feat(sniffer): publish decky.{id}.traffic on the bus (DEBT-031)

SnifferEngine gains an optional publish_fn hook, invoked after the
dedup + syslog write for traffic-summary events only (tls_session,
tcp_flow_timing, tcp_syn_fingerprint) — intermediate parser artifacts
like tls_client_hello stay off the bus.

The sniffer worker wires get_bus() + a thread-safe shim that marshals
sync calls from the scapy sniff thread back onto the asyncio loop via
run_coroutine_threadsafe.  Bus failure at startup degrades cleanly to
publish-off mode; publish failures at runtime never escape the sniff
thread.

decnet/sniffer/fingerprint.py

@@ -52,6 +52,17 @@ _TCP_ACK: int = 0x10
 _TCP_FIN: int = 0x01
 _TCP_RST: int = 0x04
 
+# Event types that should fan out on the service bus as ``decky.{id}.traffic``.
+# Intermediate parser artifacts (tls_client_hello, tls_certificate) are
+# intentionally excluded — tls_session covers the completed handshake and
+# tcp_flow_timing covers the flow summary; together they're the minimum
+# interesting signal for downstream consumers.
+_BUS_TRAFFIC_EVENTS: frozenset[str] = frozenset({
+    "tls_session",
+    "tcp_flow_timing",
+    "tcp_syn_fingerprint",
+})
+
 
 # ─── TCP option extraction for passive fingerprinting ───────────────────────
 
@@ -692,10 +703,16 @@ class SnifferEngine:
         ip_to_decky: dict[str, str],
         write_fn: Callable[[str], None],
         dedup_ttl: float = 300.0,
+        publish_fn: Callable[[str, str, dict[str, Any]], None] | None = None,
     ):
         self._ip_to_decky = ip_to_decky
         self._write_fn = write_fn
         self._dedup_ttl = dedup_ttl
+        # Optional bus publish hook. Called *after* dedup + syslog write, so
+        # every syslog line we emit has a matching bus event and duplicate
+        # storms are already suppressed upstream.  Signature:
+        # ``publish_fn(decky_name, event_type, payload_dict)``.
+        self._publish_fn = publish_fn
 
         self._sessions: dict[tuple[str, int, str, int], dict[str, Any]] = {}
         self._session_ts: dict[tuple[str, int, str, int], float] = {}
@@ -782,6 +799,15 @@ class SnifferEngine:
             return
         line = syslog_line(SERVICE_NAME, node_name, event_type, severity=severity, **fields)
         self._write_fn(line)
+        # Bus fan-out, fire-and-forget.  Only emit for traffic-summary event
+        # types — the ones that represent an observable decky interaction
+        # rather than an intermediate parser artifact.  Rate is naturally
+        # bounded by the dedup cache above.
+        if self._publish_fn is not None and event_type in _BUS_TRAFFIC_EVENTS:
+            try:
+                self._publish_fn(node_name, event_type, dict(fields))
+            except Exception:  # nosec B110 — bus must never break sniff thread
+                pass
 
     # ── Flow tracking (per-TCP-4-tuple timing + retransmits) ────────────────
 

decnet/sniffer/worker.py

@@ -11,12 +11,18 @@ The API never depends on this worker being alive.
 """
 
 import asyncio
+import contextlib
 import os
 import subprocess  # nosec B404 — needed for interface checks
 import threading
 from concurrent.futures import ThreadPoolExecutor
 from pathlib import Path
+from typing import Any, Callable
 
+from decnet.bus import topics as _topics
+from decnet.bus.base import BaseBus
+from decnet.bus.factory import get_bus
+from decnet.bus.publish import publish_safely
 from decnet.logging import get_logger
 from decnet.network import HOST_IPVLAN_IFACE, HOST_MACVLAN_IFACE
 from decnet.sniffer.fingerprint import SnifferEngine
@@ -41,6 +47,30 @@ def _load_ip_to_decky() -> dict[str, str]:
     return mapping
 
 
+def _make_thread_safe_publisher(
+    bus: BaseBus,
+    loop: asyncio.AbstractEventLoop,
+) -> Callable[[str, str, dict[str, Any]], None]:
+    """Build a sync callable that marshals bus publishes back to *loop*.
+
+    The scapy sniff loop runs in a dedicated worker thread and cannot
+    ``await`` anything.  Every call here schedules the async publish on
+    the event loop and returns immediately; the sniff thread is never
+    blocked waiting for the publish to actually land on the wire.
+    """
+    def _publish(decky_name: str, event_type: str, payload: dict[str, Any]) -> None:
+        topic = _topics.decky(decky_name, _topics.DECKY_TRAFFIC)
+        try:
+            asyncio.run_coroutine_threadsafe(
+                publish_safely(bus, topic, payload, event_type=event_type),
+                loop,
+            )
+        except Exception as exc:  # noqa: BLE001
+            logger.debug("sniffer: cross-thread bus publish failed: %s", exc)
+
+    return _publish
+
+
 def _interface_exists(iface: str) -> bool:
     """Check if a network interface exists on this host."""
     try:
@@ -59,6 +89,7 @@ def _sniff_loop(
     log_path: Path,
     json_path: Path,
     stop_event: threading.Event,
+    publish_fn: Callable[[str, str, dict[str, Any]], None] | None = None,
 ) -> None:
     """Blocking sniff loop. Runs in a dedicated thread via asyncio.to_thread."""
     try:
@@ -75,7 +106,9 @@ def _sniff_loop(
     def _write_fn(line: str) -> None:
         write_event(line, log_path, json_path)
 
-    engine = SnifferEngine(ip_to_decky=ip_map, write_fn=_write_fn)
+    engine = SnifferEngine(
+        ip_to_decky=ip_map, write_fn=_write_fn, publish_fn=publish_fn,
+    )
 
     # Periodically refresh IP map in a background daemon thread
     def _refresh_loop() -> None:
@@ -150,6 +183,25 @@ async def sniffer_worker(log_file: str) -> None:
 
         stop_event = threading.Event()
 
+        loop = asyncio.get_running_loop()
+
+        # Connect to the bus for decky.{id}.traffic fan-out.  Failure here
+        # is non-fatal: the sniffer still writes syslog, it just doesn't
+        # push notifications to downstream consumers.
+        bus: BaseBus | None = None
+        try:
+            candidate = get_bus(client_name="sniffer")
+            await candidate.connect()
+            bus = candidate
+        except Exception as exc:  # noqa: BLE001
+            logger.warning(
+                "sniffer: bus unavailable, running in publish-off mode: %s", exc,
+            )
+
+        publish_fn: Callable[[str, str, dict[str, Any]], None] | None = None
+        if bus is not None:
+            publish_fn = _make_thread_safe_publisher(bus, loop)
+
         # Dedicated thread pool so the long-running sniff loop doesn't
         # occupy a slot in the default asyncio executor.
         sniffer_pool = ThreadPoolExecutor(
@@ -157,10 +209,9 @@ async def sniffer_worker(log_file: str) -> None:
         )
 
         try:
-            loop = asyncio.get_running_loop()
             await loop.run_in_executor(
                 sniffer_pool, _sniff_loop,
-                interface, log_path, json_path, stop_event,
+                interface, log_path, json_path, stop_event, publish_fn,
             )
         except asyncio.CancelledError:
             logger.info("sniffer: shutdown requested")
@@ -169,6 +220,9 @@ async def sniffer_worker(log_file: str) -> None:
             raise
         finally:
             sniffer_pool.shutdown(wait=False)
+            if bus is not None:
+                with contextlib.suppress(Exception):
+                    await bus.close()
 
     except asyncio.CancelledError:
         raise