@agentic-qe/v3 3.0.0-alpha.6 → 3.0.0-alpha.8

package/src/domains/chaos-resilience/services/chaos-engineer.ts

@@ -1,1097 +0,0 @@
-/**
- * Agentic QE v3 - Chaos Engineering Service
- * Implements IChaosEngineeringService for fault injection and experiment execution
- */
-
-import { Result, ok, err } from '../../../shared/types';
-import { HttpClient } from '../../../shared/http';
-import {
-  SystemMetricsCollector,
-  getSystemMetricsCollector,
-} from '../../../shared/metrics';
-import { MemoryBackend } from '../../../kernel/interfaces';
-import {
-  ChaosExperiment,
-  ExperimentResult,
-  ExperimentStatus,
-  SteadyStateDefinition,
-  SteadyStateProbe,
-  FaultInjection,
-  FaultResult,
-  FaultType,
-  MetricSnapshot,
-  Incident,
-  IChaosEngineeringService,
-} from '../interfaces';
-import * as net from 'net';
-import { execFile } from 'child_process';
-import { validateCommand } from '../../../mcp/security/cve-prevention';
-
-/**
- * Configuration for the chaos engineer service
- */
-export interface ChaosEngineerConfig {
-  defaultTimeout: number;
-  maxConcurrentFaults: number;
-  enableDryRun: boolean;
-  safetyCheckInterval: number;
-  autoRollbackOnFailure: boolean;
-}
-
-const DEFAULT_CONFIG: ChaosEngineerConfig = {
-  defaultTimeout: 60000, // 60 seconds
-  maxConcurrentFaults: 3,
-  enableDryRun: true,
-  safetyCheckInterval: 5000, // 5 seconds
-  autoRollbackOnFailure: true,
-};
-
-/**
- * Mutable version of ExperimentResult for internal tracking
- */
-interface MutableExperimentResult {
-  experimentId: string;
-  status: ExperimentStatus;
-  startTime: Date;
-  endTime?: Date;
-  hypothesisValidated: boolean;
-  steadyStateVerified: boolean;
-  faultResults: FaultResult[];
-  metrics: MetricSnapshot[];
-  incidents: Incident[];
-}
-
-/**
- * Internal type for tracking experiment execution
- */
-interface ExperimentExecution {
-  experimentId: string;
-  startTime: Date;
-  result: MutableExperimentResult;
-}
-
-/**
- * Chaos Engineering Service Implementation
- * Manages chaos experiments, fault injection, and steady state verification
- */
-export class ChaosEngineerService implements IChaosEngineeringService {
-  private readonly config: ChaosEngineerConfig;
-  private readonly activeExperiments: Map<string, ExperimentExecution> = new Map();
-  private readonly activeFaults: Map<string, FaultInjection> = new Map();
-  private readonly httpClient: HttpClient;
-  private readonly metricsCollector: SystemMetricsCollector;
-  private readonly stressWorkers: Map<string, NodeJS.Timeout | number[]> = new Map();
-
-  constructor(
-    private readonly memory: MemoryBackend,
-    config: Partial<ChaosEngineerConfig> = {}
-  ) {
-    this.config = { ...DEFAULT_CONFIG, ...config };
-    this.httpClient = new HttpClient();
-    this.metricsCollector = getSystemMetricsCollector();
-  }
-
-  /**
-   * Create a new chaos experiment
-   */
-  async createExperiment(experiment: ChaosExperiment): Promise<Result<string>> {
-    try {
-      // Validate experiment configuration
-      const validationResult = this.validateExperiment(experiment);
-      if (!validationResult.success) {
-        return err(validationResult.error);
-      }
-
-      // Store experiment
-      await this.memory.set(
-        `chaos:experiments:${experiment.id}`,
-        experiment,
-        { namespace: 'chaos-resilience', persist: true }
-      );
-
-      return ok(experiment.id);
-    } catch (error) {
-      return err(error instanceof Error ? error : new Error(String(error)));
-    }
-  }
-
-  /**
-   * Run a chaos experiment
-   */
-  async runExperiment(experimentId: string): Promise<Result<ExperimentResult>> {
-    try {
-      // Load experiment
-      const experiment = await this.memory.get<ChaosExperiment>(
-        `chaos:experiments:${experimentId}`
-      );
-
-      if (!experiment) {
-        return err(new Error(`Experiment not found: ${experimentId}`));
-      }
-
-      // Check if experiment is already running
-      if (this.activeExperiments.has(experimentId)) {
-        return err(new Error(`Experiment ${experimentId} is already running`));
-      }
-
-      // Create experiment execution
-      const execution = this.createExecution(experiment);
-      this.activeExperiments.set(experimentId, execution);
-
-      try {
-        // Phase 1: Verify initial steady state
-        const steadyStateResult = await this.verifySteadyState(experiment.steadyState);
-        if (!steadyStateResult.success || !steadyStateResult.value) {
-          execution.result.steadyStateVerified = false;
-          execution.result.status = 'failed';
-          execution.result.incidents.push({
-            type: 'error',
