feat: rewrite telemetery and configs

Author: oneslash

.agents/skills/limier-cli/SKILL.md

@@ -38,8 +38,8 @@ Do not use this skill for general application security review, dependency policy
 ## Preconditions
 
 - Docker must be available to the current user.
-- Host-signal capture is Linux-only and requires `bpftrace`.
-- On macOS, Windows, or CI environments without `bpftrace`, make sure the scenario sets `capture_host_signals: false` or expect an inconclusive result.
+- Kernel telemetry capture is Linux-only and requires `bpftrace`.
+- On macOS, Windows, or CI environments without `bpftrace`, use `telemetry.mode: off` for an output-only comparison that requires human review, or expect an inconclusive result.
 
 For local development in this repo, prefer:
 
@@ -60,7 +60,7 @@ When the user has not specified otherwise, the repository-owned sample uses:
 ## Recommended Workflow
 
 1. Confirm the ecosystem, package, current version, candidate version, fixture, scenario, and rules file.
-2. Check whether the environment can satisfy the scenario, especially `capture_host_signals`.
+2. Check whether the environment can satisfy the scenario's telemetry mode.
 3. Run Limier with explicit output paths under `out/limier/`.
 4. Read `summary.md` first.
 5. If the result is not `good_to_go`, inspect `evidence/` and any rendered explanation before making claims.
@@ -127,7 +127,7 @@ Treat `rerun` as an environment or determinism problem first, not a safe outcome
 
 - Docker access problems
 - fixture nondeterminism
-- missing Linux host-signal support while `capture_host_signals` is enabled
+- missing Linux telemetry support while `telemetry.mode` is `required`
 - scenario steps failing before comparison completes
 
 When debugging, inspect the scenario, evidence bundle, and environment assumptions before changing rules.

README.md

@@ -13,7 +13,7 @@ Limier is a fixture-based dependency behavior review tool. It compares a baselin
 
 Limier is intentionally narrow. It is for suspicious or exploit-like dependency behavior such as new process execution, unexpected shelling out, changed install-time behavior, or other observable runtime drift. It is not a general application security scanner and it does not try to find `SQLi`, `XSS`, CSRF, or broad secure-coding flaws in the fixture itself.
 
-Real host-signal capture is Linux-only and currently requires `bpftrace`. If `capture_host_signals` is enabled and Limier cannot start that backend, the run becomes inconclusive so process-coverage gaps are never hidden. On non-Linux systems, set `capture_host_signals: false` to use stdout/stderr-only comparison.
+Kernel telemetry is Linux-only and currently requires `bpftrace`. Telemetry defaults to `required`; if Limier cannot start or complete capture, the run becomes inconclusive so process-coverage gaps are never hidden. Use `telemetry.mode: off` for an output-only comparison that always requires human review.
 
 ## Documentation
 

cmd/ci.go

@@ -27,6 +27,7 @@ type githubCIOptions struct {
 	fixturePath            string
 	scenarioPath           string
 	rulesPath              string
+	telemetryMode          string
 	metadataOutcome        string
 	dependencyFilesChanged string
 	prAuthor               string
@@ -92,6 +93,7 @@ func newGitHubCICommand() *cobra.Command {
 	cmd.Flags().StringVar(&options.fixturePath, "fixture", "", "Path or preset for the sample application fixture")
 	cmd.Flags().StringVar(&options.scenarioPath, "scenario", "", "Path or preset for the scenario manifest")
 	cmd.Flags().StringVar(&options.rulesPath, "rules", "", "Path or preset for the rules file")
+	cmd.Flags().StringVar(&options.telemetryMode, "telemetry-mode", "", "Telemetry mode override: required or off")
 	cmd.Flags().StringVar(&options.dependencyFilesChanged, "dependency-files-changed", "", "Whether dependency-relevant files changed: true, false, or unknown")
 
 	return cmd
@@ -132,6 +134,7 @@ func runGitHubCI(ctx context.Context, options githubCIOptions) error {
 		fixturePath:      options.fixturePath,
 		scenarioPath:     options.scenarioPath,
 		rulesPath:        options.rulesPath,
+		telemetryMode:    options.telemetryMode,
 		reportPath:       paths.reportPath,
 		summaryPath:      paths.summaryPath,
 		evidencePath:     paths.evidencePath,

cmd/run.go

@@ -25,6 +25,7 @@ type runOptions struct {
 	reportPath       string
 	summaryPath      string
 	evidencePath     string
+	telemetryMode    string
 	failOn           string
 }
 
