{
  "$schema_note": "Source of truth for the architecture explorer (docs/explorer/), Mermaid diagrams, and component relationship tables. Statuses: implemented | partial | planned. Layers: 1=people, 2=agents, 3=choke_points, 4=control_plane, 5=infrastructure, 6=outputs. Validated by scripts/validate-docs.mjs.",
  "version": 1,
  "flows": {
    "known_agent": "Known agent action: SDK -> gateway -> policy -> (approval) -> execute -> receipt -> SOC",
    "anonymous_agent": "Anonymous agent: run created -> signed command -> sensor -> cage -> egress/broker -> runtime events -> contain",
    "approval": "Approval lifecycle: require_approval -> human decision on frozen hash -> single-use consume",
    "receipt": "Receipt chain: canonical body -> hash -> prev-hash link -> verify -> evidence pack",
    "soc_incident": "SOC: decision/runtime events -> detect -> correlate -> alert -> incident -> respond",
    "ban_quarantine": "Containment: detection or analyst -> freeze/quarantine/revoke/ban -> auth fails closed",
    "egress_block": "Egress: sandbox traffic -> egress proxy allowlist -> block + runtime event (planned)",
    "prompt_lineage": "Prompt-to-action lineage: ingest/prompt capture -> trust label -> action hash -> receipt (partial)"
  },
  "nodes": [
    { "id": "developer", "label": "Developer", "layer": 1, "type": "person", "status": "implemented", "description": "Integrates the SDK, registers agents/tools, writes Cedar policy.", "related_docs": ["onboarding/For_SDK_Developer.md"] },
    { "id": "soc_analyst", "label": "SOC Analyst", "layer": 1, "type": "person", "status": "implemented", "description": "Investigates alerts/incidents in the console; freezes, quarantines, revokes agents.", "related_docs": ["onboarding/For_SOC_Analyst.md"] },
    { "id": "approver", "label": "Human Approver", "layer": 1, "type": "person", "status": "implemented", "description": "Approves or rejects the exact frozen action (hash-bound), via console or Slack.", "related_docs": ["components/Approval_Engine.md"] },
    { "id": "admin", "label": "Admin / Tenant Operator", "layer": 1, "type": "person", "status": "implemented", "description": "Manages tenants, tokens, API keys, policies, deployments.", "related_docs": ["production-hardening.md"] },

    { "id": "known_agent", "label": "Known Agent (SDK)", "layer": 2, "type": "agent", "status": "implemented", "description": "Cooperative agent whose tool calls are wrapped by @protect_tool / protect().", "related_files": ["sdk-python/aegisagent/decorator.py", "sdk-go/aegis/protect.go", "sdk-typescript/src/protect.ts"], "related_docs": ["flows/Known_Agent_Flow.md"] },
    { "id": "mcp_agent", "label": "MCP Agent", "layer": 2, "type": "agent", "status": "implemented", "description": "Agent calling tools on registered MCP servers; gated by manifest pinning + drift detection.", "related_files": ["src/src/routes/mcp.rs", "lib/soc/src/mcp_inspect.rs"], "related_docs": ["components/MCP_Gateway.md"] },
    { "id": "anon_agent", "label": "Anonymous / Unknown Agent", "layer": 2, "type": "agent", "status": "partial", "description": "Untrusted workload. Run registry + runtime-event ingest exist; sandbox execution is designed (cage runner), not implemented.", "related_files": ["lib/storage/src/db/agent_runs.rs", "lib/storage/src/db/runtime_events.rs"], "related_docs": ["flows/Unknown_Agent_Cage_Flow.md", "AegisAgent_Agent_Cage.md"] },
    { "id": "ci_agent", "label": "CI / Browser Agent", "layer": 2, "type": "agent", "status": "planned", "description": "CI-runner and browser-automation agents; target consumers of the node sensor + cage.", "related_docs": ["AegisAgent_Runtime_Data_Plane.md"] },

