DEVELOPER GUIDE

Architecture

Observation, decision, execution and verification remain separate, deterministic boundaries.

Current public view

  1. 01Linux node
  2. 02Collectors
  3. 03Structured observations
  4. 04Analysis and triage foundations
  5. 05Monitoring integration
AuditCross-cutting JSONL and SQLite evidence across the operational lifecycle

Collectors

Collectors implement a shared base contract and emit structured observations. Commands use explicit argument vectors through one shared helper with shell=False, bounded timeouts and immutable command results. Direct procfs/sysfs reads are preferred.

Runtime isolation

Enabled collectors run in immutable registry order. A defective collector becomes one bounded audit-safe failure observation while later collectors continue.

Current versus planned

Version 0.0.2 ships the collector foundation and existing dry-run lifecycle. Rich monitoring rules, alerts, operational reporting, SOP automation, notifications, platform APIs and AI-assisted recommendations are later roadmap items.