feat(audit-logging): phase 2 - US.5 - logging of agent inactive status (#7034)

[damgouj (damgouj)]

Proposed changes

• Log when an agent becomes inactive (1 hour timeout)

Testing Instructions

1. Install an agent and stop it
2. Log inactive after 1 hour (or update the last_seen column)
3. Start again the agent
4. Log active when registered again

Related issues

• Closes feat(audit-logging): Phase 2 - US.5 - Agent updates #7034

Checklist

• I consider the submitted work as finished
• I tested the code for its functionality
• I wrote test cases for the relevant uses case
• I added/update the relevant documentation (either on github or on notion)
• Where necessary I refactored code to improve the overall quality
• For bug fix -> I implemented a test that covers the bug

[github-actions]

📖 Documentation check — ✅ Passed

21 functional file(s), 1 doc file(s) changed.

Documentation-worthy changes detected and documentation was updated. 👏

Detected changes (covered by doc updates)

• 🟡 New configuration property — openaev-api/src/main/java/io/openaev/scheduler/PlatformTriggers.java

[github-actions]

✅ Container vulnerability scan — Passed

Previously reported findings are no longer present.

Image	Critical	High	Total	Status
Standard	0	0	0	✅ Clear
UBI9	0	0	0	✅ Clear

View workflow run · Standard JSON report · UBI9 JSON report

_{Updated from CI run attempt 1.}

[Copilot]

Pull request overview

This PR introduces a persisted agent_status (ACTIVE/INACTIVE) and a Quartz job that periodically marks stale agents inactive and emits an audit log event when that transition happens. It updates downstream consumers (asset activity status, vulnerable endpoint indexing, capability resolution) to rely on the persisted status instead of computing activity from last_seen, and adds unit/integration test coverage plus configuration/docs updates.

Changes:

• Add AgentStatus + agent_status DB column (with backfill + index) and switch agent activity checks to use persisted status.
• Add AgentInactivityMonitorJob scheduled trigger/job definitions to mark stale ACTIVE agents as INACTIVE and emit a COVERAGE_GAP audit event.
• Update endpoint sync/fixtures/tests/docs to reflect the new status model.

Reviewed changes

Copilot reviewed 25 out of 25 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
openaev-model/src/main/java/io/openaev/helper/AgentHelper.java	Removes computed lastSeen-based helper (replaced by persisted status + job).
openaev-model/src/main/java/io/openaev/engine/model/vulnerableendpoint/VulnerableEndpointHandler.java	Switches vulnerable endpoint “agent active” projection from lastSeen to agent_status.
openaev-model/src/main/java/io/openaev/database/repository/VulnerableEndpointRepository.java	Changes SQL projection to aggregate agent_status instead of agent_last_seen.
openaev-model/src/main/java/io/openaev/database/repository/AgentRepository.java	Moves to JpaRepository, replaces lastSeen count with status-based methods + stale-agent finder.
openaev-model/src/main/java/io/openaev/database/raw/RawVulnerableEndpointIndexing.java	Updates raw projection interface to expose agent statuses instead of timestamps.
openaev-model/src/main/java/io/openaev/database/model/Asset.java	Asset activity @Formula now considers agent_status rather than a 1-hour lastSeen window.
openaev-model/src/main/java/io/openaev/database/model/AgentStatus.java	Introduces ACTIVE/INACTIVE status enum.
openaev-model/src/main/java/io/openaev/database/model/Agent.java	Adds persisted status field + changes isActive() to read status.
openaev-api/src/test/resources/application.properties	Adds test config for inactivity monitor polling interval.
openaev-api/src/test/java/io/openaev/utils/fixtures/AgentFixture.java	Ensures inactive agent fixture sets AgentStatus.INACTIVE.
openaev-api/src/test/java/io/openaev/service/EndpointServiceTest.java	Updates behavior expectations around reactivation + source tag management.
openaev-api/src/test/java/io/openaev/scheduler/jobs/InjectsExecutionJobTest.java	Adjusts inject execution test setup to explicitly set agent statuses.
openaev-api/src/test/java/io/openaev/scheduler/jobs/AgentInactivityMonitorJobTest.java	Adds unit tests for the inactivity monitor job + audit emission.
openaev-api/src/test/java/io/openaev/scheduler/jobs/AgentInactivityMonitorJobIntegrationTest.java	Adds integration test covering ACTIVE→INACTIVE, manual ACTIVE recovery, then INACTIVE again.
openaev-api/src/test/java/io/openaev/executors/execution/service/ExecutionExecutorServiceTest.java	Updates executor tests to set AgentStatus.ACTIVE.
openaev-api/src/main/resources/application.properties	Adds production config key for inactivity monitor polling interval.
openaev-api/src/main/java/io/openaev/service/EndpointService.java	Forces agent status to ACTIVE on sync/register paths (now central to liveness model).
openaev-api/src/main/java/io/openaev/service/autonomous/CapabilityResolverService.java	Uses countByStatus(ACTIVE) for capability resolution readiness.
openaev-api/src/main/java/io/openaev/scheduler/PlatformTriggers.java	Adds Quartz trigger for agent inactivity monitor job.
openaev-api/src/main/java/io/openaev/scheduler/PlatformJobDefinitions.java	Adds job detail bean for inactivity monitor job.
openaev-api/src/main/java/io/openaev/scheduler/jobs/AgentInactivityMonitorJob.java	New Quartz job: mark stale ACTIVE agents INACTIVE and log audit coverage gap.
openaev-api/src/main/java/io/openaev/migration/V6_20260818200000000__Add_status_to_agents.java	Adds/backfills agent_status column + creates index for stale-agent query.
openaev-api/src/main/java/io/openaev/executors/model/AgentRegisterInput.java	Replaces AgentHelper usage; computes “active” from lastSeen threshold directly.
openaev-api/src/main/java/io/openaev/executors/caldera/service/CalderaExecutorService.java	Ensures updated agents are marked ACTIVE on update path.
docs/docs/deployment/configuration.md	Documents new inactivity monitor polling interval configuration key.

Suppressed comments (2)

openaev-api/src/main/java/io/openaev/service/EndpointService.java:824

• issue (blocking): setUpdatedAgentAttributes unconditionally sets status to ACTIVE even when the provided lastSeen is stale. This can flip INACTIVE→ACTIVE without a real heartbeat and then the monitor job will flip it back and log again. Gate the reactivation on input.isActive().

  private void setUpdatedAgentAttributes(Agent agent, AgentRegisterInput input, Endpoint endpoint) {
    agent.setAsset(endpoint);
    agent.setLastSeen(input.getLastSeen());
    agent.setStatus(AgentStatus.ACTIVE);
    agent.setExternalReference(input.getExternalReference());

openaev-api/src/main/java/io/openaev/service/EndpointService.java:851

• issue (blocking): new agents are always initialized as ACTIVE even if the source reports a stale/absent lastSeen. Initialize status consistently with AgentRegisterInput#isActive so brand-new stale agents don't immediately require the monitor job to correct them.

    agent.setStatus(AgentStatus.ACTIVE);

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Gael Leblan (Dimfacion)]

issue : I don't think it should be set to AuditStateIgnore as we want to monitor and have a log if the status has changed during a call

[damgouj (damgouj)]

Well seen, fix to see it in the audit log but it's also already checked with the isActive attribute

[Gael Leblan (Dimfacion)]

It works for traces when the agent goes from ACTIVE to INACTIVE but when going from INACTIVE to ACTIVE, while I do have a trace, it shows incorrectly the status as INACTIVE in the audit logs.

[Gael Leblan (Dimfacion)]

Retested, all good ! Thank you for your work on this :)