    { "id": "sdk", "label": "Aegis SDK", "layer": 3, "type": "choke_point", "status": "implemented", "description": "Fail-closed client: canonicalizes the action (aegis-jcs-1), computes action_hash, authorizes, polls approvals, refuses to execute on mismatch/expiry/unreachable-gateway.", "related_files": ["sdk-python/aegisagent/client.py", "sdk-python/aegisagent/canon.py", "sdk-go/aegis/client.go", "sdk-typescript/src/client.ts"], "related_docs": ["components/SDK.md", "fail-closed-behavior.md"] },
    { "id": "gateway", "label": "Aegis Gateway", "layer": 3, "type": "choke_point", "status": "implemented", "description": "Central authorization + control-plane API (Axum REST :8080, gRPC :6334). Every known-agent action passes through POST /v1/authorize.", "related_files": ["src/src/main.rs", "src/src/routes/authorize.rs", "src/src/routes/mod.rs"], "related_routes": ["/v1/authorize", "/v1/agents/*", "/v1/approvals/*", "/v1/receipts/*"], "related_docs": ["Architecture_Overview.md", "runtime-authorization-api.md"] },
    { "id": "mcp_gateway", "label": "MCP Gateway (Lite)", "layer": 3, "type": "choke_point", "status": "implemented", "description": "MCP server/tool registry inside the gateway: discovery, manifest hash pinning, drift classification, unknown-tool deny.", "related_files": ["src/src/routes/mcp.rs", "lib/soc/src/mcp_inspect.rs"], "related_tables": ["mcp_servers", "mcp_tools", "mcp_manifest_snapshots"], "related_docs": ["components/MCP_Gateway.md", "mcp-defense-architecture.md"] },
    { "id": "tool_broker", "label": "Tool Broker", "layer": 3, "type": "choke_point", "status": "planned", "description": "Credential-isolating executor: sandboxed agents call the broker, never hold raw secrets (Phase 6).", "related_docs": ["components/Tool_Broker.md"] },
    { "id": "egress_proxy", "label": "Egress Proxy", "layer": 3, "type": "choke_point", "status": "planned", "description": "Forced network path for caged workloads: allowlists, block + evidence on violation (Phase 5).", "related_docs": ["components/Egress_Proxy.md"] },
    { "id": "cage_runner", "label": "Agent Cage Runner", "layer": 3, "type": "choke_point", "status": "planned", "description": "Disposable sandbox launcher for unknown agents: isolated workspace, no host FS/Docker socket/raw credentials (Phase 4).", "related_docs": ["AegisAgent_Agent_Cage.md"] },
    { "id": "node_sensor", "label": "Node Sensor", "layer": 3, "type": "choke_point", "status": "planned", "description": "Host/K8s/CI-local sensor: runtime telemetry, durable event queue, signed-command enforcement (Phase 3).", "related_docs": ["components/Node_Sensor.md", "AegisAgent_Control_Command_Protocol.md"] },

    { "id": "auth_engine", "label": "Auth / Tenant Engine", "layer": 4, "type": "control_plane", "status": "implemented", "description": "Bearer/JWT (rotatable secrets), optional mTLS agent identity, tenant existence check (bloom-filtered), per-tenant rate limits and quotas.", "related_files": ["src/src/routes/mod.rs", "src/src/mtls.rs", "lib/storage/src/tenant_bloom.rs"], "related_docs": ["production-hardening.md"] },
    { "id": "policy_engine", "label": "Policy Engine (Cedar)", "layer": 4, "type": "control_plane", "status": "implemented", "description": "Deterministic allow/deny/require_approval; trust-provenance gating (6 levels, tighten-only); risk scoring; hot reload; signed bundles.", "related_files": ["lib/policy/src/cedar.rs", "lib/policy/src/trust_chain.rs", "lib/policy/src/risk.rs", "policies.cedar"], "related_docs": ["adr/0001-cedar-policy-engine.md"] },