-            severity: 'high',
-            message: 'Initial steady state verification failed',
-            timestamp: new Date(),
-            resolved: false,
-          });
-          return ok(this.finalizeExecution(execution));
-        }
-
-        execution.result.steadyStateVerified = true;
-
-        // Phase 2: Inject faults
-        for (const fault of experiment.faults) {
-          const faultResult = await this.injectFault(fault);
-          if (faultResult.success) {
-            execution.result.faultResults.push(faultResult.value);
-          } else {
-            execution.result.faultResults.push({
-              faultId: fault.id,
-              injected: false,
-              duration: 0,
-              affectedTargets: 0,
-              errors: [faultResult.error.message],
-            });
-          }
-        }
-
-        // Phase 3: Monitor and collect metrics
-        await this.collectMetricsDuringExperiment(execution, experiment);
-
-        // Phase 4: Verify final steady state
-        const finalSteadyState = await this.verifySteadyState(experiment.steadyState);
-        const finalSteadyStateValue = finalSteadyState.success ? finalSteadyState.value : false;
-
-        // Phase 5: Validate hypothesis
-        execution.result.hypothesisValidated = this.validateHypothesis(
-          experiment.hypothesis,
-          execution.result.metrics
-        );
-
-        // Determine final status
-        execution.result.status = this.determineExperimentStatus(execution, finalSteadyStateValue);
-
-        // Phase 6: Clean up faults
-        for (const fault of experiment.faults) {
-          await this.removeFault(fault.id);
-        }
-
-        return ok(this.finalizeExecution(execution));
-      } catch (error) {
-        // Handle unexpected errors
-        execution.result.status = 'failed';
-        execution.result.incidents.push({
-          type: 'error',
-          severity: 'critical',
-          message: error instanceof Error ? error.message : String(error),
-          timestamp: new Date(),
-          resolved: false,
-        });
-
-        // Attempt rollback
-        if (this.config.autoRollbackOnFailure) {
-          await this.rollbackExperiment(experiment);
-          execution.result.status = 'rolled-back';
-        }
-
-        return ok(this.finalizeExecution(execution));
-      } finally {
-        this.activeExperiments.delete(experimentId);
-      }
-    } catch (error) {
-      return err(error instanceof Error ? error : new Error(String(error)));
-    }
-  }
-
-  /**
-   * Abort a running experiment
-   */
-  async abortExperiment(experimentId: string, reason: string): Promise<Result<void>> {
-    try {
-      const execution = this.activeExperiments.get(experimentId);
-      if (!execution) {
-        return err(new Error(`No active experiment found: ${experimentId}`));
-      }
-
-      execution.result.status = 'aborted';
-      execution.result.incidents.push({
-        type: 'alert',
-        severity: 'medium',
-        message: `Experiment aborted: ${reason}`,
-        timestamp: new Date(),
-        resolved: true,
-      });
-
-      // Remove all active faults for this experiment
-      const experiment = await this.memory.get<ChaosExperiment>(
-        `chaos:experiments:${experimentId}`
-      );
-
-      if (experiment) {
-        for (const fault of experiment.faults) {
-          await this.removeFault(fault.id);
-        }
-      }
-
-      return ok(undefined);
-    } catch (error) {
-      return err(error instanceof Error ? error : new Error(String(error)));
-    }
-  }
-
-  /**
-   * Verify steady state conditions
-   */
-  async verifySteadyState(definition: SteadyStateDefinition): Promise<Result<boolean>> {
-    try {
-      const probeResults: boolean[] = [];
-
-      for (const probe of definition.probes) {
-        const result = await this.executeProbe(probe);
-        probeResults.push(result);
-      }
-
-      // All probes must pass
-      const allPassed = probeResults.every((r) => r);
-
-      return ok(allPassed);
-    } catch (error) {
-      return err(error instanceof Error ? error : new Error(String(error)));
-    }
-  }
-
-  /**
-   * Inject a single fault
-   */
-  async injectFault(fault: FaultInjection): Promise<Result<FaultResult>> {
-    try {
-      // Check concurrent fault limit
-      if (this.activeFaults.size >= this.config.maxConcurrentFaults) {
-        return err(new Error(`Maximum concurrent faults (${this.config.maxConcurrentFaults}) reached`));
-      }
-
-      // Validate fault configuration
-      const validationResult = this.validateFault(fault);
-      if (!validationResult.success) {
