[thejefflarson]

Do not merge without operator review

This PR reverses a documented invariant (the counts-only / no-per-entity-labels metric convention). Per the task it is an operator decision and must not be merged by an agent.

What

Adds protector.engine.kev_reachable_findings, a per-pass counter that fires once per distinct entry workload that is:

• reachable — is_breach_relevant() (internet-facing entry) OR foothold.is_some() (a proven exploitable front door), and
• KEV-backed — its entry image runs a CVE with exploited_in_wild (the CISA KEV flag).

It carries per-finding entity labels:

label	source
k8s.namespace.name	entry NodeKey
k8s.workload.kind	entry NodeKey (workload/<ns>/<kind>/<name>)
k8s.workload.name	entry NodeKey
image.reference	new SecurityGraph::entry_image_reference (RunsImage walk)
cve.ids	entry image's exploited-in-wild CVE ids, sorted + joined into one value

The invariant reversal (ADR-0044)

Every prior instrument was counts-only: entity names were held to be attacker-influenceable, so a per-entity series was treated as a cardinality/DoS vector and the name went to a structured log instead. ADR-0044 records the operator judgment that this is over-cautious for a bounded single-operator homelab — forging workload/node/image names already implies cluster compromise, and routing a KEV hit straight to the workload/image outweighs the guard. The ADR names an explicit revisit trigger: on any large/multi-tenant cluster the bound fails and the removed guard is load-bearing again.

The coverage and narrowing-delta gauges stay counts-only (their docstrings are reworded to say this is because they have no use for an entity label, not because one is forbidden).

Terminology

"KEV" here is exploited_in_wild — not the runtime corroborated signal (ADR-0009) counted by protector.engine.corroborations. The two are unrelated predicates; the new metric does not key off corroborations.

Series shape

One series per distinct entry workload per pass (dedup by entry key — every label is entry-scoped, so an entry's several objective-chains would only inflate one series), and the CVE ids join into one cve.ids value. This is series hygiene, not a reinstated cap or entity-name guard; it does not bound how many distinct workloads may appear. A residual (series count grows with distinct KEV-reachable workloads over the retention window) is noted in the ADR as a consideration, not a control.

Supporting changes

• SecurityGraph::entry_image_reference — projects the image ref onto the finding (it wasn't before).
• NodeKey::workload_kind — the k8s-kind-segment accessor.
• The gate/dedupe lives in record_kev_reachable_findings so it is unit-testable and keeps mod.rs under the 1,000-line cap.

Tests / gates

• New unit test (in-memory exporter): emits the five entity labels for a KEV + internet-facing finding; emits nothing for a non-KEV internet finding or a KEV internal-only finding; two objective-chains on one KEV entry dedupe to one series of value 1.
• cargo fmt, cargo check, cargo clippy --all-targets -D warnings, cargo test all clean (1250 lib tests + integration binaries, including the file-size and self-containment guards).

🤖 Generated with Claude Code

https://claude.ai/code/session_013cYVqzH7Xfwea7fAozdQK7