Robustness, platform and performance fixes for the next Netdata vendoring

.agents/skills/project-netdata-vendoring/SKILL.md

@@ -168,17 +168,64 @@ Load this skill for any task involving:
    If any downstream vendored-source change is not understood, do not run
    `vendor-to-netdata.sh`.
 
-7. Record the CI/scanner preflight in the active SOW before vendoring.
+7. Assess performance impact (AGENTS.md, Test Cadence).
+
+   Benchmarks take hours; run them only when the vendored changes can affect
+   established-session steady state. Collect the SOW gate performance
+   assessments for every source change since the baseline (step 5), and
+   record in the active SOW whether any changed code runs per request on an
+   established session, with file:line evidence.
+
+   - No such change (connection setup, reconnect, error mapping, idle-timeout
+     paths, shutdown, tests, docs, build): no benchmark run; record the
+     assessment.
+   - Such a change exists: run the affected suites once on the candidate
+     commit:
+
+     ```bash
+     # Measure (run-*), then render the report and check floors (generate-*).
+     bash tests/run-posix-bench.sh benchmarks-posix.csv
+     bash tests/generate-benchmarks-posix.sh
+     # On the Windows host:
+     bash tests/run-windows-bench.sh benchmarks-windows.csv
+     bash tests/generate-benchmarks-windows.sh
+     ```
+
+     Compare against the committed CSVs (`git diff`). If rows regress beyond
+     noise, fix all regressions, then rerun once; bisect by SOW commit.
+   - Assessment uncertain: ask the user before running anything.
+
+   A regression that is neither fixed nor explicitly accepted by the user
+   blocks vendoring.
+
+   Extended suites (fuzz, stress, randomized chaos, lookup scale) are not
+   part of correctness runs. Run them once on the candidate commit when the
+   vendored changes touch what they exercise (codecs and decoders for fuzz;
+   concurrency, session lifecycle or transports for stress), and record the
+   result or the reason none was needed:
+
+   ```bash
+   bash tests/run-extended-fuzz.sh
+   bash tests/run-extended-stress.sh
+   ```
+
+   A failure blocks vendoring until it is fixed.
+
+8. Record the CI/scanner preflight in the active SOW before vendoring.
 
    Include:
 
    - source repository and commit;
    - GitHub Actions/check-run summary;
    - code-scanning summary by tool and severity;
    - Dependabot and secret-scanning summary;
+   - Go version alignment: the `go` directive in the three plugin-ipc
+     `go.mod` files equals Netdata's `src/go/go.mod`, and `GoVersionOverride`
+     in the three `osv-scanner.toml` files equals the patch release Netdata
+     pins in `packaging/check-for-go-toolchain.sh`; fix any mismatch first;
    - decision: proceed, block, or proceed with explicit risk acceptance.
 
-8. Only after the CI/scanner preflight and two-way migration plan pass, update
+9. Only after the CI/scanner preflight and two-way migration plan pass, update
    the Netdata vendored copy using the project-local vendor workflow.
 
    ```bash
@@ -187,14 +234,42 @@ Load this skill for any task involving:
    bash ./diff-netdata-vendor.sh /path/to/netdata
    ```
 
-9. Validate in the Netdata checkout.
+   `vendor-to-netdata.sh` prints the Go import-path rewrite but does not run
+   it, and `diff-netdata-vendor.sh` normalizes import paths, so it reports no
+   difference either way. Apply the rewrite in the Netdata checkout (no `.bak`
+   files), then confirm no upstream path is left:
+
+   ```bash
+   grep -rlZ 'github.com/netdata/plugin-ipc/go' src/go/pkg/netipc --include='*.go' |
+     xargs -0 -r sed -i 's|github.com/netdata/plugin-ipc/go|github.com/netdata/netdata/go/plugins|g'
+   grep -rl 'github.com/netdata/plugin-ipc/go' src/go/pkg/netipc   # expect no output
+   ```
+
+10. Validate in the Netdata checkout.
 
