M0 — Architecture Freeze #1

Objective

Freeze the architecture for ExecSurface before any M1 runtime observer implementation.

Fixed roles

• Innovation Scientist / Architect
• Deviation Prevention / Scientific Integrity
• Independent Red Team for security-sensitive review

M0 deliverables

• problem statement
• threat model
• system boundaries
• competitor / adjacent-tool map
• canonical event model
• baseline / lock model
• normalization policy + adversarial counterexamples
• verdict semantics
• MVP definition
• observation-backend decision record
• privacy model
• architecture gate decision

Gate outcome

M0 ACCEPTED.

M1 is architecturally authorized but was not started as part of M0.

Key decisions:

• strace-based ingestion selected as M1 reference observer;
• procfs-only observer KILLED;
• eBPF-first M1 KILLED FOR M1 ONLY / deferred;
• raw observation is separate from canonical execution surface;
• baseline is separate from policy;
• completeness-fatal observer failure maps to ERROR;
• metadata-not-secrets privacy default;
• hostname attribution remains OPEN/deferred unless supported by explicit metadata-safe evidence.

Evidence commit:

34841ef1f596ea17163726e11880c4b4c44c9d29

Gate document:

docs/architecture/M0_GATE.md