📄️ 1. Telemetry is durable before it is acknowledged
Architecture decision record 0001 from the Seagull backend.
📄️ 2. Agent identity comes from the certificate
Architecture decision record 0002 from the Seagull backend.
📄️ 3. The protobuf contract is the event model
Architecture decision record 0003 from the Seagull backend.
📄️ 4. Every process starts from the same skeleton
Architecture decision record 0004 from the Seagull backend.
📄️ 5. The canonical form is for analysis, not for storage
Architecture decision record 0005 from the Seagull backend.
📄️ 6. A detection rule addresses the contract
Architecture decision record 0006 from the Seagull backend.
📄️ 7. A rule file is not the rule
Architecture decision record 0007 from the Seagull backend.
📄️ 8. A ruleset is named by what is in it
Architecture decision record 0008 from the Seagull backend.
📄️ 9. An absent field answers no question
Architecture decision record 0009 from the Seagull backend.
📄️ 10. A rule carries the cases it was written for
Architecture decision record 0010 from the Seagull backend.
📄️ 11. A detection is not an alert
Architecture decision record 0011 from the Seagull backend.
📄️ 12. Storage is owned per workload, and an alert is not a detection
Architecture decision record 0012 from the Seagull backend.
📄️ 13. A query is a scope, a window and a question
Architecture decision record 0013 from the Seagull backend.
📄️ 14. A token says who, and the policy says what
Architecture decision record 0014 from the Seagull backend.
📄️ 15. A ruleset is published to a log, and the pointer is the only mutable thing
Architecture decision record 0015 from the Seagull backend.
📄️ 16. An alert is a detection somebody owns
Architecture decision record 0016 from the Seagull backend.
📄️ 17. Noise is removed from the alert plane, never from the detection stream
Architecture decision record 0017 from the Seagull backend.
📄️ 18. Detection state is a bounded window of the backbone, in event time
Architecture decision record 0018 from the Seagull backend.
📄️ 19. A rule that counts decides on the window, once per event, and says what it counted
Architecture decision record 0019 from the Seagull backend.
📄️ 20. A sequence is a rule whose stages are ordered in event time, decided once per window that holds it
Architecture decision record 0020 from the Seagull backend.
📄️ 21. An incident is a correlation somebody owns, and how far its order can be trusted is measured
Architecture decision record 0021 from the Seagull backend.
📄️ 22. Sigma is translated and never adopted, and what it can say here is what the canonical form made comparable
Architecture decision record 0022 from the Seagull backend.
📄️ 23. Detection state is owned by the partition that feeds it, and rebuilt by reading that partition back
Architecture decision record 0023 from the Seagull backend.
📄️ 24. An agent is registered by the control plane, and the gateway is told when to stop honouring it
Architecture decision record 0024 from the Seagull backend.
📄️ 25. The platform signs the identity it binds, and an agent renews with the certificate it is replacing
Architecture decision record 0025 from the Seagull backend.
📄️ 26. An agent sends into the tenant it was registered in, and an agent the registry never named is not admitted
Architecture decision record 0026 from the Seagull backend.
📄️ 27. Inventory is a record kind of its own, and what an asset currently has is what the newest full scan named
Architecture decision record 0027 from the Seagull backend.
📄️ 28. Vulnerability intelligence is a record kind of its own, read from its source and never inferred from what a feed left out
Architecture decision record 0028 from the Seagull backend.