    { "id": "approval_engine", "label": "Approval Engine", "layer": 4, "type": "control_plane", "status": "implemented", "description": "Approvals bound to SHA-256 of the frozen action; edit re-hashes + re-evaluates; single-use atomic consume; TTL expiry; brute-force tracker.", "related_files": ["src/src/routes/approval.rs", "lib/storage/src/db/approvals.rs"], "related_tables": ["approvals"], "related_docs": ["components/Approval_Engine.md"] },
    { "id": "receipt_engine", "label": "Receipt Engine", "layer": 4, "type": "control_plane", "status": "implemented", "description": "Per-tenant hash-chained action receipts (aegis-jcs-1), optional Ed25519 signing, verify single/range/chain endpoints.", "related_files": ["src/src/routes/receipts.rs", "src/src/routes/authorize_receipts.rs", "src/src/sign.rs", "lib/storage/src/db/receipts.rs"], "related_tables": ["action_receipts"], "related_docs": ["components/Receipt_Engine.md", "action-receipt-spec.md"] },
    { "id": "soc_engine", "label": "SOC Engine", "layer": 4, "type": "control_plane", "status": "implemented", "description": "Async pipeline: ingest -> detect (rules/DSL/baselines) -> correlate (alerts->incidents) -> respond (playbooks) -> notify/export. Never in the inline authorize path.", "related_files": ["lib/soc/src/detect.rs", "lib/soc/src/correlate.rs", "lib/soc/src/respond.rs", "lib/soc/src/events.rs"], "related_tables": ["soc_alerts", "soc_incidents", "detection_rules"], "related_docs": ["components/SOC_Engine.md"] },
    { "id": "ban_engine", "label": "Ban / Quarantine Engine", "layer": 4, "type": "control_plane", "status": "partial", "description": "Freeze/unfreeze/revoke/restore + quarantine implemented via agent status; first-class agent_bans and quarantine_records stores exist; sensor-enforced bans await the control-command dispatch path.", "related_files": ["src/src/routes/agents.rs", "lib/soc/src/respond.rs", "lib/storage/src/db/agent_bans.rs", "lib/storage/src/db/quarantine.rs"], "related_tables": ["agent_bans", "quarantine_records"], "related_docs": ["flows/Ban_Quarantine_Flow.md"] },
    { "id": "control_commands", "label": "Control Command Protocol", "layer": 4, "type": "control_plane", "status": "partial", "description": "Signed, tenant-bound, replay-protected commands (start/pause/kill/quarantine/ban) to sensors. Store exists; signing/dispatch/ACK routes are designed, not implemented.", "related_files": ["lib/storage/src/db/control_commands.rs"], "related_tables": ["control_commands"], "related_docs": ["AegisAgent_Control_Command_Protocol.md", "flows/Control_Command_Flow.md"] },
    { "id": "evidence_graph", "label": "Evidence Graph", "layer": 4, "type": "control_plane", "status": "implemented", "description": "Links decisions, approvals, receipts, alerts, incidents per run/agent for investigation.", "related_files": ["src/src/graph.rs", "lib/api/src/graph.rs"], "related_routes": ["/v1/graph/run/:run_id", "/v1/graph/agent/:agent_id"], "related_docs": ["evidence-graph.md"] },

    { "id": "storage", "label": "SQLite / PostgreSQL", "layer": 5, "type": "infrastructure", "status": "implemented", "description": "StorageBackend trait over SQLite (WAL, optional SQLCipher) or Postgres; 30 migrations; tenant-scoped parameterized queries only.", "related_files": ["lib/storage/src/traits.rs", "lib/storage/src/db/mod.rs"], "related_docs": ["database-schema.md", "adr/0002-sqlite-first-storage.md"] },
    { "id": "qdrant", "label": "Qdrant (semantic index)", "layer": 5, "type": "infrastructure", "status": "implemented", "description": "Optional vector index for semantic audit search.", "related_files": ["lib/soc/src/qdrant.rs"], "related_docs": ["qdrant-integration.md"] },
