λgitsite

perf(agent-server): run ECIES encryption outside the agent lock (P2)

ober

50497d276a8594957a7f62cafaa91cc005333c5d

diff --git a/jsecmon/agent-server.ss b/jsecmon/agent-server.ss
index e6b9502..8394486 100644
--- a/jsecmon/agent-server.ss
+++ b/jsecmon/agent-server.ss
@@ -117,19 +117,24 @@
     ev)
 
   (def (agent-store-event! rt ev)
+    ;; Route under the lock (it bumps the shared next-id), then run the slow
+    ;; ECIES encryption (X25519+HKDF+GCM+blocking RNG) OUTSIDE the lock so
+    ;; concurrent monitors aren't serialized behind crypto/entropy. Re-acquire
+    ;; the lock only for the buffer insert (+ local persist, as before).
     (with-agent-lock (agent-runtime-lock rt)
-      (lambda ()
-        (let* ((ev (ensure-event-routing! rt ev))
-               (type (or (hash-get ev "type") ""))
-               (ts (or (hash-get ev "ts") (now-ms)))
-               (severity (event-severity-u8 type))
-               (plaintext (encode-security-event ev))
-               (ciphertext (ecies-encrypt (agent-runtime-public-key rt) plaintext))
-               (seq (buffer-store! (agent-runtime-buffer rt) ts severity ciphertext)))
-          (when (agent-runtime-local-store rt)
-            (try (local-store-persist (agent-runtime-local-store rt) ev)
-                 (catch (e) #f)))
-          seq))))
+      (lambda () (ensure-event-routing! rt ev)))
+    (let* ((type (or (hash-get ev "type") ""))
+           (ts (or (hash-get ev "ts") (now-ms)))
+           (severity (event-severity-u8 type))
+           (plaintext (encode-security-event ev))
+           (ciphertext (ecies-encrypt (agent-runtime-public-key rt) plaintext)))
+      (with-agent-lock (agent-runtime-lock rt)
+        (lambda ()
+          (let ((seq (buffer-store! (agent-runtime-buffer rt) ts severity ciphertext)))
+            (when (agent-runtime-local-store rt)
+              (try (local-store-persist (agent-runtime-local-store rt) ev)
+                   (catch (e) #f)))
+            seq)))))
 
   (def (agent-store-events! rt events)
     (map (lambda (ev) (agent-store-event! rt ev)) events))