Two-Adapter MVP Spec (SIEM + EDR)
================================

Goal
- Provide a toy, production-ready skeleton that demonstrates GuardRailOps interoperability between twoAdapters: a SIEM adapter and an EDR adapter. The MVP runs over TLS-like mutual authentication and supports offline-first delta propagation with deterministic replay.

Architecture Highlights
- Protocol skeleton: lightweight messaging between IR orchestrator and adapters using a minimal, vendor-agnostic contract model.
- GoC primitives:
  - LocalIRTask: per-service detection/containment objectives
  - SharedTelemetry: privacy-preserving signals shared across domains
  - PlanDelta: incremental containment/execution actions with timestamp and nonce
  - AuditLog: governance/provenance entries (signed in production)
- Deterministic delta-reconciliation: deltas carry nonce and timestamp to enable replay.
- Adapters: two starter adapters (SIEM and EDR) with TLS mutual authentication flavor.

Data Contracts (Seed)
- LocalIRTask: { id, service, detection_rules }
- SharedTelemetry: { signals: { key: value }, budget, timestamp }
- PlanDelta: { delta_id, parent_id, timestamp, nonce, changes }
- RegistryEntry: { adapter_id, contract_version, data_contract, timestamp }
- AuditLogEntry: { entry_id, event, detail, signature }

Phase 0 (Weeks 1-2): Protocol skeleton
- Implement a minimal transport layer (TLS-like) and a simple protocol to exchange LocalIRTask and PlanDelta.
- Wire two adapters: SIEMAdapter (ingest telemetry) and EDRAdapter (trigger containment actions).
- Implement DeltaSyncEngine to apply PlanDelta to an in-memory state and enable deterministic replay.

Phase 1 (Weeks 3-5): Governance and identity
- GoCRegistry: register adapter metadata.
- PrivacyBudget: per-signal budgets to demonstrate privacy-preserving telemetry.
- GovernanceLedger: append-only log with simple signing placeholder.

Phase 2 (Weeks 6-8): Cross-domain pilot
- Simulated cross-domain environment with offline-first mode: adapters communicate locally and reconcile when connected.
- Reference SDK and adapter templates to enable rapid onboarding of new adapters.

Phase 3 (Weeks 9-12): Auditability & dashboards
- Demo dashboards showing delta fidelity, replay fidelity, and containment latency.
- Harden governance proofs and privacy budgets; integrate with PortaLedger-like proofs if possible.

Notes
- This MVP intentionally uses toy cryptography placeholders and in-memory stores for clarity. Replace with production-grade crypto and persistent storage in later phases.