@@ -75,6 +76,7 @@ func newRunCommand() *cobra.Command {
 	cmd.Flags().StringVar(&options.reportPath, "report", options.reportPath, "Path to write report.json")
 	cmd.Flags().StringVar(&options.summaryPath, "summary", options.summaryPath, "Path to write summary.md")
 	cmd.Flags().StringVar(&options.evidencePath, "evidence", options.evidencePath, "Path to write evidence files")
+	cmd.Flags().StringVar(&options.telemetryMode, "telemetry-mode", "", "Telemetry mode override: required or off")
 	cmd.Flags().StringVar(&options.failOn, "fail-on", "", "Comma-separated recommendations that should fail this command; empty preserves Limier defaults")
 
 	_ = cmd.MarkFlagRequired("ecosystem")
@@ -133,6 +135,7 @@ func executeRun(ctx context.Context, options runOptions) (report.Report, error)
 		ScenarioPath:     strings.TrimSpace(resolved.scenarioPath),
 		RulesPath:        strings.TrimSpace(resolved.rulesPath),
 		EvidencePath:     strings.TrimSpace(resolved.evidencePath),
+		TelemetryMode:    strings.TrimSpace(resolved.telemetryMode),
 	})
 
 	if err := report.WriteAll(options.reportPath, options.summaryPath, result.Report); err != nil {
@@ -146,6 +149,8 @@ func executeRun(ctx context.Context, options runOptions) (report.Report, error)
 		"technical_verdict", result.Report.TechnicalVerdict,
 		"operator_recommendation", result.Report.OperatorRecommendation,
 		"exit_code", result.Report.ExitCode,
+		"telemetry_mode", result.Report.Telemetry.Mode,
+		"telemetry_status", result.Report.Telemetry.Status,
 		"report_path", options.reportPath,
 		"summary_path", options.summaryPath,
 		"evidence_path", result.Report.Evidence.RootPath,

docs/diagrams/limier-operation-flow.excalidraw

@@ -1016,10 +1016,10 @@
     {
       "id": "events-note",
       "type": "rectangle",
-      "x": 2596,
-      "y": 343,
-      "width": 445,
-      "height": 161,
+      "x": 2562,
+      "y": 381,
+      "width": 621,
+      "height": 179,
       "angle": 0,
       "strokeColor": "#264653",
       "backgroundColor": "#ffffff",
@@ -3056,10 +3056,10 @@
     {
       "id": "s_k_L47jhPZEgk-Xx4mY8",
       "type": "text",
-      "x": 2680.923828125,
-      "y": 374,
-      "width": 276.15234375,
-      "height": 90,
+      "x": 2680.38330078125,
+      "y": 421,
+      "width": 385.2333984375,
+      "height": 45,
       "angle": 0,
       "strokeColor": "#17324d",
       "backgroundColor": "transparent",
@@ -3080,13 +3080,13 @@
       "updated": 1776607283582,
       "link": null,
       "locked": false,
-      "text": "Evidence includes stdout, stderr,\nexit codes, and optional Linux\nhost-signal events when capture is\nenabled.",
+      "text": "Evidence includes stdout, stderr, exit codes, and\nrequired process-execution telemetry.",
       "fontSize": 18,
       "fontFamily": 2,
       "textAlign": "center",
       "verticalAlign": "middle",
       "containerId": "events-note",
-      "originalText": "Evidence includes stdout, stderr, exit codes, and optional Linux host-signal events when capture is enabled.",
+      "originalText": "Evidence includes stdout, stderr, exit codes, and required process-execution telemetry.",
       "autoResize": true,
       "lineHeight": 1.25
     },