    { "id": "event_bus", "label": "Event Sink (in-process)", "layer": 5, "type": "infrastructure", "status": "implemented", "description": "Async channel decoupling the authorize hot path from the SOC pipeline; drained on graceful shutdown.", "related_files": ["lib/soc/src/events.rs"], "related_docs": ["components/SOC_Engine.md"] },
    { "id": "otel", "label": "OpenTelemetry / Metrics", "layer": 5, "type": "infrastructure", "status": "implemented", "description": "Prometheus /metrics; OTLP traces + metrics gated on AEGIS_OTLP_ENDPOINT; tokio runtime metrics; Grafana dashboards.", "related_files": ["src/src/otel.rs", "lib/common/src/metrics.rs"], "related_docs": ["performance-baseline.md"] },
    { "id": "cicd", "label": "CI/CD + Supply Chain", "layer": 5, "type": "infrastructure", "status": "implemented", "description": "fmt/clippy/tests/coverage/fuzz/mutation/SAST/secret+container scans; cosign-signed releases with SLSA provenance and SBOMs.", "related_files": [".github/workflows/ci.yml", ".github/workflows/release-publish.yml"], "related_docs": ["Repo_Knowledge_Map.md"] },
    { "id": "kubernetes", "label": "Kubernetes / Helm / Compose", "layer": 5, "type": "infrastructure", "status": "implemented", "description": "Helm chart (probes, policy hot-reload), Docker Compose local stacks.", "related_files": ["helm/aegis-gateway/Chart.yaml", "docker-compose.yml"], "related_docs": ["deployment-guide.md"] },

    { "id": "receipts_out", "label": "Receipts", "layer": 6, "type": "output", "status": "implemented", "description": "Tamper-evident, independently verifiable proof of every protected action.", "related_docs": ["action-receipt-spec.md", "flows/Receipt_Flow.md"] },
    { "id": "alerts_out", "label": "Alerts & Incidents", "layer": 6, "type": "output", "status": "implemented", "description": "Detection hits correlated into incidents with narratives and timelines.", "related_docs": ["components/SOC_Engine.md"] },
    { "id": "evidence_pack", "label": "Evidence Packs", "layer": 6, "type": "output", "status": "implemented", "description": "Compliance export (GET /v1/compliance/evidence-pack) for SOC 2 / EU AI Act Art. 14.", "related_routes": ["/v1/compliance/evidence-pack"], "related_docs": ["components/Receipt_Engine.md"] },
    { "id": "audit_logs", "label": "Audit Logs", "layer": 6, "type": "output", "status": "implemented", "description": "Decision-linked audit events; policy transparency log is itself hash-chained.", "related_routes": ["/v1/audit/events", "/v1/policies/audit-log"], "related_docs": ["event-schema.md"] },
    { "id": "dashboards_out", "label": "SOC Console Dashboards", "layer": 6, "type": "output", "status": "implemented", "description": "React/Vite console served at /dashboard: overview, fleet, integrity, approvals.", "related_files": ["ui-next/src/dashboards/system/overview.ts"], "related_docs": ["components/Console_UI.md"] }
  ],
  "edges": [
    { "from": "developer", "to": "sdk", "label": "wraps tools with @protect_tool", "flow": "known_agent" },
    { "from": "known_agent", "to": "sdk", "label": "tool call intercepted", "flow": "known_agent" },
    { "from": "sdk", "to": "gateway", "label": "POST /v1/authorize (action_hash)", "flow": "known_agent", "security_boundary": true },
    { "from": "gateway", "to": "auth_engine", "label": "tenant auth + rate limits", "flow": "known_agent" },
    { "from": "gateway", "to": "policy_engine", "label": "Cedar + trust provenance", "flow": "known_agent" },
    { "from": "policy_engine", "to": "approval_engine", "label": "require_approval", "flow": "approval" },
