fix(agent): resolve typedef-wrapped structs in BTF preflight so fix_setuid attaches (JEF-924)

[thejefflarson]

Closes JEF-924

What was wrong

Every agent — arm64 (-raspi) and amd64 (-generic) alike — reported loaded=7 total=8: the fix_setuid probe (security_task_fix_setuid, the setuid→root privilege-escalation signal) was disabled fleet-wide. Privilege-escalation corroboration has been silently inert.

Root cause — a preflight false-positive

The BTF preflight logged kuid_t.val expected=0 actual=None and fail-closed the probe. actual=None means the field wasn't found, not that its offset moved. The struct lookup (preflight/btf.rs) matched only a KIND_STRUCT named kuid_t — but the kernel declares it as:

typedef struct { uid_t val; } kuid_t;   // anonymous struct; the name is on the typedef

There is no struct literally named kuid_t, so the by-name scan found nothing. The baked offset (0) is correct and the probe would work — it was being disabled by a blind spot for typedef-wrapped structs.

Fix

Add aggregate_id: resolve a struct name that is itself a typedef/see-through to its target aggregate, reusing the same resolve_to_aggregate the module already applies to anonymous members. struct_field_offset now routes through it. Adds a regression test for the exact kuid_t shape (typedef → anonymous struct { val@0 } → Some(0)).

Verified

Agent workspace: fmt clean · clippy clean · 75 tests pass (incl. the new resolves_a_struct_name_that_is_itself_a_typedef). After this ships, agents should report loaded=8 total=8 and fix_setuid attaches.

How it was found

Live fleet inspection (kubectl logs across all agents) — every node showed the same single disabled probe and the same kuid_t.val mismatch, which is what pinned it to a preflight resolution bug rather than a real per-kernel offset change.

🤖 Generated with Claude Code