stage(prd): complete — docs/prd.md

[craig-dt]

Stage 2. Docs only.

docs/prd.md follows the standard template section-for-section, is published as a Google Doc in Drive → PRDs → flabel, and remains the source of truth as markdown in the repo. current_stage advances to eng_review.

What this settles

Research deliberately deferred the labels.json schema to the PRD. That file is the product, so it was decided first:

• One entry per flow, with a sources[] array retaining every detection that asserted it — consumers get one label per flow without deduplicating, and full per-detection provenance is preserved.
• max_tier lets a consumer filter by trust without walking the array.
• Zeek uid is the authoritative join key; the full tuple is retained for PANW correlation (which produces no uid) and for readability. Research flagged that a tuple alone is ambiguous under port reuse.
• Malicious flows only — and the PRD states explicitly that an unlabelled flow is unlabelled, not verified-benign. No detection firing is not evidence of innocence, and that distinction must survive into whatever trains on this.
• Schema version on the file, so a shape change breaks loudly.

Edge-case behaviour

• Uncorrelatable detections go to unmatched_detections[] with a reason and the raw device fields — never dropped, never guessed into a flow. The count is a correlation-health signal.
• Timestamped run directories with a latest pointer, so re-running against a newer ruleset snapshot preserves the earlier labels. ⚠️ This changes the output layout the original brief specified ({pcap}/labels.json → {pcap}/{timestamp}/labels.json).
• Truncated input is processed and stamped partial; an unreadable header fails hard with no labels written.
• Zero detections is a successful run with an empty labels array.

On measurable goals

The template asks for measurable goals, but trust-by-construction means label accuracy cannot be measured. Rather than invent a false-positive target, goals are framed around what genuinely can be verified — provenance completeness, reproducibility, and zero silent-loss paths — with an explicit note that these measure pipeline integrity, not label accuracy.

Contents

13 user stories (P0–P2) across two personas — DeepTempo detection-model engineer and lab/platform operator — with acceptance criteria per story, 16 test cases, 9 risks, and 10 open questions.

Only one open question blocks scope: Legal's ruling on JA4+ under FoxIO License 1.1. Stakeholders and target release are TBD pending your input rather than invented.

Closes #2

🤖 Generated with Claude Code