Add isolated SIP call tool, optional debug capture and split interface schemas

cmd/sip-go-agent/agent_command.go

@@ -23,6 +23,7 @@ import (
 
 func newAgentCommand() *cobra.Command {
 	var mode string
+	var debug bool
 	command := &cobra.Command{
 		Use: "agent", Short: "Run the bound Agent", Args: cobra.NoArgs,
 		SilenceUsage: true,
@@ -31,6 +32,10 @@ func newAgentCommand() *cobra.Command {
 			if err != nil {
 				return err
 			}
+			settings.Debug = debug
+			if err := settings.ValidateDebug(); err != nil {
+				return err
+			}
 			ca, err := readAgentPEM("MTLS_CA_FILE", settings.CAFile)
 			if err != nil {
 				return err
@@ -146,6 +151,7 @@ func newAgentCommand() *cobra.Command {
 			return nil
 		},
 	}
+	command.Flags().BoolVarP(&debug, "debug", "D", false, "Require per-call evidence from the nonproduction capture script")
 	command.Flags().StringVar(&mode, "mode", "mock", "isolated Mock, SIP-only or explicit nonprod-real mode")
 	return command
 }

cmd/sip-go-agent/agent_real.go

@@ -40,7 +40,10 @@ func newRealAgentServer(ctx context.Context, settings config.AgentEnvironment, d
 	if value.Kind() == reflect.Pointer && value.IsNil() {
 		return nil, errors.New("real Agent requires a live pinned Dispatcher transport")
 	}
-	for _, path := range []string{settings.AsteriskConfigDir, settings.AsteriskBin, settings.AsteriskLibraryDir, settings.EvidenceRoot, settings.RecoveryRoot} {
+	if err := settings.ValidateDebug(); err != nil {
+		return nil, err
+	}
+	for _, path := range []string{settings.AsteriskConfigDir, settings.AsteriskBin, settings.AsteriskLibraryDir, settings.RecoveryRoot} {
 		if !filepath.IsAbs(path) {
 			return nil, errors.New("real Agent paths must be absolute")
 		}
@@ -85,7 +88,7 @@ func newRealAgentServer(ctx context.Context, settings config.AgentEnvironment, d
 				Journal: &agent.ResultJournal{Root: settings.RecoveryRoot},
 			}
 			return (&rpc.ApprovedRecordedRealCall{
-				Loader: loader, MediaPayloadType: 118, EvidenceRoot: settings.EvidenceRoot,
+				Loader: loader, MediaPayloadType: 118, EvidenceRoot: settings.EvidenceRoot, Debug: settings.Debug,
 				MaxWAVBytes: 64 << 20, ReportTimeout: 15 * time.Minute, Delivery: delivery, Mirror: mirror,
 			}).Prepare(execution)
 		},

cmd/sip-go-agent/debug_test.go

@@ -0,0 +1,24 @@
+package main
+
+import "testing"
+
+func TestDebugFlagIsExplicitAndAgentOnly(t *testing.T) {
+	for _, flag := range []string{"--debug", "-D"} {
+		command := newAgentCommand()
+		if err := command.ParseFlags([]string{flag}); err != nil {
+			t.Fatal(err)
+		}
+		enabled, err := command.Flags().GetBool("debug")
+		if err != nil || !enabled {
+			t.Fatalf("%s: %v %v", flag, enabled, err)
+		}
+		if err := newDispatcherCommand().ParseFlags([]string{flag}); err == nil {
+			t.Fatal("Dispatcher must not silently accept an Agent capture flag")
+		}
+	}
+	command := newAgentCommand()
+	enabled, err := command.Flags().GetBool("debug")
+	if err != nil || enabled {
+		t.Fatal("capture must be disabled by default")
+	}
+}