cel: Add process annotation functions

[russellhancox]

Adds add_annotation and has_annotation functions to CEL, which add & retrieve annotations on the process tree.

This does not hook annotations into telemetry (that will be a follow-up PR) nor does it include pre-defined annotations (another follow-up PR once we've decided what those should be).

[coderabbitai]

Understand this PR’s impact

Explore downstream dependencies and potential security impact with Blast Radius.

View blast radius →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: 3add13ea-44a6-4d92-810d-f39da30b1b28

📥 Commits

Reviewing files that changed from the base of the PR and between c493661 and 47b19f2.

📒 Files selected for processing (14)

• Source/common/cel/Activation.h
• Source/common/cel/Activation.mm
• Source/common/cel/AnnotationFunction.h
• Source/common/cel/AnnotationFunction.mm
• Source/common/cel/BUILD
• Source/common/cel/Evaluator.h
• Source/common/cel/Evaluator.mm
• Source/common/cel/PolicyForRangeFunction.mm
• Source/common/cel/ResultPath.h
• Source/common/cel/ResultPath.mm
• Source/common/cel/Test.mm
• Source/common/processtree/process_tree.cc
• Source/common/processtree/process_tree.h
• Source/common/processtree/process_tree_test.mm

Included review availability: 3 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 4 reviews per hour.

---

📝 Walkthrough

Walkthrough

CELv2 now supports has_annotation() and add_annotation(). Evaluations stage annotation writes until success. Process-tree annotations support bounded storage and fork/exec propagation. Santad connects CEL hooks to process-tree annotation state.

Changes

CEL Process-Tree Annotations

Layer / File(s)	Summary
CEL annotation runtime Source/common/cel/...	Adds annotation contracts, validation, compiler and runtime registration, activation hooks, staged updates, non-cacheability tracking, and CEL coverage.
CEL evaluation and result paths Source/common/cel/...	Registers annotation functions for rules and fallbacks, commits staged annotations after successful evaluation, and validates result-path placement.
Process-tree annotation storage Source/common/processtree/...	Adds immutable CEL annotations, bounded entries, atomic lookup and updates, fork/exec propagation, sorted protobuf export, retention fixes, build targets, and unit tests.
Santad annotation integration Source/santad/...	Connects CELv2 hooks to process-tree annotations and tests annotation writes, inheritance, result policies, and non-cacheability.

Priority: ➖ Normal

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant CELActivation
  participant AnnotationFunction
  participant ProcessTree
  participant CELAnnotator
  CELActivation->>AnnotationFunction: Evaluate has_annotation or add_annotation
  AnnotationFunction->>ProcessTree: Read or stage annotation for exec target
  ProcessTree->>CELAnnotator: Query or replace annotation state
  ProcessTree->>CELAnnotator: Propagate annotations across fork or exec

Loading

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main change: adding process annotation functions to CEL.
Description check	✅ Passed	The description directly explains that add_annotation and has_annotation are added to CEL for process-tree annotation access, and it identifies deferred telemetry and predefined annotation work.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}