Skip to content

docs: add ADAPTERS.md EDR contributor guide#10

Merged
keirsalterego merged 1 commit into
mainfrom
docs/adapters-contributor-guide
May 23, 2026
Merged

docs: add ADAPTERS.md EDR contributor guide#10
keirsalterego merged 1 commit into
mainfrom
docs/adapters-contributor-guide

Conversation

@keirsalterego

Copy link
Copy Markdown
Contributor

Summary

Adds ADAPTERS.md — the contributor guide for adding a new EDR vendor to the ingestion pipeline.

Contents

  • The four contract rules every adapter must enforce (auth before parse, authenticated tenant_id, audit before 202, output is a valid NormalizedAlert)
  • NormalizedAlert dataclass shape with conventions on optional defaults
  • Six concrete steps to ship a new adapter, end to end, with a worked example for a hypothetical bearer-token vendor
  • A copy-pasteable patch-style route example
  • Five failure modes the tests must cover
  • Anti-patterns we've actually rejected in past PRs
  • Table of existing adapters with auth scheme and tenant ID source
  • Review checklist

Why

The fifth EDR adapter is the easiest path for an external contributor to add real value. The contract was previously documented only in the private monorepo. Lifting the public-safe portion here lets contributors propose adapters without needing access to the private side.

Confidentiality

References existing adapters by name and auth scheme only. No pattern weights, no detection logic, no proprietary mapping tables.

Depends on / merges after

#8 — foundation rewrite. Cross-refs to ARCHITECTURE.md, THREAT_MODEL.md, API_REFERENCE.md resolve once that lands.

Test plan

  • Walk through the six-step adapter recipe against the public Rust proxy + simulator stack
  • Confirm no private pattern data leaked

Standalone contributor guide for adding a new EDR vendor to the
ingestion pipeline. Targets external contributors who want to ship
the fifth adapter.

Contents:

- The four contract rules every adapter must enforce, with the
  preview-parse pattern and the why-it-is-safe explanation
- The NormalizedAlert dataclass shape with conventions on optional
  defaults
- Six concrete steps to add a new adapter, end to end, including a
  worked example for a hypothetical bearer-token vendor
- A patch-style route example that the contributor can copy
- The five failure modes their tests must cover
- The anti-patterns the reviewer has actually rejected in past PRs
- A table of existing adapters with their auth scheme and tenant ID
  source
- A review checklist

Sketches the private code shape without leaking the private code
itself; the existing four adapters are referenced by name and auth
scheme only, never by their pattern weights or detection logic.

Cross-refs to ARCHITECTURE.md, THREAT_MODEL.md, API_REFERENCE.md
resolve once the foundation PR (#8) merges.
Copilot AI review requested due to automatic review settings May 23, 2026 17:36

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

@keirsalterego keirsalterego merged commit 1106265 into main May 23, 2026
1 check failed
keirsalterego added a commit that referenced this pull request May 23, 2026
The previous ROADMAP carried ARR targets, pilot counts, quarterly
revenue numbers, and an MSP channel percentage. That material moved
to vyrox-design-partners/docs/gtm/INTERNAL_ROADMAP_WITH_TARGETS.md
in PR #9 of that repo. This commit lands its replacement.

The new ROADMAP is organised by capability, not by quarter or by
revenue tier. Sections:

- Recently shipped: the sixteen blockers from the May 2026 audits
  (eight P0 + eight P0.5), each described as a public contract
  change with the file paths a reader can verify.
- In flight: items that touch a public contract, with the actual
  bottleneck called out (Postgres before tenant 25, retry runner
  not yet wired into worker entrypoint, etc).
- Planned, not started: public OpenAPI spec, customer-side audit
  verifier binary, EU data region, web operator interface trigger
  conditions.
- Adapter coverage: shipped vendors plus on-demand future adapters.
- Compliance and certification: where we are honest about what is
  in flight versus planned versus not started.
- Versioning and release cadence: semver intent for the public repos.
- "Intentionally not on the roadmap": SIEM, managed human SOC,
  web dashboard during alpha, free public ingestion endpoint.

Cross-refs to ARCHITECTURE.md, API_REFERENCE.md, AUDIT_CHAIN.md,
ADAPTERS.md, SECURITY.md resolve after the foundation and specialty
PRs (#8, #9, #10, #11) land.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants