Skip to content

ADR-0094 — PURE.Art Discovery Hub + PVI/PVP/PIE-PA wave

  • Status: Accepted
  • Date: 2026-05-24
  • Deciders: André Luiz Gallon
  • Module: MÓDULO PURE.Art (pkg/pure-art/)
  • Slot: OOBI VXLAN .74 (k8s/oobi/74-pure-art.yaml)
  • Wave: PURE-1 + PURE-2 + PURE-3 + PURE-4 + PURE-5 + PURE-6 (6 sub-PRs, ~7800 LoC, 189 Go tests)
  • Strategy memo: discuss_pure_real_url_replay_2026_05_10.md
  • Related ADRs: ADR-0086 (VALIDATOR.Art Phase A) · ADR-0092 (RELAY.Art Phase A) · ADR-0093 (RELAY.Art Phase B) · ADR-0085 (TREX.Art) · ADR-0036 (HyperBridge.Art) · ADR-0084 (HAR.Art) · ADR-0081 (DoYour.Art)
  • Patent claim: #13 (DOM/OOBI/GATEWAY/RELAY/PURE family — 13 total claims)

Context

The first six Test Kinds available in TLSStress.Art (TLS Decrypt, Branch Office, Inspection Profile, VPN SDWAN / DIA, VPN PQC, Cluster Test) all hit our internal Synthetic and Cloned Personas. That works for greenfield + lab certifications, but it doesn't answer the production validation question customers actually ask: "how does my NGFW behave against the real sites my users visit?"

Real public URLs through the customer's prod DUT means real Akamai/Cloudflare/AWS edges, real cipher diversity, real cert-chain complexity, real HTTP/3 negotiation. Synthetic and Cloned can't replicate this. Spirent/Keysight/Ixia can't either — their addressing assumes lab isolation.

The catch is safety. Personas in v4.3 use public IP space (200.130.x.x — NRENs / hosters per project_personas_v43_public_ip_2026_05_13). That creates four real risk vectors when running PURE in production:

  1. BGP route leak — control-plane stress advertisements leak persona prefixes upstream → real customer traffic routed to us → accidental MITM
  2. DNS collision — customer recursive resolves real domain to persona IP → wrong target
  3. Persona-CA cert TLS MITM — Cloned Persona for www.amazon.com.br has a valid cert from persona-ca-issuer → if NGFW trusts that CA (it does, per design), browser silently accepts → transparent TLS MITM
  4. NGFW URL filter category-IP mapping misroutes

Without a safety perimeter, PURE is unsafe to ship. The whole wave is shaped by the answer to that risk.

Decisions

12 locked decisions across the 6 sub-PRs:

  1. 7-source Discovery Hub, priority order F > A > B > C > D > E > G: SPAN port (live, richest) > Syslog > Vendor API > PCAP > HAR > Pre-curated > Cloud Endpoint (complementary). Memo addendum 2026-05-10 evening.

  2. Adapter pattern continues — Disabled / Fake / real per source: Same triple that worked for VALIDATOR.Art / TBI / RELAY.Art. Operator flips real on per source when ready.

  3. NormalizeURL is the catalog primary key: lowercase host + strip default ports + drop fragment + sort query keys + trim trailing slash on non-root paths + promote bare hostnames to https://. eTLD+1 collapse defers to PURE-3-late (needs Public Suffix List).

  4. HAR original NEVER stored — only sanitised version: light / medium / aggressive aggressiveness. Audit log: SHA-256 of original + redaction counts + operator identity.

  5. PVI 3-stage cascade (K6 → PW → PW + stealth): Stage 1 is real HTTP probe today (PURE-3); Stages 2 + 3 defer to Phase B-late (require headless browser sidecar). MVP rule: clean Stage-1 200 → BothOK; WAF block → Skip; transport error → Unknown.

  6. PVI runs through CLONER egress, NEVER through customer prod DUT: Memo §"Network path" — PVI's job is "does this URL work in general internet". DUT-specific delta is PVP's job.

  7. WAF signature library — 16 signatures + case-insensitive substring + optional header check: Akamai / Cloudflare / Imperva / DataDome / PerimeterX / F5 Shape / Sucuri + reCAPTCHA / hCaptcha / Turnstile. Most-specific first.

  8. PVP runs BEFORE PIE-PA apply: Step 4 before Step 6 of memo's full pipeline. Avoids tearing down personas if URLs already broken through this DUT — auto-aborts if issues/total > IssueRatio (default 0.20).

  9. PIE-PA = 3-layer defense-in-depth, MANDATORY in production: Pod scale-to-0 + BGP advertisement withdrawal + DNS sanity check. Any layer failure → atomic rollback of prior layers. CascadingPIEPA mutex-serialised. DisabledPIEPA in non-production blocks PURE explicitly.

