Redflag/docs/Refactor_A_Series.md

# A-Series Refactor and Cleanup Report

**Date:** 2026-03-29
**Branch:** culurien
**Scope:** Dead code removal and ETHOS compliance from A-1, A-2, A-3 fix rounds

---

## Cleanup Tasks

### Task 1: Remove Dead queries.RetryCommand (DEV-019) — DONE

- **File:** `aggregator-server/internal/database/queries/commands.go:199-229`
- **Verification:** `grep -r "\.RetryCommand\|RetryCommand(" --include="*.go"` confirmed zero production callers. Only references are in test comments and handler methods (which are different functions).
- **Action:** Function removed (31 lines).

### Task 2: Remove security_settings.go.broken — DONE

- **File:** `aggregator-server/internal/api/handlers/security_settings.go.broken`
- **Verification:** File still existed after A-3 rename. The active `security_settings.go` was created as a rewrite, not a move.
- **Action:** `.broken` file deleted.

### Task 3: Remove Compiled Test Binaries — DONE

5 ELF binaries deleted from `aggregator-agent/`:
| File | Size |
|------|------|
| `agent` | 12.5 MB |
| `agent-test` | 11.9 MB |
| `test-agent-final` | 12.4 MB |
| `test-agent-fixed` | 12.4 MB |
| `test-redflag-agent` | 12.1 MB |

Total: ~61 MB of dead binaries removed.

Also deleted: `aggregator-agent/test_disk.go` (throwaway test file, `package main` with old import path).

**.gitignore updated** with rules:
```
aggregator-agent/agent
aggregator-agent/agent-test
aggregator-agent/test-agent-*
aggregator-agent/test-redflag-agent
```

### Task 4: Remove config_builder.go.restored — DONE

- **File:** `config_builder.go.restored` (repo root)
- **Verification:** Active `config_builder.go` exists at `aggregator-server/internal/services/config_builder.go`. The `.restored` file at repo root used `package services` — it was a recovery backup from the original author's dev machine failure.
- **Action:** Deleted.

### Task 5: Remove test_disk_detection.go — DONE

- **File:** `test_disk_detection.go` (repo root)
- **Verification:** Used old import path `github.com/redflag-aggregator/aggregator-agent/internal/system`. Won't compile with current module name. Not part of any test suite.
- **Action:** Deleted.

### Task 6: Machine ID Duplication Audit — DOCUMENTED (read-only)

**Implementations found:**

1. **Canonical:** `aggregator-agent/internal/system/machine_id.go`
   - `GetMachineID()` → multi-tier fallback → SHA256 hash
   - Uses `github.com/denisbrodbeck/machineid` as primary source
   - Linux fallbacks: `/etc/machine-id`, `/var/lib/dbus/machine-id`, `/sys/class/dmi/id/product_uuid`
   - Generic fallback: `hostname-goos-goarch`
   - All values SHA256 hashed before return

2. **Client usage:** `aggregator-agent/internal/client/client.go`
   - Calls `system.GetMachineID()` during initialization — consistent
   - Caches in struct, adds as `X-Machine-ID` header

3. **Main.go usage:** `aggregator-agent/cmd/agent/main.go`
   - Calls `system.GetMachineID()` during registration — consistent
   - **Divergence:** Error fallback uses `"unknown-" + sysInfo.Hostname` (NOT hashed)

4. **Example code:** `aggregator-agent/internal/logging/example_integration.go`
   - Calls `machineid.ID()` directly (NOT hashed, NOT using GetMachineID)
   - **Divergence:** Returns raw library output, not SHA256 hash

**Consistency issues for D-1 fix prompt:**
- Main.go error fallback produces unhashed ID vs. SHA256 in normal path
- Example integration uses raw `machineid.ID()` instead of `GetMachineID()`
- Recommend: single `GetMachineID()` call site in main.go, remove direct library calls

### Task 7: ETHOS Compliance Sweep — DONE

**Banned words fixed (6 occurrences):**

| File | Line | Old | New |
|------|------|-----|-----|
| `scheduler/scheduler.go:38` | "production-ready default" | "default configuration values" |
| `system/info.go:260` | "enhanced detection" | (removed "enhanced") |
| `system/info.go:386` | "More robust partition" | "Strip partition number to get base device" |
| `system/windows.go:390` | "more robust parsing" | "Simplified parsing" |
| `service/windows.go:36` | "Enhanced configuration" | "Configuration system" |
| `scanner/windows_override.go:7` | "used seamlessly" | "aliases to the WUA implementation" |

**Emoji scan:** 30+ pre-existing emoji uses found in agents.go, machine_binding.go, setup.go, db.go, updates.go, etc. These are NOT from A-series code — they predate the audit work. Documented as future cleanup item for the D-series.

---

## Files Deleted

| File | Reason |
|------|--------|
| `aggregator-server/internal/database/queries/commands.go` (RetryCommand function only) | Dead code (DEV-019) |
| `aggregator-server/internal/api/handlers/security_settings.go.broken` | Replaced by security_settings.go in A-3 |
| `aggregator-agent/agent` | Compiled ELF binary |
| `aggregator-agent/agent-test` | Compiled ELF binary |
| `aggregator-agent/test-agent-final` | Compiled ELF binary |
| `aggregator-agent/test-agent-fixed` | Compiled ELF binary |
| `aggregator-agent/test-redflag-agent` | Compiled ELF binary |
| `aggregator-agent/test_disk.go` | Throwaway test file |
| `config_builder.go.restored` | Recovery backup, duplicated |
| `test_disk_detection.go` | Throwaway test, old import path |

## Files Modified

| File | Change |
|------|--------|
| `.gitignore` | Added rules for compiled agent binaries |
| `aggregator-server/internal/database/queries/commands.go` | Removed dead RetryCommand (31 lines) |
| `aggregator-server/internal/scheduler/scheduler.go` | Banned word: "production-ready" |
| `aggregator-agent/internal/system/info.go` | Banned words: "enhanced", "robust" |
| `aggregator-agent/internal/system/windows.go` | Banned word: "robust" |
| `aggregator-agent/internal/service/windows.go` | Banned word: "Enhanced" |
| `aggregator-agent/internal/scanner/windows_override.go` | Banned word: "seamlessly" |

---

## Test Results

**Server: 27 tests — 26 PASS, 1 SKIP, 0 FAIL**
**Agent: 14 tests — 14 PASS, 0 FAIL**
**Total: 41 tests pass. Zero regressions.**

---

## Items Flagged for Future Fix Prompts

1. **D-1: Machine ID duplication** — 3 implementations with 2 divergences (unhashed fallback in main.go, raw library call in example_integration.go). Needs consolidation to single `GetMachineID()` call site.

2. **D-2: Pre-existing emoji in logs** — 30+ emoji characters in log statements across agents.go, machine_binding.go, setup.go, db.go, updates.go. Not from A-series code. Should be addressed in a dedicated ETHOS compliance pass.

3. **D-3: test-config directory** — `aggregator-agent/test-config/config.yaml` exists as a test fixture. May be needed for local dev — left in place.