Skip to content

P0_RUNTIME_ARCHITECTURE.md

Latest commit

 

History

History
116 lines (97 loc) · 4.47 KB

P0_RUNTIME_ARCHITECTURE.md

File metadata and controls

116 lines (97 loc) · 4.47 KB
Raw

Azazel-Edge P0 Runtime Architecture

Last updated: 2026-05-13 Scope: Minimum runtime architecture after P0 baseline completion.

1. P0 Completion Scope

Completed issues:

  • #10 Evidence Plane v1
  • #9 Lightweight NOC monitoring v1
  • #11 NOC Evaluator v1
  • #12 SOC Evaluator v1
  • #13 Action Arbiter v1
  • #8 Lightweight SoT v1
  • #14 Decision Explanation v1
  • #15 AI Assist Governance v1
  • #16 Notification v1
  • #17 Minimal audit logging baseline v1
  • #5 Epic: P0 baseline

2. P0 Decision Pipeline

  1. Tactical Engine first-minute triage
  2. suricata_eve / noc_probe / syslog_min
  3. Evidence Plane
  4. NOC Evaluator / SOC Evaluator
  5. Action Arbiter
  6. Decision Explanation
  7. Notification / AI Assist Governance
  8. P0 Audit Logger

3. Implementation Modules

3.1 Evidence Plane

3.2 NOC Monitoring

Collectors:

  • icmp
  • iface_stats
  • cpu_mem_temp
  • dhcp_leases
  • arp_table
  • service_health

3.3 Evaluators

3.4 Arbiter

3.5 SoT

3.6 Explanation

Required fields:

  • why_chosen
  • why_not_others
  • evidence_ids
  • operator_wording

3.7 AI Governance

Guardrails:

  • Invoke AI only when governance conditions match.
  • Send only sanitized payload.
  • Limit output class to advice / summary / candidate.
  • Audit adopt / fallback decisions.

Governance scope:

  • In scope:
    • Operator-facing runbook support and wording assist that consume or produce advice / summary / candidate
    • NOC/SOC support calls from deterministic outputs (post-evaluator/arbiter)
  • Out of scope:
    • Analyst model scoring payloads in py/azazel_edge_ai/agent.py (verdict/confidence/reason/suggested_action/escalation schema)
    • Ops coach structured responses (runbook_id/summary/operator_note) in py/azazel_edge_ai/agent.py
    • Manual ask structured responses (answer/confidence/runbook_id/operator_note/user_message) in py/azazel_edge_ai/agent.py
  • Out-of-scope calls must still emit audit scope records (in_scope=false) and must not bypass deterministic evaluator/arbiter decisions.

3.8 Notification

3.9 Audit Logging

Common fields:

  • ts
  • kind
  • trace_id
  • source

4. Current Constraints

  • Evaluator/arbiter/explanation are implemented as libraries, but not every legacy path is fully refactored.
  • P0 keeps deterministic evaluators primary and AI assist secondary.
  • Advanced correlation prediction, TI/YARA/Sigma, and external CMDB sync are out of P0 scope.

5. Tests

Primary P0 baseline tests: