operations-dlp-agent

Host DLP sensor agent: runs operations-dlp-sensor sources, enqueues masked findings to a durable local SQLite queue (bounded, drop-oldest), and pushes them to the server ingest API with at-least-once retry. Masked-only by default; raw never leaves the host.

What it is for

operations-dlp-agent — the host DLP sensor agent.

Runs a operations_dlp_sensor source (clipboard by default), scans locally, enqueues masked DlpFindingEnvelopes to a durable SQLite queue, and a sender loop pushes them to the server ingest API with at-least-once retry. Masked-only: raw never touches disk or the wire. The queue is bounded + drop-oldest so it cannot fill the disk or block the host.

Config (env): DLP_SERVER_URL e.g. http://127.0.0.1:8788 (required) DLP_API_KEY the agent's api key (bearer) (required) DLP_TENANT_ID the agent's tenant uuid (required; must match its registration) DLP_DEVICE_ID the agent's device id (default "unknown-device") DLP_QUEUE_PATH sqlite path (default "./dlp-agent-queue.sqlite") DLP_HMAC_KEY optional keyed-fingerprint secret DLP_QUEUE_CAP max buffered findings (default 10000)

Capabilities

No public items.

How to use it

No examples/ target and no doctest in this crate's rustdoc. The tests listed under Verification are the closest executable usage.

Module structure

No public modules: the crate root is its whole surface.

Public surface

No public items.

No pub use re-exports: every item above is declared in this crate.

Boundary

Reaches into infrastructure.

Shares tier operations with 40 other crates: operations-approval-workflow, operations-assessments, operations-block-imaging, operations-boot-media, operations-browser-agent-worker, operations-camera-discovery, operations-camera-liveview, operations-camera-registry, … (40 total).

_What this crate deliberately does NOT own is a judgment. No committed registry records one for it, so none is stated here._

Where it sits

Tier flow. Which tiers this crate's own edges cross.

flowchart LR
  n_operations["operations"] --> n_infrastructure["infrastructure"]

Dependencies

Runtime, in this workspace.

Runtime, from outside the workspace.

Development. None.

Build. None.

Depended on by. Nothing in this workspace.

Signal flow — what reaches this crate, and what it reaches.

flowchart LR
  SELF["operations-dlp-agent"]
  SELF -->|runtime| n_infrastructure_dlp["infrastructure-dlp"]
  SELF -->|runtime| n_infrastructure_dlp_detect["infrastructure-dlp-detect"]
  SELF -->|runtime| n_infrastructure_ocr_engine["infrastructure-ocr-engine"]
  SELF -->|runtime| n_infrastructure_ocr_tesseract["infrastructure-ocr-tesseract"]
  SELF -->|runtime| n_operations_dlp_sensor["operations-dlp-sensor"]
  classDef self fill:#1f883d,stroke:#1f883d,color:#fff;
  class SELF self;

Feature flags

flowchart LR
  n_default["default"]
  n_screen["screen"] --> n_operations_dlp_sensor_screen["operations-dlp-sensor/screen"]
  n_screen["screen"] --> n_dep_infrastructure_ocr_tesseract["dep:infrastructure-ocr-tesseract"]
  n_screen["screen"] --> n_dep_infrastructure_ocr_engine["dep:infrastructure-ocr-engine"]

Targets

Error model

No public error type was detected: no public item declares a type named *Error, and no public signature returns one.

Operational characteristics

No unsafe block, unsafe fn, unsafe impl or unsafe trait was found by the parser anywhere in this crate's source.

Configuration

Related capabilities

No workspace crate depends on this one.

Verification

What the tests establish, by name:

• drop_oldest_at_capacity — src/queue.rs
• durable_across_reopen — src/queue.rs
• fifo_peek_and_delete — src/queue.rs

Documentation coverage

Metrics

pie showData
    title Rust source composition
    "Code" : 270
    "Blank or comment" : 70

Generation

Rendered by tools-corpus corpus readme from repository evidence alone, renderer schema 2, lexicon current. No model, network service or database was consulted. Regenerate with tools-corpus corpus readme --write; verify with --check.