Epic: AE release — merge #89 (dark-vector canonical tables, pairs dx#129)

[entlein]

Superseded rewrite (2026-07-26). The first version sequenced a #68 → #73 → #77 → #78 AE stack plus #72/#76/#70, pinned to AE aeprod27 + dx integration7. That whole stack has already merged to main, and the AE line advanced aeprod27 → aeprod45. That body is void. The AE release is now a single PR — #89 — pairing with dx#129. This body replaces it.

Epic — agent-loopable. Every task has acceptance criteria that must be observed, not inferred.

Companion (dx side): entlein/dx#127 — release = merge dx#129 only. dx#129 was aligned to AE#89 by dx#130 (already merged).

---

The AE release = pixie#89 only

#89 (feat/ae-dark-tables-on-main) — restores dark-vector tracepoint table export onto main (8 dx_* tables); 28 files, +1371. This is the "AE#89 canonical tables" that dx#129 consumes. Its stack:

• AE deploys dark-vector bpftraces at boot and owns the tables (039d4bd3), auto-creates dc_snoop/creds_change/stack_trace (11848176)
• nanosecond-timestamp + single-auth invariants (4507bf9b); event_time nanos so the sink keeps DateTime64 (88ec050d)
• full k8s metadata enrichment (namespace/pod/container) incl. pid→pod for dc_snoop/creds_change (c80b4b64, 9786eef8)
• leader-election guard so cluster-scoped setup fires once (d6d31ae3), excludes our own infra pods (3b7688d9)

Latest AE build: 0.14.19-aeprod45. MERGEABLE against main as of 07-25 (re-check at merge time).

---

T1 — Regression-gate #89 on the release pair ⛔

• Rig running AE aeprod45 (adaptive_export: restore dark-vector tracepoint table export onto main (8 dx_* tables) #89) + dx 0.3.0-obf2 (dx#129); px get viziers CS_HEALTHY, AE healthz=ok
• All 8 dx_* dark tables auto-created at boot (leader elected once — no duplicate setup)
• Tracepoint rows carry full k8s metadata + pid→pod enrichment; timestamps are nanosecond DateTime64
• Rows persist past the 10m TTL window
• AE reconcile read == wrote == CH holds; scorecard archived at evidence/regression/release_dx129_ae89/ (shared with dx#127 T1)

T2 — Merge #89 to main

• T1 archived and green
• #89 re-checked mergeable at merge time
• Merged

T3 — Disposition of the other open pixie PRs (do NOT close blind)

Verified against main / #89 on 2026-07-26 — each diverged (carries unique commits not in the release):

• lint: fix arc-lint breakage on main (suite exclude + skaffold indent + copy.bara dup) #86 (lint fix on main) — diverged; decide fold-to-main vs keep; account for its commits before closing
• feat(ae): reattribute DNS via kubescape process tree (fixes #80) #81 (DNS reattribution) — diverged; has builds (aeprod29) but no test evidence; defer to a later release, record decision
• feat(experimental): dx on pure Linux — standalone PEM-direct showcase (fork-only, no copybara) #79 (standalone Linux showcase) — diverged; CHANGES_REQUESTED at head, validated 07-04; independent showcase, defer, record decision

---

Loop protocol

1. T1 gates T2. Nothing merges without the release-pair scorecard reproduced and archived (shared artifact with dx#127).
2. Do not tick a box you did not observe.
3. feat(ae): reattribute DNS via kubescape process tree (fixes #80) #81/feat(experimental): dx on pure Linux — standalone PEM-direct showcase (fork-only, no copybara) #79/lint: fix arc-lint breakage on main (suite exclude + skaffold indent + copy.bara dup) #86 all carry unique commits — none is a blind close; account for their content first.
4. Blocked → comment the blocker, move to the next unblocked task.