release: v0.8.0 — process lifecycle (ProcessExit + exit code)

sys_enter_exit_group → AgentEvent::ProcessExit {pid, exit_code}, pairing with ToolExec to
bracket a tool's lifecycle — you see outcomes (success/failure), not just that it ran.
Host-validated: exit 42 → {"exit_code":42}. Folds in the exec-ring headroom + fileguard
clippy fix. 0.7.0 -> 0.8.0.

Author: RoyLin

CHANGELOG.md

@@ -2,6 +2,21 @@
 
 All notable changes to a3s-observer will be documented in this file.
 
+## [0.8.0] — process lifecycle (exit + exit code)
+
+### Added
+
+- **`ProcessExit` event** — `sys_enter_exit_group` captures a process's exit + **exit code**,
+  pairing with `ToolExec` to bracket a tool's lifecycle (started → finished with this status).
+  You now see tool *outcomes* (did the command succeed / fail?), not just that it ran.
+  Host-validated: `exit 42` surfaced `{"exit_code":42}`. Catches clean exits (the C runtime's
+  `exit()` calls `exit_group`); signal kills don't.
+
+### Changed
+
+- Exec ring 256→512 KiB — the v0.7.0 argv buffer made `ExecEvent` ~928 B (6×), which had
+  halved the exec ring; restore headroom so a process burst doesn't drop. fileguard clippy-clean.
+
 ## [0.7.0] — richer tool observability (full argv + cwd)
 
 ### Added / Changed

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-observer"
-version = "0.7.0"
+version = "0.8.0"
 edition = "2021"
 license = "MIT"
 description = "General-purpose, language-agnostic eBPF observability for AI agents (LLM calls, tools, files, network egress)."

Cargo.toml

@@ -44,6 +44,7 @@ latency / TTFT, or plaintext) / **where** (peer IP / hostname).
 | signal | kernel hook | event |
 |---|---|---|
 | `exec` | `sys_enter_execve` | `ToolExec` — tool / subprocess: **full argv** + cwd, comm, uid |
+| `exit` | `sys_enter_exit_group` | `ProcessExit` — tool outcome + **exit code** (clean exits) |
 | `connect` | `sys_enter_connect` | `Egress` — peer IP:port |
 | `sni` | TLS ClientHello (plaintext `server_name`) | LLM **provider** + endpoint |
 | `dns` | `sendto` / `sendmsg` / `sendmmsg` to :53 | `Dns` — resolved hostname |

README.md

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-observer-collector"
-version = "0.7.0"
+version = "0.8.0"
 edition = "2021"
 license = "MIT"
 description = "a3s-observer collector: loads the eBPF probes and exports enriched events."

a3s-observer-collector/Cargo.toml

@@ -11,7 +11,7 @@ use a3s_observer::{
     KubeResolver, LogExporter, Provider, ServiceClassifier, SniClassifier,
 };
 use a3s_observer_common::{
-    ConnectEvent, DnsEvent, ExecEvent, FileEvent, LlmEvent, SslEvent, TlsEvent,
+    ConnectEvent, DnsEvent, ExecEvent, ExitEvent, FileEvent, LlmEvent, SslEvent, TlsEvent,
 };
 use anyhow::Context as _;
 use aya::{
@@ -57,6 +57,7 @@ async fn main() -> anyhow::Result<()> {
     let files = std::env::var_os("A3S_OBSERVER_FILES").is_some();
     let mut probes = vec![
         ("exec", "sys_enter_execve"),
+        ("proc_exit", "sys_enter_exit_group"),
         ("tls_write", "sys_enter_write"),
         ("tls_sendto", "sys_enter_sendto"),
         ("connect", "sys_enter_connect"),
@@ -129,6 +130,10 @@ async fn main() -> anyhow::Result<()> {
     // closes (the in-kernel LlmEvent) to build the metric-bearing LlmCall.
     let mut llm_meta: HashMap<u64, (Option<String>, Option<Provider>, IpAddr)> = HashMap::new();
     let mut exec_ring = RingBuf::try_from(ebpf.take_map("EVENTS").context("`EVENTS` missing")?)?;
+    let mut exit_ring = RingBuf::try_from(
+        ebpf.take_map("EXIT_EVENTS")
+            .context("`EXIT_EVENTS` missing")?,
+    )?;
     let mut tls_ring = RingBuf::try_from(
         ebpf.take_map("TLS_EVENTS")
             .context("`TLS_EVENTS` missing")?,
@@ -194,6 +199,7 @@ async fn main() -> anyhow::Result<()> {
                     .unwrap_or(0);
                 tracing::info!(
                     exec = stats.exec,
+                    exit = stats.exit,
                     egress = stats.egress,
                     dns = stats.dns,
                     file = stats.file,
@@ -222,6 +228,18 @@ async fn main() -> anyhow::Result<()> {
                         });
                     }
                 }
+                while let Some(item) = exit_ring.next() {
+                    if let Some(ev) = read_pod::<ExitEvent>(&item) {
+                        emit(exporter.as_ref(), &mut stats, EnrichedEvent {
+                            identity: identity_for(&resolver, ev.pid, &ev.comm),
+                            provider: None,
+                            event: AgentEvent::ProcessExit {
+                                pid: ev.pid,
+                                exit_code: ev.exit_code,
+                            },
+                        });
+                    }
+                }
                 // Drain connect BEFORE tls so a same-poll ClientHello finds its peer.
                 while let Some(item) = connect_ring.next() {
                     if let Some(ev) = read_pod::<ConnectEvent>(&item) {
@@ -347,6 +365,7 @@ async fn main() -> anyhow::Result<()> {
     }
     tracing::info!(
         exec = stats.exec,
+        exit = stats.exit,
         egress = stats.egress,
         dns = stats.dns,
         file = stats.file,
@@ -432,6 +451,7 @@ fn identity_for(r: &impl IdentityResolver, pid: u32, comm: &[u8; 16]) -> Identit
 #[derive(Default)]
 struct Stats {
     exec: u64,
+    exit: u64,
     egress: u64,
     dns: u64,
     file: u64,
@@ -443,6 +463,7 @@ struct Stats {
 fn emit(exporter: &dyn Exporter, stats: &mut Stats, ev: EnrichedEvent) {
     match &ev.event {
         AgentEvent::ToolExec { .. } => stats.exec += 1,
+        AgentEvent::ProcessExit { .. } => stats.exit += 1,
         AgentEvent::Egress { .. } => stats.egress += 1,
         AgentEvent::Dns { .. } => stats.dns += 1,
         AgentEvent::FileAccess { .. } => stats.file += 1,