-        return err(validationResult.error);
-      }
-
-      const startTime = Date.now();
-
-      // Apply probability check
-      if (fault.probability !== undefined && Math.random() > fault.probability) {
-        return ok({
-          faultId: fault.id,
-          injected: false,
-          duration: 0,
-          affectedTargets: 0,
-          errors: ['Skipped due to probability check'],
-        });
-      }
-
-      // Inject fault based on type
-      const injectionResult = await this.performFaultInjection(fault);
-
-      if (injectionResult.success) {
-        this.activeFaults.set(fault.id, fault);
-
-        // Schedule automatic removal if duration is specified
-        if (fault.duration > 0) {
-          setTimeout(() => {
-            this.removeFault(fault.id);
-          }, fault.duration);
-        }
-
-        return ok({
-          faultId: fault.id,
-          injected: true,
-          duration: Date.now() - startTime,
-          affectedTargets: injectionResult.value,
-          errors: [],
-        });
-      }
-
-      return ok({
-        faultId: fault.id,
-        injected: false,
-        duration: Date.now() - startTime,
-        affectedTargets: 0,
-        errors: [injectionResult.error.message],
-      });
-    } catch (error) {
-      return err(error instanceof Error ? error : new Error(String(error)));
-    }
-  }
-
-  /**
-   * Remove an injected fault
-   */
-  async removeFault(faultId: string): Promise<Result<void>> {
-    try {
-      const fault = this.activeFaults.get(faultId);
-      if (!fault) {
-        return ok(undefined); // Already removed
-      }
-
-      // Remove fault based on type
-      await this.performFaultRemoval(fault);
-
-      this.activeFaults.delete(faultId);
-
-      return ok(undefined);
-    } catch (error) {
-      return err(error instanceof Error ? error : new Error(String(error)));
-    }
-  }
-
-  // ============================================================================
-  // Private Helper Methods
-  // ============================================================================
-
-  private validateExperiment(experiment: ChaosExperiment): Result<void> {
-    if (!experiment.id) {
-      return err(new Error('Experiment ID is required'));
-    }
-
-    if (!experiment.name) {
-      return err(new Error('Experiment name is required'));
-    }
-
-    if (!experiment.hypothesis) {
-      return err(new Error('Experiment hypothesis is required'));
-    }
-
-    if (!experiment.steadyState || experiment.steadyState.probes.length === 0) {
-      return err(new Error('At least one steady state probe is required'));
-    }
-
-    if (!experiment.faults || experiment.faults.length === 0) {
-      return err(new Error('At least one fault injection is required'));
-    }
-
-    if (!experiment.rollbackPlan) {
-      return err(new Error('Rollback plan is required'));
-    }
-
-    // Validate blast radius
-    if (experiment.blastRadius.excludeProduction === false) {
-      // Additional checks for production experiments
-      if (!experiment.rollbackPlan.automatic) {
-        return err(new Error('Production experiments require automatic rollback'));
-      }
-    }
-
-    return ok(undefined);
-  }
-
-  private validateFault(fault: FaultInjection): Result<void> {
-    if (!fault.id) {
-      return err(new Error('Fault ID is required'));
-    }
-
-    if (!fault.type) {
-      return err(new Error('Fault type is required'));
-    }
-
-    if (!fault.target) {
-      return err(new Error('Fault target is required'));
-    }
-
-    if (fault.duration < 0) {
-      return err(new Error('Fault duration must be non-negative'));
-    }
-
-    if (fault.probability !== undefined && (fault.probability < 0 || fault.probability > 1)) {
-      return err(new Error('Fault probability must be between 0 and 1'));
-    }
-
-    return ok(undefined);
-  }
-
-  private createExecution(experiment: ChaosExperiment): ExperimentExecution {
-    return {
-      experimentId: experiment.id,
-      startTime: new Date(),
-      result: {
-        experimentId: experiment.id,
-        status: 'running',
-        startTime: new Date(),
-        hypothesisValidated: false,
-        steadyStateVerified: false,
-        faultResults: [],
-        metrics: [],
-        incidents: [],
-      },
-    };
-  }
-
-  private finalizeExecution(execution: ExperimentExecution): ExperimentResult {
-    execution.result.endTime = new Date();
-
-    // Convert mutable result to readonly ExperimentResult
-    const result: ExperimentResult = {
-      experimentId: execution.result.experimentId,
-      status: execution.result.status,
-      startTime: execution.result.startTime,
-      endTime: execution.result.endTime,
-      hypothesisValidated: execution.result.hypothesisValidated,
-      steadyStateVerified: execution.result.steadyStateVerified,
-      faultResults: execution.result.faultResults,
-      metrics: execution.result.metrics,
-      incidents: execution.result.incidents,
-    };
-
-    // Store result in memory
-    this.memory.set(
-      `chaos:results:${execution.experimentId}:${Date.now()}`,
-      result,
-      { namespace: 'chaos-resilience', persist: true }
-    );
-
-    return result;
-  }
-
-  private async executeProbe(probe: SteadyStateProbe): Promise<boolean> {
-    try {
-      // Execute the appropriate probe type based on configuration
-      switch (probe.type) {
-        case 'http':
-          return await this.executeHttpProbe(probe);
-        case 'tcp':
-          return await this.executeTcpProbe(probe);
-        case 'command':
-          return await this.executeCommandProbe(probe);
-        case 'metric':
-          return await this.executeMetricProbe(probe);
-        default:
-          return false;
-      }
-    } catch {
-      return false;
-    }
-  }
-
-  private async executeHttpProbe(probe: SteadyStateProbe): Promise<boolean> {
-    try {
-      const result = await this.httpClient.get(probe.target, {
-        timeout: probe.timeout ?? 5000,
-        retries: 1,
-        circuitBreaker: false,
-      });
-
-      if (!result.success) {
-        console.log(`HTTP probe failed: ${probe.name} -> ${result.error.message}`);
-        return false;
-      }
-
-      const response = result.value;
-
-      // Check expected status if specified
-      if (probe.expectedStatus !== undefined) {
-        const passed = response.status === probe.expectedStatus;
-        if (!passed) {
-          console.log(`HTTP probe ${probe.name}: expected status ${probe.expectedStatus}, got ${response.status}`);
-        }
-        return passed;
-      }
-
-      // Default: any 2xx status is success
-      return response.ok;
-    } catch (error) {
-      console.log(`HTTP probe error: ${probe.name} -> ${error instanceof Error ? error.message : String(error)}`);
-      return false;
-    }
-  }
-
-  private async executeTcpProbe(probe: SteadyStateProbe): Promise<boolean> {
-    return new Promise((resolve) => {
-      try {
-        // Parse target as host:port
-        const [host, portStr] = probe.target.split(':');
-        const port = parseInt(portStr, 10);
-
-        if (!host || isNaN(port)) {
-          console.log(`TCP probe invalid target: ${probe.target} (expected host:port)`);
-          resolve(false);
-          return;
-        }
-
-        const timeout = probe.timeout ?? 5000;
-        const socket = new net.Socket();
-
-        const timer = setTimeout(() => {
-          socket.destroy();
-          console.log(`TCP probe timeout: ${probe.name} -> ${probe.target}`);
-          resolve(false);
-        }, timeout);
-
-        socket.connect(port, host, () => {
-          clearTimeout(timer);
-          socket.destroy();
-          resolve(true);
-        });
-
-        socket.on('error', (err) => {
-          clearTimeout(timer);
-          socket.destroy();
-          console.log(`TCP probe error: ${probe.name} -> ${err.message}`);
-          resolve(false);
-        });
-      } catch (error) {
-        console.log(`TCP probe exception: ${probe.name} -> ${error instanceof Error ? error.message : String(error)}`);
-        resolve(false);
-      }
-    });
-  }
-
-  /**
-   * Allowed commands for chaos probes (security whitelist)
-   */
-  private static readonly ALLOWED_PROBE_COMMANDS = [
-    'curl', 'wget',          // Health check endpoints
-    'nc', 'netcat',          // Network connectivity
-    'ping',                  // Network reachability
-    'nslookup', 'dig',       // DNS checks
-    'ps', 'pgrep',           // Process checks
-    'cat', 'head', 'tail',   // File content checks
-    'ls', 'stat',            // File system checks
-    'echo',                  // Simple output
-    'test', '[',             // Conditional checks
-    'node', 'npm',           // Node.js checks
-  ];
-
-  private async executeCommandProbe(probe: SteadyStateProbe): Promise<boolean> {
-    return new Promise((resolve) => {
-      const timeout = probe.timeout ?? 10000;
-
-      // Validate command against whitelist to prevent injection (CWE-78)
-      const validation = validateCommand(probe.target, ChaosEngineerService.ALLOWED_PROBE_COMMANDS);
-      if (!validation.valid) {
-        console.log(`Command probe ${probe.name} blocked: ${validation.error}`);
-        console.log(`Blocked patterns: ${validation.blockedPatterns?.join(', ') || 'none'}`);
