SecFusionAgent Technical Design 1: Data Plane

SecFusionAgent Technical Design 1: Data Plane An architecture diagram generated by Archify. External Sources · feeds · repos · papers · External sources · external authority External Sources feeds · repos · papers external authority Acquisition Runtime · Scheduler · run state · SecFusionAgent Data Plane · scheduled + on-demand Acquisition Runtime Scheduler · run state scheduled + on-demand Source Adapters · discover · fetch · query · SecFusionAgent Data Plane · provider protocol Source Adapters discover · fetch · query provider protocol Retention Router · retention_mode · SecFusionAgent Data Plane · four lifecycles Retention Router retention_mode four lifecycles Hot Bug Working Set · Redis · current bugs · SecFusionAgent Data Plane · hot_window Hot Bug Working Set Redis · current bugs hot_window Incident Staging · Redis · signal / candidate · SecFusionAgent Data Plane · incident_signal Incident Staging Redis · signal / candidate incident_signal Managed Content · revision · chunk · SecFusionAgent Data Plane · durable_managed Managed Content revision · chunk durable_managed Structured Index · Repo · Object · Claim · SecFusionAgent Data Plane · selective_index Structured Index Repo · Object · Claim selective_index Evidence Boundary · Observation · EvidenceLink · SecFusionAgent Data Plane · pin source revision Evidence Boundary Observation · EvidenceLink pin source revision Artifact Store · S3 / MinIO · SecFusionAgent Data Plane · raw artifact Artifact Store S3 / MinIO raw artifact Canonical State · PostgreSQL · SecFusionAgent Data Plane · knowledge · incident · outbox Canonical State PostgreSQL knowledge · incident · outbox Async Consumers · Celery · consumers · SecFusionAgent Data Plane · enrich · project · index Async Consumers Celery · consumers enrich · project · index External sources SecFusionAgent Data Plane Legend Backend Database Cloud Security Message bus External

Authority and storage

  • • Providers own external current state; PostgreSQL owns durable SecFusionAgent state
  • • Redis is hot/staging only; eviction never changes durable conclusions
  • • Current projections and retrieval indexes are rebuildable

Four retention paths

  • • hot_window: bounded high-volume vulnerability working set
  • • incident_signal: short-lived signals; durable after independent evidence
  • • durable_managed / selective_index: evidence-backed durable paths

Failure and async replay

  • • Advance the cursor only after the full checkpoint is accepted
  • • Canonical state and outbox commit together; consumers are idempotent
  • • Enrichment provider reads re-enter Acquisition → Evidence