Architectural Decision Records (ADR) Registry

This directory serves as the immutable registry of Architectural Decision Records (ADRs) for the TIDIR platform. Every significant architectural, schema, runtime, and governance choice is documented following the MADR (Markdown Architectural Decision Records) standard.

---

Registry Overview

All decisions are recorded as version-controlled markdown documents alongside the architecture specifications. Visual state machines and topologies within ADRs are authored in declarative Mermaid syntax and validated programmatically in CI/CD.

Total Decisions: 21 | Accepted: 21 | Deprecated: 0 | Superseded: 0

---

1. Governance & Strategy

ADR	Title	Status	Deciders	Summary
0001	Record Architecture Decisions	accepted	Architecture Team / Harry	Establishes MADR markdown records with version-controlled Mermaid diagrams as the governance standard.
0008	SecOps Error Budgets & Chaos Engineering	accepted	SecOps / SRE Team	Adopts SRE Alert Noise Error Budgets (false-positive rate $\le 5\mathrm{\%}$ ) with automated CI/CD deployment freezes on budget exhaustion.
0010	SABSA Alignment & Attribute Profiling	accepted	Enterprise Architecture	Maps all TIDIR capabilities to the SABSA 6x6 matrix and operational security attribute profiles.
0021	Graceful Degradation & Continuity Plan B	accepted	Architecture / SecOps / SRE	Codifies a 4-tier capabilities-driven degradation model, failure detection probes, and automated Plan B fallbacks across all layers.

---

2. Data Fabric & Ingress

ADR	Title	Status	Deciders	Summary
0002	Preserve Unmapped OCSF Telemetry	accepted	Data Engineering	Mandates preserving non-standard raw fields inside an unmapped_data JSON object to prevent telemetry loss.
0015	Sandboxed Agent Execution & OTLP Convergence	accepted	SecOps / AI Platform	Runs specialist agents in gVisor/Firecracker microVMs emitting standard OTLP spans, unified with enterprise APM.
0016	JIT Telemetry Elevation & Ephemeral Forensics	accepted	SecOps / Detection Leads	Implements dynamic agent-driven sensor elevation (eBPF, PCAP, memory) with strict TTLs ( $\le 30\text{min}$ ) and auto-eviction.

---

3. Detection Engineering & Threat Intelligence

ADR	Title	Status	Deciders	Summary
0007	Continuous Purple Teaming & Consensus	accepted	Detection Engineering	Enforces automated adversary emulation in CI/CD with Proposer/Challenger multi-model consensus on rule logic.
0009	Bayesian Multi-Signal Risk Scoring	accepted	Detection Engineering	Overcomes the Base Rate Fallacy by compounding orthogonal weak signals (asset, identity, network) into a composite score.
0011	Bipartite Entity-Finding Graph Consolidation	accepted	Detection & Graph Leads	Structures detection correlation as a bipartite graph of Entities and Findings with community detection clustering.
0013	Ambient Deception Fabric & Canary Anchors	accepted	SecOps / Red Team	Deploys low-overhead honeytokens and canary assets emitting zero-noise high-confidence alerts with instant triage priority.
0019	Polyglot Detection-as-Code & Native Engines	accepted	Architecture / Detection Leads	Pairs vendor-neutral YAML metadata envelopes with target-optimized query blocks (KQL, SPL, SQL) and AI-driven parity testing.

---

4. Investigation & Automated Response

ADR	Title	Status	Deciders	Summary
0003	Supernode Pruning & Graph Boundaries	accepted	Investigation Leads	Solves graph explosion by pruning high-degree utility nodes (DNS, shared DCs) during automated graph traversal.
0005	Asymmetric Containment & Break-Glass Protocol	accepted	SecOps Leads	Executes containment as distributed Sagas with forward escalation on failure and audited human-in-the-loop break-glass overrides.
0020	Operator Skill Retention & Incident Replay	accepted	SecOps / AI Platform	Counteracts the Ironies of Automation via forensic currency quotas, workload throttling, and incident replay simulators.

---

5. AI Runtime, Agent Safety & Observability

ADR	Title	Status	Deciders	Summary
0004	Defensive AI & Agent Trust Boundary	accepted	AI Platform / SecOps	Isolates untrusted telemetry payloads to a sandboxed Data Plane, preventing indirect prompt injection attacks.
0006	Agent Evaluation Harness (Evals-as-Code)	accepted	AI Platform Leads	Implements continuous regression testing of agent prompts and triage accuracy against versioned golden datasets.
0012	AI Orchestration Runtime & MCP Roadmap	accepted	AI Platform / Architecture	Standardises tool interfaces on the Model Context Protocol (MCP) and defines phased MVP milestones.
0014	AI Observability & SLM Judges	accepted	AI Platform Leads	Deploys local Small Language Model (SLM) judges for real-time hallucination checks, groundedness audits, and cost tracking.
0017	Agent Fleet Control Plane & Loop Breakers	accepted	AI Platform Leads	Implements supervisor-driven agent lifecycle management, zombie task reaping, semantic loop breakers, and priority preemption.
0018	Non-Human Identity Lifecycle & Machine Attestation	accepted	Identity / Cloud Security	Enforces cryptographic SPIFFE/SPIRE attestation for ephemeral agent identities and line-rate profiling of service credentials.

---

Proposing New Architecture Decisions

To propose a new architecture decision:

1. Copy template.md to a new file: docs/adr/00XX-my-decision-title.md.
2. Populate the context, decision drivers, considered options, and trade-offs.
3. Submit a Pull Request following the Contributing Guide.