ADR Registry

IoT remains a tentative breadth extension and is not part of the confirmed core entity roster unless a later scope decision promotes it.

Windows remains a tentative breadth extension until its experimental role, telemetry surface, time budget, and evaluation value are formally confirmed.

E2 is a confirmed Linux build/CI entity for the experiment and will be provisioned from the documented experimental base with its own workload and reset contract.

E1 is a confirmed Linux developer-workstation entity for the experiment and will receive a reproducible provisioning and reset contract.

Track C provides semantic auth, DNS, and related host context that cannot be represented cleanly by the kernel event stream alone.

Track B covers periodic magnitude and rate counters that may capture behavior not recoverable from the event stream; the collect-now versus defer decision remains open before corpus collection.

Track A is the primary Tetragon kernel-behavior stream, designed around behavior-plane coverage, broad modifications, narrow high-volume reads, redaction, lineage correctness, and runtime loss validation.

Separates implementation evidence, the formal thesis record, and the curated committee portal.

Defines the model-evaluation discipline used after the thesis corpus is frozen.

Defines the high-level agentic attack campaign, deterministic target model, and provenance requirements used by the future harness sprint.

Establishes the Track A/B/C framing that the current telemetry sprint is now decomposing into track-specific decisions.

Defines the per-entity collection topology and establishes the baseline collection-window requirement subject to telemetry validation.

Requires a fresh thesis corpus with provenance labels rather than relying on the earlier time-window labeling approach.

Defines the bounded thesis contribution and RQ1–RQ4 used by the v0.3 research program.