Litju · Litju · Aug 30, 2026 · Aug 30, 2026
@@ -5,86 +5,108 @@
 [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/Litju/Sec-Scan-Monitor/badge)](https://securityscorecards.dev/viewer/?uri=github.com/Litju/Sec-Scan-Monitor)
 [![License](https://img.shields.io/badge/license-source--available-5b6472.svg)](LICENSE)
 
-<p align="center">
-  <img src="apps/web/app/icon.svg" alt="SecScanMonitor product mark" width="128">
-</p>
+<p align="center"><img src="apps/web/app/icon.svg" alt="SecScanMonitor product mark" width="128"></p>
 
-> **SecScanMonitor is an evidence-first cybersecurity platform for AI agents, workflows, and agent-built software.**
+> **SecScanMonitor is an evidence-first autonomous cybersecurity firm platform for software, AI agents, MCP/A2A systems, workflows, and agent-built systems.**
 
-This repository is a source-visible/source-available publication. It is **not
-open source**. The restrictive evaluation license permits viewing, permitted
-cloning, and private execution of unmodified copies for non-production
-evaluation, testing, security research, or assessment of a potential
-commercial license. See LICENSE.
+It is not a chatbot, a generic SIEM, or an autonomous hacking agent. Security work remains contract-bound, evidence-grounded, advisory-first, and subject to explicit authority.
 
-## Platform scope
+This repository is **SOURCE-VISIBLE / SOURCE-AVAILABLE**. It is **NOT OPEN SOURCE**. The restrictive evaluation license permits viewing, permitted cloning, and private execution of unmodified copies for non-production evaluation, testing, security research, or assessment of a potential commercial license. See [LICENSE](LICENSE).
 
-SecScanMonitor keeps security work bounded, evidence-first, and advisory-first:
+## Current capabilities
 
-- **Cases and targets:** contract-bound engagements with explicit scope,
-  authority, and lifecycle state.
-- **Agent security:** inspection paths for agent-built systems, workflows, and
-  software without allowing an agent to self-authorize or create a finding.
-- **Policy and execution:** deterministic OPA decisions, capability manifests,
-  sandboxed execution boundaries, and refusal on missing authority.
-- **Evidence and adjudication:** provenance-backed evidence, observations,
-  claims, adjudication, Findings, and advisory reports.
-- **Security services:** generic extension contracts for AppSec, vulnerability
-  intelligence, supply-chain security, and other bounded specialist services.
-- **Product surfaces:** local APIs, controlled read models, a public UI, and
-  synthetic examples for safe evaluation.
+### Inspection
 
-The canonical chain is:
+- AppSec
+- Agent Security
+- Vulnerability Intelligence
+- Supply Chain
 
-    EvidenceObject -> Observation -> Claim -> Adjudication -> Finding -> Report
+### Continuous Security
 
-Agents produce claims with evidence references. Adjudication is the control
-point for authoritative Findings; incomplete evidence remains explicitly
-uncertain or not validated.
+- Security Graph and Security Event Plane
+- Continuous Patrol with no-change/no-noise semantics
+- MCP/A2A Agent Security Gateway and customer-side Edge Runner
+- restart/replay reconstruction from canonical state
 
-## Architecture
+### Detection & Response — v0.3
 
-The platform uses inward dependency direction:
+- authenticated, scope-bound security-event ingest into canonical PostgreSQL `SecurityEvent` records;
+- durable detection orchestration, bounded Sigma-compatible rules, `DetectionRun` records, and `Signal` records;
+- bounded correlation, Threat Hunting, and `IncidentHypothesis` records;
+- canonical evidence and claims, adjudication, and explicit Incident creation;
+- governed `ResponseProposal` records evaluated by real OPA and requiring human approval.
 
-    adapters -> application -> domain
+**RESPONSE EXECUTION IS NOT ENABLED.**
 
-PostgreSQL, OPA, Temporal, Docker sandboxing, object storage, and FastAPI are
-replaceable adapters around the platform contracts. The public UI defaults to a
-read-only synthetic preview. Hosted operation, live external systems, and
-production deployment are not validated by this publication.
+### Product surfaces
 
-## Run it locally
+The Web Command Center, OpenTUI Operator Console, and API consume shared canonical state. Preview data remains available for safe evaluation, but it is not the qualified live topology.
 
-### Platform core
+## Canonical chains
+
+Inspection:
+
+```text
+Evidence -> Observation -> Claim -> Adjudication -> Finding -> Report
+```
+
+Detection & Response:
+
+```text
+External Security Source -> SecurityEvent -> DetectionRun -> Signal
+-> Correlation / Hunt -> IncidentHypothesis -> Observation / Claim
+-> Adjudication -> Incident -> ResponseProposal -> OPA -> Human Approval
+```
 
-    cd analysis
-    python -m venv .venv
-    python -m pip install -e '.[dev]'
-    python -m pytest -q
-    python -m mypy src
-    python -m ruff check src tests
+Signal != Incident. Tool output != truth. ATT&CK/ATLAS mapping != proof. LLM != authority. Approval != execution.
 
-### Web surface
+## v0.3 qualification status
 
-    cd apps/web
-    npm ci
-    npm test
-    npm run typecheck
-    npm run lint
-    npm run build
+The v0.3 system was qualified with controlled synthetic live telemetry using real network transport, PostgreSQL, repository-pinned OPA, separate producer, API, and worker processes, MCP/A2A, Edge Runner, Web, and OpenTUI.
+
+The campaign qualified a benign no-noise baseline; endpoint, cloud/identity, and agent/MCP scenarios; correlation; Hunt; Incident adjudication; `ResponseProposal`; restart/replay; cross-tenant and cross-case denial; failure injection; and integrated Web/TUI operation. This is controlled qualification evidence, not customer production validation.
+
+Limitations: there is no production deployment, formal release or tag, response executor, or DFIR capability. Sigma compatibility is a bounded subset. Performance figures are qualification-only and are not product benchmarks.
+
+## Run it locally
+
+### Platform core
 
-The web application uses synthetic, non-personal, non-client data by default.
-Read docs/DEVELOPMENT.md for the local loop and docs/SECURITY_MODEL.md for the
-security boundary.
+```bash
+cd analysis
+python -m venv .venv
+python -m pip install -e '.[dev]'
+python -m pytest -q
+python -m mypy src
+python -m ruff check src tests
+```
+
+### Web Command Center
+
+```bash
+cd apps/web
+npm ci
+npm test
+npm run typecheck
+npm run lint
+npm run build
+```
+
+### OpenTUI Operator Console
+
+```bash
+cd apps/tui
+npm ci
+npm test
+npm run typecheck
+npm run build
+```
+
+The default safe evaluation mode may use synthetic preview data. Integrated live mode requires the documented PostgreSQL, repository-pinned OPA, API, and worker environment. See [Development](docs/DEVELOPMENT.md) and the [Security model](docs/SECURITY_MODEL.md).
 
 ## Public boundary
 
-The public tree is an exact, deterministic export. It contains generic
-platform code, public contracts, synthetic examples, and security controls. It
-does not contain client material, raw evidence, credentials, private history,
-or private qualification artifacts. Unknown files and secret-like or
-path-identifying content fail the export.
+The public tree is an exact, deterministic export. It contains generic platform code, public contracts, synthetic examples, and security controls. It does not contain client material, raw evidence, credentials, private history, or private qualification artifacts. Unknown files and secret-like or path-identifying content fail the export.
 
-Issues and security reports may be accepted, but external source-code
-contributions require separate written authorization. See CONTRIBUTING.md and
-SECURITY.md.
+Issues and security reports may be accepted, but external source-code contributions require separate written authorization. See [CONTRIBUTING.md](CONTRIBUTING.md) and [SECURITY.md](SECURITY.md).
@@ -1,18 +1,51 @@
 # Architecture
 
-`IMPLEMENTED` public boundaries:
+PostgreSQL is the canonical state store. Process memory, UI state, agent output, detector output, and transport delivery are not canonical truth.
 
-1. **Domain** — typed identities, engagement lifecycle, authority, capability manifests, evidence metadata, observations, claims, adjudication, and findings.
-2. **Application** — contract and authority services coordinate work without allowing agents to mutate canonical state directly.
-3. **Adapters** — PostgreSQL, local content-addressed evidence, optional S3-compatible evidence, OPA, Temporal, Docker sandbox, and FastAPI are replaceable boundaries.
-4. **Product surface** — the web UI consumes controlled API/read models and presents explicit preview, unavailable, and `NOT_VALIDATED` states.
+## Current composition
 
-The canonical chain is:
+- **Firm Control Plane** binds engagements, targets, principals, scopes, and authority.
+- **Security Graph** preserves scoped security relationships.
+- **Security Event Plane** authenticates and normalizes external telemetry into canonical `SecurityEvent` records.
+- **Detection/Response control plane** leases durable work, records `DetectionRun` and `Signal` state, correlates signals, supports bounded hunts, adjudicates Incidents, and creates governed `ResponseProposal` records.
+- **Authority and OPA** evaluate deterministic policy and fail closed.
+- **Durable workflow** supports restart/replay reconstruction without treating process memory as truth.
+- **Edge Runner and protocol adapters** connect customer-side and MCP/A2A sources through scoped boundaries.
+- **Evidence and adjudication** convert evidence into observations, claims, findings, and incidents only through explicit authority transitions.
+- **Web Command Center, OpenTUI Operator Console, and API** consume shared canonical read models.
+
+Dependency direction remains inward:
+
+```text
+Web / OpenTUI / API / Edge Runner / protocol adapters
+                         |
+                         v
+       application and durable orchestration
+                         |
+                         v
+                 canonical domain
+                         |
+                         v
+ PostgreSQL / OPA / evidence / workflow adapters
+```
+
+## Inspection flow
 
 ```text
-EvidenceObject -> Observation -> Claim -> Adjudication -> Finding
+Evidence -> Observation -> Claim -> Adjudication -> Finding -> Report
 ```
 
 Agents do not construct findings. A finding is an adjudicated conclusion with evidence references, rationale, severity, remediation guidance, verification steps, and confidence.
 
-`EXPERIMENTAL` or `NOT YET QUALIFIED`: managed hosted deployment, external identity providers, production Temporal operation, production object storage, and live-model execution.
+## Detection and response flow
+
+```text
+External event -> canonical SecurityEvent -> durable detection work
+-> DetectionRun / Signal -> explicit triage -> Correlation / Hunt
+-> Observation / Claim -> Adjudication -> Incident -> ResponseProposal
+-> OPA -> Human Approval
+```
+
+A `Signal` cannot directly create an Incident. Hunt output must become canonical evidence and claims before adjudication. OPA and human approval govern proposals only: **v0.3 has no response executor, and approval does not execute an action.**
+
+This public architecture describes the generic SecScanMonitor platform only. Private products, operational evidence, and private qualification artifacts are outside the public boundary.
@@ -0,0 +1,11 @@
+# Current state
+
+Current public capability level: **v0.3 — Detection & Response Firm**.
+
+SecScanMonitor currently provides evidence-first inspection, continuous security, live event ingest, durable bounded detection, Signals, correlation, hunting, Incident adjudication, governed non-executing Response Proposals, and shared Web/OpenTUI/API views of canonical PostgreSQL state.
+
+The v0.3 chain was qualified with controlled synthetic live telemetry across real network transport, PostgreSQL, repository-pinned OPA, separate processes, MCP/A2A, Edge Runner, Web, and OpenTUI. The deterministic public tree was separately qualified for tests, builds, security/dependency scans, leakage, license, SBOM, clean-clone parity, and drift.
+
+Deliberately absent: production deployment, formal release/tag, response execution, DFIR acquisition, full Sigma compatibility, and customer production validation.
+
+The completed roadmap position is v0.3. The next milestone is **v0.4 — DFIR & Security Operations**, beginning with governed evidence acquisition and chain of custody.
@@ -1,7 +1,17 @@
 # Deployment
 
-`IMPLEMENTED`: local/self-hosted composition can be assembled from the Python API, PostgreSQL adapter, optional OPA, optional Temporal, optional sandbox, and the web surface. Bind development services to loopback and provide configuration outside version control.
+## Local evaluation
 
-`NOT VALIDATED`: managed cloud hosting, multi-tenant production isolation, hosted identity, production object storage, production Temporal workers, autoscaling, public ingress, external model providers, and operational SLOs.
+The safe evaluation surface includes the Python platform/API, Web Command Center, and OpenTUI Operator Console. Synthetic preview state is available without claiming external or production operation. Bind development services to loopback and keep configuration outside version control.
 
-The public repository intentionally provides no production credentials, hosted provider project, deployment secret, or managed-cloud claim. A deployment proposal must add an engagement or architecture decision, qualification evidence, rollback, and an explicit go/no-go.
+## Integrated live v0.3
+
+The qualified reference composition uses PostgreSQL as canonical state, the repository-pinned real OPA adapter for governed `ResponseProposal` decisions, separate API and durable worker processes, and Web/OpenTUI consumers of shared canonical read models. Follow the repository development instructions and pin files; do not substitute an in-memory store or approval stub and claim the qualified topology.
+
+**RESPONSE EXECUTION IS NOT ENABLED.**
+
+## Not validated
+
+Managed cloud hosting, multi-tenant production isolation, hosted identity, production object storage, production workflow workers, autoscaling, public ingress, external model providers, and operational SLOs are not validated.
+
+The public repository provides no production credentials, hosted-provider project, deployment secret, or managed-cloud claim. A production deployment requires separate authority, qualification evidence, rollback, and explicit go/no-go. No production deployment is represented by this publication.
@@ -1,6 +1,6 @@
 # Development
 
-## Python
+## Platform core
 
 ```bash
 cd analysis
@@ -10,7 +10,7 @@ python -m mypy src
 python -m ruff check src tests
 ```
 
-## Web
+## Web Command Center
 
 ```bash
 cd apps/web
@@ -21,7 +21,17 @@ npm run lint
 npm run build
 ```
 
-The default web mode is synthetic preview. Run the API and set `SECSCAN_API_URL` only when the local integration is intentionally configured. Do not use live credentials in tests.
+## OpenTUI Operator Console
+
+```bash
+cd apps/tui
+npm ci
+npm test
+npm run typecheck
+npm run build
+```
+
+The default safe evaluation mode may use synthetic preview data. Integrated live mode requires the documented PostgreSQL canonical store, repository-pinned OPA, API, and durable worker environment. Configure live endpoints outside version control and never use live credentials in tests.
 
 ## Change discipline
 

@@ -1,9 +1,9 @@
 # Public/private boundary
 
-The public repository contains reusable platform code, public contracts, synthetic examples, local development documentation, and security controls that can be reviewed without operational context.
+The public repository contains reusable inspection, continuous-security, and v0.3 detection/response control-plane code; Web and OpenTUI product surfaces; public contracts; synthetic examples; local development documentation; and security controls that can be reviewed without private operational context.
 
-Private-only material includes engagement records, client names and reports, raw or exported evidence, ledgers, recovery material, local environment files, credentials, deployment identifiers, private qualification receipts, caches, binaries, legacy archives, and any artifact that identifies a private operator or workspace.
+Private-only material includes engagement records, client names and reports, raw or exported evidence, ledgers, recovery material, local environment files, credentials, deployment identifiers, private/live qualification receipts, caches, binaries, legacy archives, and any artifact that identifies a private operator or workspace.
 
 The export is an explicit source-to-destination map. It is not a heuristic scrubber and it does not infer that an unclassified file is safe. Unknown, symlinked, binary, secret-like, client-specific, path-identifying, or license-uncleared material blocks the export.
 
-The private release state records source revision, manifest digest, exporter version, public tree digest, and the public commit after publication. The public tree contains no private repository history.
+The private release state records source revision, manifest digest, exporter version, public tree digest, and the public commit after publication. The public tree contains no private repository history. Public qualification documentation summarizes sanitized results without exporting private/live receipts or operational evidence.
@@ -1,9 +1,55 @@
 # Roadmap
 
-The public foundation is intentionally narrow.
+## Completed
 
-- `IMPLEMENTED`: typed inspection domain, contract-bound authority, evidence-to-finding chain, deterministic local policy adapter, read-only preview UI, and local development checks.
-- `QUALIFICATION NEXT`: repeatable public dogfood receipt, clean-clone checks, supply-chain evidence, and deeper adapter qualification.
-- `PLANNED`: production-grade hosted identity and storage qualification, operational telemetry qualification, and additional bounded service workflows.
+### v0.1 — Inspection Firm
 
-No roadmap item authorizes a new service, a target mutation path, a hosted production claim, or a formal product release by itself.
+Evidence-first inspection, adjudication, findings, and reports.
+
+### v0.2 — Continuous Security Firm
+
+- Security Graph
+- Continuous Patrol
+- Agent Security Gateway
+- Edge Runner
+- Web V2
+- OpenTUI V1
+- external live qualification
+
+### v0.3 — Detection & Response Firm
+
+- live event ingest
+- durable detection
+- bounded Sigma compatibility
+- correlation
+- hunting
+- incident adjudication
+- governed Response Proposals
+- Web and OpenTUI
+- live qualification
+- public source-visible publication
+
+## Next
+
+### v0.4 — DFIR & Security Operations
+
+Planned foundation:
+
+- Investigation domain
+- forensic acquisition authority
+- `ForensicArtifact`
+- artifact manifests
+- hash and integrity controls
+- chain of custody
+- retention and legal hold
+- recovery verification
+- Windows reference acquisition
+- Web/OpenTUI investigation experience
+
+## Later
+
+- v0.5 — Authorized Active Security & Purple Team
+- v0.6 — Enterprise Platform
+- v1.0 — Enterprise Autonomous Security Firm
+
+No roadmap item authorizes a new service, a target mutation path, a hosted production claim, or a formal product release by itself. Planned items are not implemented capabilities, and this roadmap makes no date commitments.