Skip to content

feat(w0-pr4): ghost detector — NIC collision substrate probe - #1535

Closed
POWERFULMOVES wants to merge 2 commits into
mainfrom
feat/w0-pr4-ghost-detector
Closed

POWERFULMOVES wants to merge 2 commits into
mainfrom
feat/w0-pr4-ghost-detector

Conversation

@POWERFULMOVES

Copy link
Copy Markdown
Owner

Summary

  • PR-3: glances-autodetect.ps1 — Windows hardware probe companion; auto-detects GPU, CPU, NIC, and system specs via glances JSON API; outputs structured YAML for W0 TAC tree consumption
  • PR-4: nic_collisions wiring — threads NIC collision counter into both Windows (.ps1) and Linux (.sh) probe scripts; ghost detector relies on collision delta to fingerprint phantom traffic

W0 Substrate Context

Part of the W0 substrate pipeline (PR-1 through PR-6). Current branch carries PR-3 + PR-4. The node-4090-probe skill (.claude/skills/node-4090-probe/SKILL.md) wraps this probe — full skill wiring lands in a companion PR (feat/shift-crew-4090-skills).

Test plan

  • Run deploy/provision/glances-autodetect.ps1 on 4090 node — verify YAML output contains gpu, cpu, nics, nic_collisions keys
  • Run .sh counterpart on Linux node — verify same structure
  • Confirm nic_collisions field is non-null and increments under load
  • Verify node-4090-probe skill SKILL.md references correct script paths after this merges

🤖 Generated with Claude Code

POWERFULMOVES and others added 2 commits May 14, 2026 22:30
Windows PowerShell equivalent of glances-autodetect.sh, emitting the same
JSON schema and --node-type suggestions for PMOVES.AI node onboarding.

Detection stack:
- OS/arch: Win32_OperatingSystem + PROCESSOR_ARCHITECTURE
- CPU: Win32_Processor + Win32_ComputerSystem.NumberOfLogicalProcessors
- RAM: Win32_ComputerSystem.TotalPhysicalMemory
- GPU: Win32_VideoController (PCI-only, virtual adapters filtered) + HKLM
  display driver registry for VRAM (WMI AdapterRAM capped at 4 GB)
- Disks: Get-PhysicalDisk with HDD/SSD detection
- NICs: Get-NetAdapter (Up only, Gbps/Mbps parse)
- Platform: Tailscale, Docker, WSL2, Hyper-V service checks

Node types: gpu-5090, gpu-4090, rdna4-workstation, dgx-spark,
            pve-member-fresh, desktop-workstation, unknown

Modes: interactive (default), --json, --json-file, --suggest, --help

Tested on 4090 laptop (i9-13980HX, 64 GB, RTX 4090 Laptop GPU):
  Suggested: gpu-4090 (high confidence)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add Get-NicCollisions (PS1) and detect_nic_collisions (bash) and wire
them fully into: JSON output (nic_collisions field), interactive report
(NIC Collision Check section with remediation link), and schema comments
(placeholder format, no hardcoded IPs).

Both scripts now emit nic_collisions: [{primary, ghost, subnet}] — empty
array on healthy hosts, populated when same-subnet ghost adapters are
detected per SAME_SUBNET_GHOST_PATTERN.md detection steps.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@coderabbitai

coderabbitai Bot commented May 18, 2026

Copy link
Copy Markdown
Contributor

Warning

Rate limit exceeded

@POWERFULMOVES has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 13 minutes and 25 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 9c2f4957-6d91-4b76-9265-e446df3e2952

📥 Commits

Reviewing files that changed from the base of the PR and between 4d29488 and 5966bc8.

📒 Files selected for processing (2)
  • deploy/provision/glances-autodetect.ps1
  • deploy/provision/glances-autodetect.sh
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch feat/w0-pr4-ghost-detector

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5966bc8fde

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines +236 to +240
$netKey = if ($pl -ge 24) {
"$($bytes[0]).$($bytes[1]).$($bytes[2]).0/$pl"
} elseif ($pl -ge 16) {
"$($bytes[0]).$($bytes[1]).0.0/$pl"
} else {

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Use true CIDR masking when grouping Windows subnets

Get-NicCollisions does not actually honor arbitrary prefix lengths: it builds subnet keys by truncating to whole octets (/24, /16, else /8), so prefixes like /23, /20, or /25 are grouped incorrectly. This can both miss real same-subnet adapter collisions and create false ones, which undermines the new ghost-detector output on non-/24 networks.

Useful? React with 👍 / 👎.

Comment on lines +447 to +449
primary = members[0]
for ghost in members[1:]:
print(f"{primary[0]}|{primary[1]}|{ghost[0]}|{ghost[1]}|{subnet}")

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Exclude same-interface aliases from ghost-collision output

The Linux collision detector treats every additional IP in the same subnet as a ghost regardless of interface identity, so a single NIC with multiple IPv4 addresses (IP aliasing/secondary IPs) is reported as a collision. In that common setup there is no competing adapter, so this produces false warnings and can trigger unnecessary remediation steps.

Useful? React with 👍 / 👎.

@POWERFULMOVES

Copy link
Copy Markdown
Owner Author

Closing as superseded — main already has both commits from this branch's intent under different SHAs:

Both feature paths landed via separate PRs while this branch was sitting. The conflict on deploy/provision/glances-autodetect.ps1 was add/add with main's version (509 lines) vs this branch (398 lines) — main is the canonical version going forward.

Codex/CodeRabbit P1/P2 findings on this PR are still valid bugs — they apply to main's version too:

  • P1 glances-autodetect.ps1:254-260 (Get-NicCollisions truncates to /24/16/8 instead of true CIDR mask)
  • P2 glances-autodetect.sh:442-449 (Linux detector flags same-interface IP aliases as ghosts)

Filing a follow-up PR against main shortly to apply both fixes directly. 5090-CLAUDE cross-lane on behalf of W0 substrate (4090 / Z890 lane historically).

@POWERFULMOVES
POWERFULMOVES deleted the feat/w0-pr4-ghost-detector branch May 18, 2026 23:24
POWERFULMOVES added a commit that referenced this pull request May 19, 2026
…detector (#1537)

Addresses Codex P1 + P2 findings from PR #1535 (closed as superseded by
#1476+#1481). Same bugs apply to main's version, so fixing directly.

deploy/provision/glances-autodetect.ps1 (P1):
  Get-NicCollisions previously truncated network keys to whole-octet boundaries
  (/24, /16, /8) regardless of actual PrefixLength. This mis-grouped /23, /20,
  /25, etc. — missing real same-subnet adapter collisions on non-/24 networks
  and creating false ones on partial-octet masks. Now builds a true CIDR
  network mask via bitwise AND on each byte using the actual PrefixLength.

deploy/provision/glances-autodetect.sh (P2):
  The Python collision detector treated every additional IP in a subnet as a
  ghost regardless of interface identity. A single NIC with multiple IPv4
  addresses (IP aliasing / secondary IPs) was reported as a collision, even
  though no competing adapter exists. Now requires at least 2 distinct
  interfaces in the subnet group before flagging, and skips same-interface
  aliases inside the loop.

Verification (Linux fix, Python simulation):
  - same-iface alias only (eth0, eth0)            → 0 ghosts ✓
  - distinct-iface collision (eth0, eth1)         → 1 ghost  ✓
  - mixed: 1 alias + 1 ghost (eth0, eth0, eth1)   → 1 ghost  ✓

Cross-lane on behalf of W0 substrate (4090 / Z890 lane historically).

Co-authored-by: Shaela Bello <slbello@uncg.edu>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant