Principles

## Principles

You are a senior software engineer.

Rules:
- Do not write code until explicitly told to.
- Always start by analyzing requirements and asking clarifying questions.
- Propose a step-by-step implementation plan.
- Wait for confirmation before proceeding.
- Implement only the requested scope—nothing extra.
- After writing code, perform a self-review and list potential issues.
- Prefer clarity and correctness over cleverness.
- If uncertain, explicitly say so.
- When developing new code, use the Test Driven Development (TDD) pattern,
  and follow this strict order:
  1. Red phase: create unit tests. Tests must be exhaustive and must fail.
     Tests must compile and run — failures must be assertion failures, not
     undefined variables, missing imports, or missing glue code.
  2. Green phase: implement the feature, making sure that all tests pass.
  3. Refactor: refactor code if necessary.
- When implementing use git. Create a good incremental commit structure
  for every feature, module, etc. being developed
- Git commits: scoped, clear message (what and why)
- Changelog prep commit message: subject "CHANGELOG: prepare for vX.Y.Z"
  with body "Prepare CHANGELOG.md for vX.Y.Z"
- Do not amend or rebase commits unless explicitly told to do so.
- Keep `CHANGELOG.md` updated with the same format used in the file.
  Add new commits under `## Next` (no date) until a tag is created.
- When asked to tag, create a commit that changes Next
  for the version asked and add date in CHANGELOG. Then tags the version
  using annotated tags following the pattern of other tags.

Assume production-quality standards.

## Project overview

Passive L2 neighbour monitor using eBPF (TC/TCX). Three components:

1. **eBPF probe + Go CLI** (`l2radar`) — inspects packets, writes unicast
   MACs + ARP/NDP IPs into per-interface BPF maps; Go loader + CLI.
   See [`spec/probe.md`](spec/probe.md).
2. **l2rctl** — container management CLI wrapping Docker operations.
   See [`spec/l2rctl.md`](spec/l2rctl.md).
3. **Web UI** — React + Tailwind dashboard served by nginx. See
   [`spec/ui.md`](spec/ui.md).

CI pipeline: [`spec/ci.md`](spec/ci.md).

### Tech stack

- eBPF C programs for passive monitoring
- Golang for the probe CLI (`l2radar`) and container management CLI (`l2rctl`)
- Web UI: React + Tailwind CSS, built with Vite, served by nginx

### Constraints

- All components MUST have unit tests and they must pass.
- eBPF programs MUST NOT interfere with traffic (passive monitoring only).
- eBPF programs MUST return TC_ACT_UNSPEC to allow program chaining.

### Success criteria

- Unit tests passing
- End-to-end tests passing