docs/diagrams/limier-operation-flow.preview.png

@@ -314,7 +314,7 @@
     {
       "id": "events-note",
       "target": "compare",
-      "label": "Evidence includes stdout, stderr, exit codes, and optional Linux host-signal events when capture is enabled.",
+      "label": "Evidence includes stdout, stderr, exit codes, and required process-execution telemetry.",
       "placement": "bottom"
     },
     {

docs/diagrams/limier-operation-flow.scene-spec.json

@@ -1,13 +1,13 @@
 {
-  "svgPath": "/Users/sardo/Projects/t/docs/diagrams/limier-operation-flow.svg",
-  "previewPath": "/Users/sardo/Projects/t/docs/diagrams/limier-operation-flow.preview.png",
+  "svgPath": "docs/diagrams/limier-operation-flow.svg",
+  "previewPath": "docs/diagrams/limier-operation-flow.preview.png",
   "screenshot": {
     "width": 4718,
-    "height": 829
+    "height": 835
   },
   "exportSummary": {
     "width": 4718,
-    "height": 829.25,
+    "height": 835,
     "exportPadding": 20
   },
   "inspectSummary": {
@@ -47,7 +47,7 @@
       "textOverlaps": 0,
       "crowdedLabels": 0,
       "diagramSprawl": 0,
-      "occupancyRatio": 0.361,
+      "occupancyRatio": 0.367,
       "maxEdgeLength": 749,
       "sameRankBentEdgeCount": 0,
       "worstEdgeDetourRatio": 3.73,
@@ -57,20 +57,15 @@
       "minX": 100,
       "minY": -235,
       "maxX": 4778,
-      "maxY": 554.25
+      "maxY": 560
     }
   },
   "warnings": [],
   "hardFailures": [],
   "passed": true,
-  "metadata": {
-    "layoutEngine": "legacy",
-    "layoutEngineReason": "manual layout remains on the deterministic legacy path",
-    "preset": "clean-flowchart"
-  },
   "policy": {
     "maxWarnings": 0,
-    "minimumEditableElements": 18,
+    "minimumEditableElements": 2,
     "requireStructuredScene": true
   },
   "manualChecklist": [

docs/diagrams/limier-operation-flow.svg

@@ -118,14 +118,18 @@ In this path, `report.json` is the source of truth. Rendered outputs are alterna
 
 ## Hosted Runners vs Self-Hosted Runners
 
-For GitHub-hosted runners, assume Docker is available but full host-signal capture is not. In that environment you should typically use:
+Telemetry defaults to `required`. Install `bpftrace` and confirm the runner supports cgroup v2 and eBPF before relying on a `good_to_go` recommendation.
+
+The reusable `room215/limier-action` performs this setup on GitHub-hosted Ubuntu runners: it verifies Docker and cgroup v2, installs `bpftrace` when necessary, and runs Limier with the privileges required for capture. Direct CLI and container-image users remain responsible for preparing the host.
+
+Use output-only mode only when kernel telemetry is intentionally unavailable:
 
 ```yaml
-evidence:
-  capture_host_signals: false
+telemetry:
+  mode: off
 ```
 
-Use a self-hosted Linux runner with `bpftrace` installed when you want full host telemetry.
+Output-only comparisons always require human review. A required telemetry failure produces `rerun` rather than silently reducing coverage.
 
 ## Run Limier From The Container Image
 
@@ -161,4 +165,4 @@ docker run --rm \
 
 If that command fails with a Docker socket permission error, make sure the host user already has access to `/var/run/docker.sock`. On Linux, a common fix is to add the Docker group inside the container with `--group-add "$(getent group docker | cut -d: -f3)"` alongside `--user`.
 
-For the easiest containerized setup, disable host-signal capture in the scenario.
+For the easiest containerized setup, use `telemetry.mode: off` and treat the result as requiring human review.