-        resolve(false);
-        return;
-      }
-
-      // Parse command into executable and arguments
-      const sanitizedCommand = validation.sanitizedCommand || probe.target;
-      const parts = sanitizedCommand.trim().split(/\s+/);
-      const executable = parts[0];
-      const args = parts.slice(1);
-
-      // Use execFile instead of exec to avoid shell interpretation
-      execFile(executable, args, { timeout }, (error, stdout, _stderr) => {
-        if (error) {
-          console.log(`Command probe failed: ${probe.name} -> ${error.message}`);
-          resolve(false);
-          return;
-        }
-
-        // Check expected output if specified
-        if (probe.expectedOutput !== undefined) {
-          const passed = stdout.trim().includes(probe.expectedOutput);
-          if (!passed) {
-            console.log(`Command probe ${probe.name}: output did not contain expected value`);
-          }
-          resolve(passed);
-          return;
-        }
-
-        // Default: exit code 0 is success (no error)
-        resolve(true);
-      });
-    });
-  }
-
-  private async executeMetricProbe(probe: SteadyStateProbe): Promise<boolean> {
-    try {
-      // Query metrics endpoint (expects JSON response with 'value' field)
-      const result = await this.httpClient.get(probe.target, {
-        timeout: probe.timeout ?? 5000,
-        retries: 1,
-        circuitBreaker: false,
-      });
-
-      if (!result.success) {
-        console.log(`Metric probe failed: ${probe.name} -> ${result.error.message}`);
-        return false;
-      }
-
-      const response = result.value;
-      if (!response.ok) {
-        console.log(`Metric probe HTTP error: ${probe.name} -> ${response.status}`);
-        return false;
-      }
-
-      // Parse response body for metric value
-      const text = await response.text();
-      let metricValue: number;
-
-      try {
-        const json = JSON.parse(text);
-        metricValue = typeof json.value === 'number' ? json.value : parseFloat(json.value);
-      } catch {
-        // Try parsing as plain number
-        metricValue = parseFloat(text);
-      }
-
-      if (isNaN(metricValue)) {
-        console.log(`Metric probe ${probe.name}: could not parse metric value from response`);
-        return false;
-      }
-
-      // Check threshold if specified
-      if (probe.threshold !== undefined) {
-        const { operator, value } = probe.threshold;
-        switch (operator) {
-          case 'lt': return metricValue < value;
-          case 'gt': return metricValue > value;
-          case 'lte': return metricValue <= value;
-          case 'gte': return metricValue >= value;
-          case 'eq': return metricValue === value;
-          default: return true;
-        }
-      }
-
-      return true;
-    } catch (error) {
-      console.log(`Metric probe error: ${probe.name} -> ${error instanceof Error ? error.message : String(error)}`);
-      return false;
-    }
-  }
-
-  private async performFaultInjection(fault: FaultInjection): Promise<Result<number>> {
-    const faultHandlers: Record<FaultType, () => Promise<Result<number>>> = {
-      'latency': async () => this.injectLatency(fault),
-      'error': async () => this.injectError(fault),
-      'timeout': async () => this.injectTimeout(fault),
-      'packet-loss': async () => this.injectPacketLoss(fault),
-      'cpu-stress': async () => this.injectCpuStress(fault),
-      'memory-stress': async () => this.injectMemoryStress(fault),
-      'disk-stress': async () => this.injectDiskStress(fault),
-      'network-partition': async () => this.injectNetworkPartition(fault),
-      'dns-failure': async () => this.injectDnsFailure(fault),
-      'process-kill': async () => this.injectProcessKill(fault),
-    };
-
-    const handler = faultHandlers[fault.type];
-    if (handler) {
-      return handler();
-    }
-
-    return err(new Error(`Unknown fault type: ${fault.type}`));
-  }
-
-  private async injectLatency(fault: FaultInjection): Promise<Result<number>> {
-    // Latency injection is typically done at proxy/network level
-    // For simulation, we store the config and check during probe execution
-    const latencyMs = fault.parameters.latencyMs ?? 100;
-    console.log(`Latency injection configured: ${latencyMs}ms for ${fault.target.selector}`);
-    console.log(`Note: Actual latency injection requires network proxy (e.g., Toxiproxy, tc)`);
-    return ok(1);
-  }
-
-  private async injectError(fault: FaultInjection): Promise<Result<number>> {
-    // Error injection typically requires proxy/service mesh
-    const errorCode = fault.parameters.errorCode ?? 500;
-    console.log(`Error injection configured: ${errorCode} for ${fault.target.selector}`);
-    console.log(`Note: Actual error injection requires service mesh (e.g., Istio, Linkerd)`);
-    return ok(1);
-  }
-
-  private async injectTimeout(fault: FaultInjection): Promise<Result<number>> {
-    // Timeout injection via proxy configuration
-    console.log(`Timeout injection configured for ${fault.target.selector}`);
-    console.log(`Note: Actual timeout injection requires network proxy configuration`);
-    return ok(1);
-  }
-
-  private async injectPacketLoss(fault: FaultInjection): Promise<Result<number>> {
-    const lossPercent = fault.parameters.packetLossPercent ?? 10;
-    console.log(`Packet loss configured: ${lossPercent}% for ${fault.target.selector}`);
-    console.log(`Note: Actual packet loss requires tc/iptables (Linux) or similar`);
-    return ok(1);
-  }
-
-  private async injectCpuStress(fault: FaultInjection): Promise<Result<number>> {
-    // Real CPU stress implementation using busy loops
-    const cpuPercent = fault.parameters.cpuPercent ?? 80;
-    const cores = fault.parameters.cores ?? 1;
-    const duration = fault.duration;
-
-    console.log(`Injecting CPU stress: ${cpuPercent}% on ${cores} core(s) for ${duration}ms`);
-
-    // Create CPU-intensive work
-    const startTime = Date.now();
-    const workInterval = setInterval(() => {
-      if (Date.now() - startTime >= duration) {
-        clearInterval(workInterval);
-        return;
-      }
-
-      // Busy work based on target CPU percentage
-      const busyTime = 10 * (cpuPercent / 100);
-
-      const busyStart = Date.now();
-      while (Date.now() - busyStart < busyTime) {
-        // Busy loop - CPU intensive operations
-        Math.random() * Math.random();
-      }
-      // Note: Idle time is handled by the interval itself (10ms interval)
-      // In real implementation, this would use worker threads for true parallelism
-    }, 10);
-
-    this.stressWorkers.set(fault.id, workInterval);
-
-    return ok(cores as number);
-  }
-
-  private async injectMemoryStress(fault: FaultInjection): Promise<Result<number>> {
-    // Real memory stress implementation by allocating buffers
-    const memoryBytes = fault.parameters.memoryBytes ?? 1024 * 1024 * 100; // 100MB default
-    const memoryMB = Math.round(memoryBytes / (1024 * 1024));
-
-    console.log(`Injecting memory stress: ${memoryMB}MB allocation`);
-
-    try {
-      // Allocate memory in chunks to avoid single large allocation issues
-      const chunkSize = 1024 * 1024; // 1MB chunks
-      const chunks = Math.ceil(memoryBytes / chunkSize);
-      const allocatedMemory: number[][] = [];
-
-      for (let i = 0; i < chunks; i++) {
-        const size = Math.min(chunkSize, memoryBytes - (i * chunkSize));
-        // Use Array to allocate memory that won't be easily garbage collected
-        const chunk = new Array(size).fill(Math.random());
-        allocatedMemory.push(chunk);
-      }
-
-      // Store reference to prevent garbage collection
-      this.stressWorkers.set(fault.id, allocatedMemory as unknown as number[]);
-
-      console.log(`Memory stress active: ${allocatedMemory.length} chunks allocated`);
-      return ok(1);
-    } catch (error) {
-      return err(new Error(`Failed to allocate memory: ${error instanceof Error ? error.message : String(error)}`));
-    }
-  }
-
-  private async injectDiskStress(fault: FaultInjection): Promise<Result<number>> {
-    // Disk stress would require file system operations
-    console.log(`Disk stress configured for ${fault.target.selector}`);
-    console.log(`Note: Actual disk stress requires file system write permissions`);
-    return ok(1);
-  }
-
-  private async injectNetworkPartition(fault: FaultInjection): Promise<Result<number>> {
-    // Network partition typically requires iptables or similar
-    console.log(`Network partition configured for ${fault.target.selector}`);
-    console.log(`Note: Actual network partition requires iptables/firewall rules`);
-    return ok(1);
-  }
-
-  private async injectDnsFailure(fault: FaultInjection): Promise<Result<number>> {
-    // DNS failure injection via /etc/hosts or DNS server configuration
-    console.log(`DNS failure configured for ${fault.target.selector}`);
-    console.log(`Note: Actual DNS failure requires DNS server or /etc/hosts modification`);
-    return ok(1);
-  }
-
-  private async injectProcessKill(fault: FaultInjection): Promise<Result<number>> {
-    // Process kill via system commands
-    const processPattern = fault.target.selector;
-    console.log(`Process kill configured for pattern: ${processPattern}`);
-    console.log(`Note: Actual process kill requires appropriate permissions`);
-
-    // In dry-run mode or without permissions, just log
-    if (this.config.enableDryRun) {
-      console.log(`[DRY RUN] Would kill processes matching: ${processPattern}`);
-      return ok(0);
-    }
-
-    return ok(1);
-  }
-
-  private async performFaultRemoval(fault: FaultInjection): Promise<void> {
-    console.log(`Removing fault: ${fault.id} (${fault.type})`);
-
-    // Clean up any active stress workers
-    const worker = this.stressWorkers.get(fault.id);
-    if (worker) {
-      if (typeof worker === 'object' && 'unref' in worker) {
-        // It's a timeout/interval
-        clearInterval(worker as NodeJS.Timeout);
-      }
-      // Memory allocations will be garbage collected when reference is removed
-      this.stressWorkers.delete(fault.id);
-    }
-  }
-
-  private async collectMetricsDuringExperiment(
-    execution: ExperimentExecution,
-    experiment: ChaosExperiment
-  ): Promise<void> {
-    const metricsToCollect = experiment.hypothesis.metrics.map((m) => m.metric);
-    const startTime = Date.now();
-    const duration = Math.max(
-      ...experiment.faults.map((f) => f.duration),
-      this.config.defaultTimeout
-    );
-
-    // Collect real metrics during experiment execution
-    while (Date.now() - startTime < Math.min(duration, 5000)) {
-      for (const metric of metricsToCollect) {
-        const snapshot: MetricSnapshot = {
-          timestamp: new Date(),
-          name: metric,
-          value: this.collectRealMetricValue(metric),
-          labels: { experiment: experiment.id },
-        };
-        execution.result.metrics.push(snapshot);
-      }
-      await this.sleep(this.config.safetyCheckInterval);
-    }
-  }
-
-  private collectRealMetricValue(metric: string): number {
-    // Collect real system metrics using SystemMetricsCollector
-    return this.metricsCollector.getChaosMetricValue(metric);
-  }
-
-  private validateHypothesis(
-    hypothesis: ChaosExperiment['hypothesis'],
-    metrics: MetricSnapshot[]
-  ): boolean {
-    // Check each metric expectation
-    for (const expectation of hypothesis.metrics) {
-      const relevantMetrics = metrics.filter((m) => m.name === expectation.metric);
-
-      if (relevantMetrics.length === 0) {
-        return false; // Missing metric data
-      }
-
-      const avgValue =
-        relevantMetrics.reduce((sum, m) => sum + m.value, 0) / relevantMetrics.length;
-
-      if (!this.checkMetricExpectation(avgValue, expectation)) {
-        return false;
-      }
-    }
-
-    // Check tolerances
-    for (const tolerance of hypothesis.tolerances) {
-      const relevantMetrics = metrics.filter((m) => m.name === tolerance.metric);
-
-      if (relevantMetrics.length === 0) continue;
-
-      const values = relevantMetrics.map((m) => m.value);
-      const deviation = this.calculateDeviation(values);
-
-      const maxAllowed =
-        tolerance.unit === 'percent'
-          ? (deviation / values[0]) * 100
-          : deviation;
-
-      if (maxAllowed > tolerance.maxDeviation) {
-        return false;
-      }
-    }
-
-    return true;
-  }
-
-  private checkMetricExpectation(
-    actual: number,
-    expectation: ChaosExperiment['hypothesis']['metrics'][0]
-  ): boolean {
-    const { operator, value } = expectation;
-
-    switch (operator) {
-      case 'eq':
-        return actual === value;
-      case 'lt':
-        return actual < (value as number);
-      case 'gt':
-        return actual > (value as number);
-      case 'lte':
-        return actual <= (value as number);
-      case 'gte':
-        return actual >= (value as number);
-      case 'between':
-        const [min, max] = value as [number, number];
-        return actual >= min && actual <= max;
-      default:
-        return false;
-    }
-  }
-
-  private calculateDeviation(values: number[]): number {
-    if (values.length === 0) return 0;
-    const avg = values.reduce((a, b) => a + b, 0) / values.length;
-    const squaredDiffs = values.map((v) => Math.pow(v - avg, 2));
-    return Math.sqrt(squaredDiffs.reduce((a, b) => a + b, 0) / values.length);
-  }
-
-  private determineExperimentStatus(
-    execution: ExperimentExecution,
-    finalSteadyState: boolean
-  ): ExperimentStatus {
-    if (!execution.result.steadyStateVerified) {
-      return 'failed';
-    }
-
-    if (!finalSteadyState) {
-      return 'failed';
-    }
-
-    if (execution.result.hypothesisValidated) {
-      return 'completed';
-    }
-
-    // Check if any faults failed to inject
-    const failedFaults = execution.result.faultResults.filter((f) => !f.injected);
