tinysocs-architecture-contract

Only the C# agent engine fires alerts, evaluating threshold_by_key rules inline in the OpenSearchBulkShipper batch loop before events are posted. The Python KQL rules.yaml catalogue has no scheduler and never fires alerts in production.

PackLoader verifies an Ed25519 signature over canonical JSON bytes, pins the key_id, and licence-gates before loading rules. However, ContentPackConfig.Enabled defaults to false, so this signed path is implemented and tested but dormant in every real install.

No, runs_on is an authoring convention only. Neither RuleLoader nor PackLoader checks it; a runs_on: backend rule with detection.type threshold_by_key would load and fire as an agent rule. Adding real enforcement is open work.

EventLogInput.cs has a hard-coded TS-080 direct-alert fast path that bypasses the detection engine, while rules.yml also defines a regular TS-080 engine rule. The two paths are not reconciled, so one real-world event can yield two alert documents.

Documented weak points include no allowlist runtime, schema-only baselines outside FIM, mostly unauthenticated dashboard rule CRUD endpoints, and /storage/purge shipping unauthenticated by default since it uses the conditional HMAC gate.

Do not use it for build or deployment steps, symptom-first debugging triage, rule threshold semantics, external positioning claims, or change-approval decisions. Those belong to the build-and-env, debugging-playbook, detection-engineering, external-positioning, and change-control references respectively.