    Run the targeted Netdata build/tests required by the active SOW. At minimum,
    prove:
 
    - the vendor diff is expected after copying;
    - Netdata-only wrapper files were not overwritten;
-   - unrelated Netdata files were not staged or modified by the vendoring step.
+   - unrelated Netdata files were not staged or modified by the vendoring step;
+   - every vendored `.c` file is in Netdata's build lists
+     (`src/libnetdata/SourceLists.cmake`), and every system library the new
+     code calls is linked to the `netipc` target in
+     `src/libnetdata/CMakeLists.txt` (the script does not edit either file);
+   - the Netdata build reports no warning in vendored NetIPC sources. Netdata
+     compiles them with `-O2 -D_FORTIFY_SOURCE=3`, which plugin-ipc's own
+     builds do not enable, so check this before pushing the source commit:
+
+     ```bash
+     cmake -S . -B .tmp/fortify-build -DCMAKE_BUILD_TYPE=Release \
+       -DCMAKE_C_FLAGS="-O2 -D_FORTIFY_SOURCE=3 -Wall -Wextra"
+     cmake --build .tmp/fortify-build 2>&1 | grep 'src/libnetdata.*warning:'
+     ```
+
+   Netdata builds `netipc` on Linux and Windows only; the Windows build is
+   proven by the Netdata PR's "Build Windows" check, so the SOW stays open
+   until that check passes.
 
 ## Blockers
 
@@ -210,6 +285,8 @@ Stop and report if any of these are true:
 - either side has NetIPC changes since the last vendoring that are not
   understood;
 - the active SOW does not contain a migration plan for both directions;
+- the performance assessment is missing, or a benchmark run it called for
+  shows a regression that is neither fixed nor explicitly accepted by the user;
 - source tree has uncommitted changes that are intended for vendoring;
 - Netdata checkout has unrelated changes that would be hard to isolate.
 
