engine/src/engine/reason/proof/corroborate.rs, wired into corroborated_for alongside the existing cross_tenant_lateral shape (JEF-319) it mirrors structurally.

FP-aware / entry scoping

Scoped to a proven internet-facing foothold entry only (EntryContext.is_foothold), exactly like cross_tenant_lateral — apps legitimately write-then-run their own /tmp scripts constantly, so an ordinary pod's write+exec must never corroborate. This is checked first (cheap early-return) before the O(n²) path-correlation scan even runs.

Shadow / no-actuation

Only sets corroborated; never touches engine.enable or any actuation path (ADR-0014).

Tests

New engine/src/engine/reason/proof/corroborate_drop_exec_tests.rs (mirrors corroborate_context_tests.rs's style), covering the ticket's acceptance criteria:

• exec of a recently-written path on a foothold entry → corroborates (both end-to-end via corroborated_for and directly on drop_then_execute)
• exec with no matching write → does not
• write and exec of different paths → does not
• same pair on a non-foothold (ordinary) entry → does not
• exec strictly before an unrelated later write of the same path → does not
• exactly at the DROP_EXEC_WINDOW boundary → still corroborates (<=)
• just past the window → does not (the bound/TTL exercised)
• DROP_EXEC_WINDOW is asserted narrower than the general runtime TTL
• regression guard: an unpaired benign write + bare exec of different paths still don't corroborate

Checks

• cargo fmt -p protector -- --check — clean
• cargo clippy --all-targets -- -D warnings — clean
• cargo test -p protector — 916 passed, 0 failed, 2 ignored (network-only), plus dashboard/file-size guard suites all green
• file_size_guard test confirms every source file stays under the repo's 1,000-line cap (corroborate.rs is ~275 lines)
• Self-reviewed the diff against soundcheck's PR-review checklist (pure in-memory correlation over already-authenticated, rate-limited, TTL'd runtime signals — no new I/O, no user-controlled paths, no secrets): no Critical/High findings
• Ran a single-pass /simplify-equivalent review (no Agent-tool fan-out available in this context): applied a couple of doc-comment prose cleanups; no structural findings. The nested O(execs × writes) scan inside drop_then_execute was considered and intentionally left as a plain nested .any() (matches cross_tenant_lateral's simple-scan style) rather than adding a HashMap — the foothold early-return keeps the hot path free for the overwhelming majority of non-foothold entries, and the underlying runtime slice is already small/rate-limited/TTL'd in practice.

Closes JEF-321