DEVELOPER GUIDE
Architecture
Observation, decision, execution and verification remain separate, deterministic boundaries.
Current public view
- 01Linux node
- 02Collectors
- 03Structured observations
- 04Analysis and triage foundations
- 05Monitoring integration
AuditCross-cutting JSONL and SQLite evidence across the operational lifecycle
Collectors
Collectors implement a shared base contract and emit structured observations. Commands use explicit argument vectors through one shared helper with shell=False, bounded timeouts and immutable command results. Direct procfs/sysfs reads are preferred.
Runtime isolation
Enabled collectors run in immutable registry order. A defective collector becomes one bounded audit-safe failure observation while later collectors continue.
Current versus planned
Version 0.0.2 ships the collector foundation and existing dry-run lifecycle. Rich monitoring rules, alerts, operational reporting, SOP automation, notifications, platform APIs and AI-assisted recommendations are later roadmap items.