@@ -228,5 +305,7 @@ Netdata vendoring preflight:
 - Upstream gap: <summary of plugin-ipc changes since baseline>
 - Downstream gap: <summary of Netdata vendored changes since baseline>
 - Migration plan: <preserve/backport/overwrite/decision summary>
+- Performance: <assessment; benchmark run or why none was needed; regressions fixed/accepted/none>
+- Extended suites: <fuzz/stress run and result, or why none was needed>
 - Decision: proceed | blocked | proceed with user-accepted risk
 ```

.agents/sow/current/SOW-0021-20260613-netipc-at-scale.md

@@ -1359,7 +1359,7 @@ Pending.
 
 ## Followup
 
-None yet.
+- 2026-10-31: the Netdata consumer steps of the "Downstream Vendoring Plan" (step 7: OVERSIZED_ITEM / PAYLOAD_EXCEEDED handling and status names) were never done; the statuses are already vendored in Netdata. They are now tracked in SOW-0050, including a confirmed network-viewer caching bug. This SOW closes after the pre-vendoring full POSIX and Windows benchmark run and after the remaining broader adversarial matrix gaps are handled (Execution Log, artifact gate entry).
 
 ## Regression Log
 

.agents/sow/current/SOW-0015-20260605-codacy-scope-and-maintainability.md → .agents/sow/done/SOW-0015-20260605-codacy-scope-and-maintainability.md

@@ -2,9 +2,9 @@
 
 ## Status
 
-Status: paused
+Status: completed
 
-Sub-state: paused by user decision on 2026-06-11 so `SOW-0016` can take current active slot for a timeout/abort liveness fix. Resume from Codacy test/bench exclusion and refreshed production-source maintainability baseline work.
+Sub-state: closed 2026-10-31 after refreshing the metrics and selecting the next target; the continuing file-by-file work moves to SOW-0057 and the Go version drift to SOW-0058.
 
 ## Requirements
 
@@ -1082,19 +1082,30 @@ Lessons:
 
 Follow-up mapping:
 
-- Netdata re-vendor work is planned in this SOW and will be performed after the SDK commit is pushed.
+- Netdata re-vendor work from this SOW shipped in later vendorings (`netdata/netdata#22936`, merged 2026-07-01, closed in SOW-0027).
+
+### 2026-10-31 close-out
+
+- Codacy Cloud, public API, `main` `63919ecb7d` (2026-09-27): grade A (99), 33 issues, 60453 LOC (tests and benchmarks excluded by `.codacy.yml` `exclude_paths`, which Cloud honors), coverage 90.6%, complex files 32%, duplicated files 32% (baseline at `dbf77a8595`: 42% / 41%, with tests counted). Goals: 10% / 10%.
+- The 33 issues are all Trivy Go standard-library findings on `go.mod` (`go 1.26.0`); Netdata has since moved to `go 1.27.0`, so the version rule this SOW recorded is now out of date: tracked in SOW-0058.
+- Next target, by evidence: `jscpd --min-tokens 50` over production sources (branch tip `dbfa64a`) finds 9.6% duplicated lines; the largest pair is Rust `transport/windows.rs` (745 lines) / `transport/posix.rs` (577). Tracked with the full ranking in SOW-0057.
 
 ## Outcome
 
-Pending.
+Codacy metrics now cover production code only (tests and benchmarks excluded through `.codacy.yml`, which Cloud honors). Complex files fell from 42% to 32% and duplicated files from 41% to 32%. The next production target is selected with evidence.
+
+Correction (2026-11-07, SOW-0070): the 42% / 41% baseline counted tests and the 32% / 32% result counts production code only, so the two do not measure the same scope; the result is a production-only rebaseline, not evidence that complexity or duplication fell.
 
 ## Lessons Extracted
 
-Pending.
+- Codacy Cloud reads path excludes from a root `.codacy.yml`, not from `.codacy/codacy.config.json`.
+- Codacy's duplicated-files metric counts any file with one duplicated block, so it stays far above line-level duplication (32% of files vs 9.6% of lines here); pick targets by duplicated lines, then confirm with the Cloud metric.
 
 ## Followup
 
-None yet.
+- File-by-file duplication work: SOW-0057.
+- Go 1.27 alignment and the Trivy findings: SOW-0058.
+- Search of this SOW for defer/later/follow-up/future/TODO/pending: the July re-vendor plan (shipped, see above) and historical narrative.
 
 ## Regression Log
 

.agents/sow/current/SOW-0027-20260629-netdata-vendor-memory-safety-update.md → .agents/sow/done/SOW-0027-20260629-netdata-vendor-memory-safety-update.md

@@ -2,12 +2,11 @@
 
 ## Status
 
-Status: paused
+Status: completed
 
-Sub-state: paused on 2026-07-12 so SOW-0030 can take the active slot for the
-fleet-observed SHM SIGBUS crash. The earlier L3 API decision was resolved by using the
-direct L2 snapshot path; resume from final validation, artifact maintenance, review,
-and lifecycle closure for the already merged Netdata vendor update.
+Sub-state: closed 2026-10-31 on existing evidence: the Netdata vendor update merged on 2026-07-01 (`netdata/netdata#22936`). Paused 2026-07-12 for SOW-0030; resumed only for final validation and lifecycle closure.
+
+Correction (2026-11-07, SOW-0070): no `diff-netdata-vendor.sh` result was recorded at close, so this record does not prove source-to-Netdata parity for `netdata/netdata#22936`. The next vendoring (SOW-0050) reconstructed the baseline from both repositories and records its own before and after vendor diffs.
 
 ## Requirements
 
@@ -287,7 +286,8 @@ Acceptance criteria evidence:
 - Source post-backport preflight completed before Netdata vendoring: CI/checks, GitHub code scanning, Dependabot, secret scanning, and Codacy Cloud were checked for `bb7a73e0e2b871352eeb3c4403afbd69649a351d`.
 - Two-way gap analysis completed before vendoring and recorded in the 2026-07-01 execution log.