a3s-observer-collector/src/main.rs

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-observer-common"
-version = "0.7.0"
+version = "0.8.0"
 edition = "2021"
 license = "MIT"
 description = "Shared no_std types crossing the eBPF <-> userspace boundary for a3s-observer."

a3s-observer-common/Cargo.toml

@@ -25,6 +25,17 @@ pub struct ExecEvent {
     pub args: [[u8; ARG_LEN]; ARGV_SLOTS], // argv[0..argc], each NUL-terminated
 }
 
+/// A process exit (`sys_enter_exit_group`) — the other end of the tool lifecycle, carrying the
+/// exit status so tool *outcomes* are visible (did the command succeed?), not just that it ran.
+/// Catches clean exits (the C runtime's `exit()` calls `exit_group`); signal kills don't.
+#[repr(C)]
+#[derive(Clone, Copy)]
+pub struct ExitEvent {
+    pub pid: u32,
+    pub exit_code: u32, // exit_group status; the low byte is the code passed to exit()
+    pub comm: [u8; 16],
+}
+
 /// The leading bytes of an outbound TLS ClientHello, captured at the send syscall.
 ///
 /// The eBPF side only detects + copies (verifier-friendly); userspace parses the SNI

a3s-observer-common/src/lib.rs

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-observer-ebpf"
-version = "0.7.0"
+version = "0.8.0"
 edition = "2021"
 license = "MIT"
 publish = false

a3s-observer-ebpf/Cargo.toml

@@ -2,8 +2,8 @@
 #![no_main]
 
 use a3s_observer_common::{
-    ConnectEvent, DnsEvent, ExecEvent, FileEvent, LlmEvent, SslEvent, TlsEvent, ARGV_SLOTS,
-    ARG_LEN, DNS_SNAP_LEN, PATH_SNAP_LEN, SSL_SNAP_LEN, TLS_SNAP_LEN,
+    ConnectEvent, DnsEvent, ExecEvent, ExitEvent, FileEvent, LlmEvent, SslEvent, TlsEvent,
+    ARGV_SLOTS, ARG_LEN, DNS_SNAP_LEN, PATH_SNAP_LEN, SSL_SNAP_LEN, TLS_SNAP_LEN,
 };
 use aya_ebpf::{
     helpers::gen::bpf_probe_read_user,
@@ -21,6 +21,9 @@ use aya_ebpf::{
 #[map]
 static EVENTS: RingBuf = RingBuf::with_byte_size(512 * 1024, 0);
 
+#[map]
+static EXIT_EVENTS: RingBuf = RingBuf::with_byte_size(64 * 1024, 0);
+
 #[map]
 static TLS_EVENTS: RingBuf = RingBuf::with_byte_size(256 * 1024, 0);
 
@@ -145,6 +148,28 @@ fn try_exec(ctx: &TracePointContext) -> Result<u32, i64> {
     Ok(0)
 }
 
+// ---- process exit (sys_enter_exit_group) — the tool's outcome / exit code ----
+
+#[tracepoint]
+pub fn proc_exit(ctx: TracePointContext) -> u32 {
+    try_proc_exit(&ctx).unwrap_or(0)
+}
+
+fn try_proc_exit(ctx: &TracePointContext) -> Result<u32, i64> {
+    let Some(mut entry) = reserve_or_drop::<ExitEvent>(&EXIT_EVENTS) else {
+        return Ok(0);
+    };
+    let ev = entry.as_mut_ptr();
+    unsafe {
+        (*ev).pid = (bpf_get_current_pid_tgid() >> 32) as u32;
+        (*ev).comm = bpf_get_current_comm().unwrap_or_default();
+        // sys_enter_exit_group: `long error_code` at offset 16 (low byte = the exit() code).
+        (*ev).exit_code = ctx.read_at::<u64>(16).unwrap_or(0) as u32;
+    }
+    entry.submit(0);
+    Ok(0)
+}
+
 // ---- TLS ClientHello on send (sys_enter_write / sys_enter_sendto) ----
 //
 // Both tracepoints share arg layout: buf @ offset 24, count @ offset 32. The probe only