-    if (failedFaults.length > 0) {
-      return 'failed';
-    }
-
-    return 'completed';
-  }
-
-  private async rollbackExperiment(experiment: ChaosExperiment): Promise<void> {
-    // Execute rollback steps in order
-    for (const step of experiment.rollbackPlan.steps.sort((a, b) => a.order - b.order)) {
-      console.log(`Executing rollback step ${step.order}: ${step.action}`);
-
-      try {
-        await this.executeRollbackAction(step.action, step.target, step.timeout);
-      } catch (error) {
-        console.error(
-          `Rollback step ${step.order} failed: ${error instanceof Error ? error.message : String(error)}`
-        );
-        // Continue with other rollback steps even if one fails
-      }
-    }
-
-    // Remove all active faults
-    for (const fault of experiment.faults) {
-      await this.removeFault(fault.id);
-    }
-  }
-
-  private async executeRollbackAction(
-    action: string,
-    target?: string,
-    timeout: number = 30000
-  ): Promise<void> {
-    // Determine action type and execute accordingly
-    if (action.startsWith('http://') || action.startsWith('https://')) {
-      // HTTP endpoint rollback
-      await this.executeHttpRollback(action, timeout);
-    } else if (action.startsWith('cmd:')) {
-      // Command-based rollback
-      await this.executeCommandRollback(action.slice(4), timeout);
-    } else if (target && (target.startsWith('http://') || target.startsWith('https://'))) {
-      // HTTP target with action name
-      await this.executeHttpRollback(`${target}/_chaos/${action}`, timeout);
-    } else {
-      // Built-in action or description-only step
-      await this.executeBuiltInRollback(action, target, timeout);
-    }
-  }
-
-  private async executeHttpRollback(url: string, timeout: number): Promise<void> {
-    const result = await this.httpClient.post(url, {}, { timeout, retries: 1 });
-    if (!result.success) {
-      throw new Error(`HTTP rollback failed: ${result.error.message}`);
-    }
-  }
-
-  /**
-   * Allowed commands for rollback operations (security whitelist)
-   */
-  private static readonly ALLOWED_ROLLBACK_COMMANDS = [
-    'kill', 'pkill',         // Process termination
-    'rm', 'rmdir',           // File cleanup
-    'mv', 'cp',              // File operations
-    'systemctl', 'service',  // Service management
-    'docker', 'kubectl',     // Container management
-    'iptables',              // Network rules (for cleanup)
-    'tc',                    // Traffic control (for cleanup)
-    'echo', 'true',          // No-op commands
-  ];
-
-  private executeCommandRollback(command: string, timeout: number): Promise<void> {
-    return new Promise((resolve, reject) => {
-      // Validate command against whitelist to prevent injection (CWE-78)
-      const validation = validateCommand(command, ChaosEngineerService.ALLOWED_ROLLBACK_COMMANDS);
-      if (!validation.valid) {
-        reject(new Error(`Rollback command blocked: ${validation.error}`));
-        return;
-      }
-
-      // Parse command into executable and arguments
-      const sanitizedCommand = validation.sanitizedCommand || command;
-      const parts = sanitizedCommand.trim().split(/\s+/);
-      const executable = parts[0];
-      const args = parts.slice(1);
-
-      // Use execFile instead of exec to avoid shell interpretation
-      execFile(executable, args, { timeout }, (error, _stdout, stderr) => {
-        if (error) {
-          reject(new Error(`Command rollback failed: ${error.message}. ${stderr}`));
-        } else {
-          resolve();
-        }
-      });
-    });
-  }
-
-  private async executeBuiltInRollback(
-    action: string,
-    target?: string,
-    _timeout?: number
-  ): Promise<void> {
-    // Handle built-in rollback actions
-    const actionLower = action.toLowerCase();
-
-    if (actionLower.includes('remove') || actionLower.includes('clear')) {
-      // Clear any remaining state
-      if (target) {
-        console.log(`Clearing state for target: ${target}`);
-      }
-    } else if (actionLower.includes('restart')) {
-      // Restart service (log only - actual restart would require orchestration)
-      console.log(`Restart requested for: ${target || 'service'}`);
-    } else if (actionLower.includes('restore')) {
-      // Restore to previous state
-      console.log(`Restore requested for: ${target || 'system'}`);
-    } else {
-      // Log-only for description actions
-      console.log(`Rollback action logged: ${action}`);
-    }
-
-    // Brief pause between actions
-    await this.sleep(100);
-  }
-
-  private sleep(ms: number): Promise<void> {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-  }
-}