 - Valid Netdata-only vendored-source drift was backported to `plugin-ipc` before any Netdata copy.
-- Netdata vendoring is implemented in the target checkout and the eBPF L2 adaptation builds; the first PR commit exposed CI/scanner findings that are being fixed source-first before re-vendoring.
+- Netdata vendoring is implemented in the target checkout and the eBPF L2 adaptation builds; the first PR commit exposed CI/scanner findings, fixed source-first before re-vendoring.
+- Final state (checked 2026-10-31, read-only `gh`): `netdata/netdata#22936` "Update vendored NetIPC to 98ec474" merged 2026-07-01T13:51:31Z, head `e5f57a1e93`, merge commit `ca9a5426a6`. The vendored source commit `98ec474` is an ancestor of plugin-ipc `HEAD`.
 
 Tests or equivalent validation:
 
@@ -298,7 +298,9 @@ Tests or equivalent validation:
   - `git diff --check`;
   - SOW audit.
 - GitHub/Codacy validation for the new source backport commit passed as recorded above.
-- Source-side CI/scanner repair validation passed locally as recorded in the 2026-07-01 execution log. Remote source CI/scanner validation is pending until the repair commit is pushed.
+- Source-side CI/scanner repair validation passed locally as recorded in the 2026-07-01 execution log.
+- Remote source checks on the vendored commit `98ec474`: 46 check runs succeeded; `Valgrind` was skipped on the 2026-07-01 run and a later 2026-07-07 run was cancelled: the run that gated vendoring skipped it, and the cancelled run came six days after the merge. Open GitHub code-scanning alerts on plugin-ipc: 0 (2026-10-31).
+- PR check snapshot (2026-10-31): 107 pass, 20 skipping, 20 fail. All 20 failures are `Build / Test Source Build (...)` jobs that completed about two hours after the merge (e.g. check run 84540364193, completed 15:52 UTC) and failed in Docker buildx with "repository does not contain ref refs/pull/22936/merge": a post-merge re-run against a deleted merge ref, not a code failure.
 
 Real-use evidence:
 
@@ -308,7 +310,7 @@ Real-use evidence:
 
 Reviewer findings:
 
-- Not started.
+- No external review. Netdata maintainers reviewed and merged the PR.
 
 Same-failure scan:
 
@@ -326,7 +328,7 @@ Artifact maintenance gate:
 - Specs: no update needed until implementation changes behavior.
 - End-user/operator docs: no update needed until implementation changes behavior.
 - End-user/operator skills: no update needed until implementation changes behavior.
-- SOW lifecycle: moved from pending to current before source backport and Netdata vendoring; remains in progress until Netdata commit, post-vendor checks, and final review are complete.
+- SOW lifecycle: moved to `done/` at close. The `umask()` suppressions added during the scanner repair are superseded by SOW-0032, which removed the `umask()` calls.
 
 Specs update:
 
@@ -354,15 +356,16 @@ Follow-up mapping:
 
 ## Outcome
 
-In progress. Source backport and pre-vendor checks are complete, Netdata vendoring is copied, and the eBPF consumer now builds against the vendored opaque NetIPC cache API by using direct L2 snapshot access. Draft PR `netdata/netdata#22936` is open; its first commit exposed Go fix, Codacy, and Sonar findings that are being repaired source-first before re-vendoring. Post-vendor CI/scanner checks and final SOW closure are not complete yet.
+Completed. The NetIPC memory-safety fixes reached Netdata through the source-first vendoring path: Netdata-only drift was backported, the CI and scanner findings from the first PR commit were fixed in plugin-ipc, and `netdata/netdata#22936` (vendoring plugin-ipc `98ec474`, with the eBPF consumer switched to direct L2 snapshot access) merged on 2026-07-01.
 
 ## Lessons Extracted
 
 - Avoid adding a public L3 enumeration API only to satisfy a single-threaded periodic importer; first check whether the consumer is actually a hot multi-threaded lookup user or just a fetch/process pipeline.
 
 ## Followup
 
-None yet.
+- Later NetIPC changes reach Netdata through SOW-0050.
+- Search of this SOW for defer/later/follow-up/future/TODO/pending: remaining matches are historical narrative (the July "pending" states, now resolved above) and the SOW-0050 reference.
 
 ## Regression Log
 

.agents/sow/pending/SOW-0031-20260712-linux-shm-build-gating.md → .agents/sow/done/SOW-0031-20260712-linux-shm-build-gating.md

@@ -2,10 +2,11 @@
 
 ## Status
 
-Status: open
+Status: closed
 
-Sub-state: tracked follow-up discovered by SOW-0030; execution must wait until the
-active SOW completes.
+Sub-state: merged into SOW-0048 (FreeBSD support) on 2026-10-31, before any
+implementation. Its requirements and acceptance criteria live there; the FreeBSD build
+is where the `NOT APPLE` gate fails.
 
 ## Requirements
 
@@ -173,6 +174,11 @@ Open decisions:
 - Created as the real pending follow-up for the CMake/platform-contract discrepancy
   discovered during SOW-0030 research.
 
+### 2026-10-29
+
+- Overlap recorded: SOW-0048 (FreeBSD support) includes this C SHM build-gating fix;
+  merge the two before implementation.
+
 ## Validation
 
 Acceptance criteria evidence:
@@ -225,11 +231,13 @@ Lessons:
 
 Follow-up mapping:
 
-- This file is the tracked follow-up from SOW-0030.
+- All requirements are tracked by SOW-0048.
 
 ## Outcome
 
-Pending.
+Closed without implementation: merged into
+`.agents/sow/current/SOW-0048-20261029-freebsd-support.md`, as the overlap note of
+2026-10-29 required (AGENTS.md "One SOW At A Time": merge before implementation).
 
 ## Lessons Extracted