Documentation coverage map

This map covers every discovered backend top-level internal package, every executable, every agent package, and all canonical schema families at the source baseline. It is a maintenance inventory, not a claim that planned components are implemented.

Backend owners

Package / owner	Canonical guide
cmd	backend/services
ingest, agentidentity	ingestion/gateway
broker	event-pipeline/streaming
event, protocol	contracts/event-model
analysis, detection	detection/overview
detectionstate	architecture/state-correctness
rulefile	detection/rules
ruleset, sigma	detection/rulesets
alert, alertfile, alertstore	correlation/alerts
incident	correlation/incidents
inventory, inventorystore	inventory/overview
vulnerability, advisoryfeed, advisorystore, osv	vulnerability-management/overview
clickhouse, postgres, eventstore, detectionstore	storage/ownership
authz, policyfile	security/authentication
agent, pki, devpki	security/enrollment
control	api/overview
hunt	api/hunting
platform	observability/health

Executables

advisory-importer, advisory-writer, alert-writer, analysis-engine, backbone-migrator, control-api, control-migrator, detection-writer, event-writer, ingest-gateway, inventory-projector, query-api, store-migrator. Each is described in service responsibilities and has a configuration reference.

Agent packages

Package	Guide
runtime	Agent runtime
modules	Agent collectors
config	Agent configuration
identity	Agent identity
pki	Agent keys
protocol	Agent compatibility
secrets	Agent diagnostics
platform/files	Agent identity
platform/privileges	Agent privileges
platform/dumps	Agent diagnostics

Remaining domains

All twelve schema families appear in contracts. All 28 backend ADRs appear under Architecture → Decisions. Every SQL migration is included in the storage reference. Runtime metric declarations appear in metrics.

Installation, Docker/deployment, PKI, threat modeling, data ownership, configuration, troubleshooting, tests, CI, contribution, and status each have explicit sections. Native agent packaging, heartbeat, secure updates, SCA/FIM/process/network collectors, vulnerability matching, and V2 frontend architecture are documented as targets. No unsupported operational command is supplied to fill those gaps.