    { "from": "approver", "to": "approval_engine", "label": "approve/reject/edit frozen action", "flow": "approval", "security_boundary": true },
    { "from": "approval_engine", "to": "sdk", "label": "single-use consume, hash re-checked", "flow": "approval", "fail_closed": true },
    { "from": "gateway", "to": "receipt_engine", "label": "append hash-chained receipt", "flow": "receipt", "evidence": true },
    { "from": "receipt_engine", "to": "receipts_out", "label": "verify single/range/chain", "flow": "receipt", "evidence": true },
    { "from": "receipt_engine", "to": "evidence_pack", "label": "compliance export", "flow": "receipt", "evidence": true },
    { "from": "gateway", "to": "storage", "label": "decisions/audit (tenant-scoped SQLx)", "flow": "known_agent" },
    { "from": "gateway", "to": "event_bus", "label": "async security events", "flow": "soc_incident" },
    { "from": "event_bus", "to": "soc_engine", "label": "ingest → detect → correlate", "flow": "soc_incident" },
    { "from": "soc_engine", "to": "alerts_out", "label": "alerts, incidents, narratives", "flow": "soc_incident", "evidence": true },
    { "from": "soc_engine", "to": "ban_engine", "label": "respond playbooks (deny-storm, exfil)", "flow": "ban_quarantine" },
    { "from": "soc_analyst", "to": "ban_engine", "label": "freeze / quarantine / revoke", "flow": "ban_quarantine" },
    { "from": "ban_engine", "to": "gateway", "label": "agent auth fails closed", "flow": "ban_quarantine", "fail_closed": true },
    { "from": "mcp_agent", "to": "mcp_gateway", "label": "MCP tool call (manifest-pinned)", "flow": "known_agent", "security_boundary": true },
    { "from": "mcp_gateway", "to": "policy_engine", "label": "unknown tool → deny; drift → SOC", "flow": "known_agent", "fail_closed": true },
    { "from": "anon_agent", "to": "gateway", "label": "POST /v1/agent-cage/runs (run registry)", "flow": "anonymous_agent" },
    { "from": "gateway", "to": "control_commands", "label": "signed start/kill/quarantine (planned dispatch)", "flow": "anonymous_agent", "security_boundary": true },
    { "from": "control_commands", "to": "node_sensor", "label": "verify sig/tenant/expiry/nonce (planned)", "flow": "anonymous_agent", "fail_closed": true },
    { "from": "node_sensor", "to": "cage_runner", "label": "launch disposable sandbox (planned)", "flow": "anonymous_agent" },
    { "from": "cage_runner", "to": "egress_proxy", "label": "forced network path (planned)", "flow": "egress_block", "security_boundary": true },
    { "from": "cage_runner", "to": "tool_broker", "label": "tools without raw credentials (planned)", "flow": "anonymous_agent", "security_boundary": true },
    { "from": "node_sensor", "to": "gateway", "label": "POST /v1/ingest/runtime-events", "flow": "anonymous_agent", "evidence": true },
    { "from": "gateway", "to": "evidence_graph", "label": "link decisions/approvals/receipts/alerts", "flow": "prompt_lineage", "evidence": true },
    { "from": "evidence_graph", "to": "dashboards_out", "label": "run/agent timelines", "flow": "prompt_lineage" },
    { "from": "soc_analyst", "to": "dashboards_out", "label": "investigate via /dashboard", "flow": "soc_incident" },
    { "from": "admin", "to": "gateway", "label": "tenants, policies, keys", "flow": "known_agent" },
    { "from": "gateway", "to": "otel", "label": "traces + metrics", "flow": "soc_incident" },
    { "from": "soc_engine", "to": "audit_logs", "label": "decision-linked audit trail", "flow": "soc_incident", "evidence": true },
    { "from": "gateway", "to": "qdrant", "label": "semantic audit indexing (optional)", "flow": "soc_incident" }
  ]
}