  10. Persona public-IP space is the load-bearing risk model: Layer 3 DNS sanity check resolves external + internal for each URL and HARD ABORTS (ErrDNSCollision) if any resolved IP lives in PersonaPrefixCIDR. Operator must adjust persona IP scheme OR skip the URL — no override path (memo §"Hard abort").

  11. Staleness gates — 30d Warning / 60d Stale / 90d Critical (hard gate): 90+ days requires explicit OverrideStalenessHardGate flag, which adds stale-list-acknowledged to Plan.AuditFlags. Per-test SHA-256 provenance stamp = same test 1y+ later → re-downloadable + reproducible.

  12. Test execution itself is OUT of PURE's scope: PURE is the enablement MÓDULO. PW.Art / K6.Art existing engines do the actual load. PURE hands them a vetted URL list + a PIE-PA snapshot for restore, then waits. Restore is the mandatory caller responsibility after test.

Consequences

Positive

  • Differentiated test kind no competitor offers: Spirent / Keysight / Ixia can't run against real internet through a real customer DUT — their addressing model assumes lab isolation.
  • Safety perimeter is patentable: Claim #13 §"defense-in-depth in-bench resource isolation (3 layers)" is genuinely novel. None of HashiCorp Vault / Akamai / Cloudflare / Spirent / Keysight / Ixia have anything comparable.
  • Operator-facing UX is simple despite the complexity: 1 page (/admin/pure-art) shows the ranked catalog + filters + revalidate button. The 8-step pipeline runs underneath with zero kubectl exposure (CLAUDE.md invariant: "Dashboard is the ONLY operator interface").
  • Air-gap installs are first-class: Bundled Tranco Top-100 snapshot ships with the MÓDULO; BundledFetcher is the air-gap fallback per memo §"Air-gap fallback" #1.
  • PVI baselines feed PVP delta: Single source of truth for "what was the latency before the DUT" eliminates the "is this slow because of DUT or because of upstream" ambiguity.

Negative

  • PVI Stages 2 + 3 (PW + PW stealth) are deferred: MVP runs Stage-1 HTTP probe only. URLs blocked by Akamai/Cloudflare/Imperva get RecSkip until the headless browser sidecar lands (Phase B-late). Workaround: operator can override OperatorForceVisible=true per-URL and use HAR replay instead.
  • PIE-PA SimulatedBackend doesn't actually pause pods or withdraw BGP: Audit-only at MVP. Real K8sApplierBackend + VyOSBackend + MiekgDNSBackend land Phase B-late. DisabledPIEPA blocks PURE in production until the real backend is wired.
  • CategorIzer is a hand-coded dictionary: ~140 hostname suffixes covering BR + global. Will become stale; eventually replaced by VALIDATOR ML cortex fn #9 (per discuss_module_validator_tbi_2026_05_10).
  • PCAP scope MVP-only: Plain PCAP; PCAPNG defers to PURE-3+ (needs gopacket). TLS 1.3 ESNI extraction defers similarly.

Alternatives considered

  • Don't ship PURE — keep Synthetic+Cloned only: Rejected. Production validation is the #1 differentiator vs Spirent/Keysight/Ixia. Patent claim #13 (DOM/OOBI/GATEWAY/RELAY/PURE family) requires this.
  • Skip PIE-PA and just trust BGP/DNS scheme: Rejected. Memo §"PIE-PA — Persona Auto-Pause" Layers #1 + #3 are real-incident risks, not theoretical. Auditor would never approve.
  • Single-stage PVI (just K6, no PW cascade): Rejected. Bot defense (Akamai/Cloudflare/Imperva/DataDome) blocks K6 routinely — without PW fallback we'd skip 60%+ of the Top-100. Stages 2+3 are deferred but the slot is in the schema.
  • Embed Postgres for the URL catalog at MVP: Rejected for PURE-1. In-memory ring is simpler + sufficient for working-set sizes. PURE-3 swaps in Postgres when persistence becomes load-bearing.
  • Cross-customer PVI cache: Memo open-question #3 leans NO; ADR locks it OFF by default (CrossCustomerCache=false). Privacy concern: we'd know which URLs different customers care about.

Compliance / governance

  • LGPD / GDPR: PURE only ingests URLs (no source IPs) post-RELAY PII strip; HAR upload runs Aggressive sanitiser by operator choice (memo §"HAR scrubber"); cross-customer cache OFF.
  • Audit trail: every PIE-PA layer transition + PVP run + Test Plan generation logged with operator identity + test_id + scope. PURE-6-late adds Drizzle persistence for the ring.
  • Per-test reproducibility: SHA-256 of source snapshot stamped in Plan.Provenance — supports compliance-grade "rerun the same test 1y later" requirement.

References