{
  "schema": "sasquatch.yeti.public-deployment-topology.v1",
  "document_version": "2026-09-20.2",
  "purpose": "Public component, trust-boundary, and dependency contract; exact sizing and placement require customer validation.",
  "canonical_url": "https://sasquatchlabs.io/yeti-deployment-topology.json",
  "flow": ["security_sources", "endpoint_collector_or_site_relay", "authenticated_home_ingress", "normalization_detection_and_evidence", "search_archive_and_workflows"],
  "modes": [
    {"id":"endpoint_collector","placement":"customer_linux_host","components":["collector","ocsf_normalization","detection","durable_journal"],"residency":"customer_host"},
    {"id":"site_and_home","placement":"customer_sites_and_customer_home","components":["site_relay","authenticated_ingress","central_processing","query","retrieve","control_plane"],"stores":["clickhouse_search","postgres_workflow_metadata","customer_object_archive","durable_processing_state"]},
    {"id":"kubernetes_byoc","qualification":"Yeti-enabled full-suite configuration","components":["agent_daemonset","control_plane","query","retrieve","dashboard","postgres","clickhouse"],"archive_backends":["s3","gcs","azure"]}
  ],
  "boundaries": {
    "ingress": "Authenticated and deployment-scoped; Site supports configured syslog and HTTP intake.",
    "egress": "Feature- and topology-dependent, explicitly configurable, and restrictable by network policy.",
    "identity": ["api_keys","signed_access_context","oidc_user_session","site_mtls"],
    "keys_and_secrets": ["customer_kms_for_supported_storage","operator_supplied_secrets","mounted_secret_files","workload_identity","cloud_secret_references"]
  },
  "trust_flows": [
    {"from":"security_sources","to":"endpoint_collector_or_site_relay","data":"telemetry","protocol":"configured local input, syslog, or HTTP intake","identity":"source- and deployment-specific","failure_behavior":"durable local or Site state preserves accepted work within configured capacity"},
    {"from":"site_relay","to":"home_ingress","data":"authenticated telemetry and lifecycle receipts","protocol":"TLS","identity":"enrollment-bound client certificate, private key, CA, and runtime authorization","failure_behavior":"retry from durable relay state; do not represent undelivered work as delivered"},
    {"from":"central_processing","to":"clickhouse_search","data":"normalized searchable records and catalog state","protocol":"private service connection","identity":"deployment secret or workload identity","failure_behavior":"surface dependency degradation and preserve durable processing state"},
    {"from":"central_processing","to":"customer_object_archive","data":"retained archive chunks","protocol":"cloud object-storage API","identity":"customer workload identity or scoped credentials","failure_behavior":"failed upload is not represented as retained evidence"},
    {"from":"control_plane","to":"optional_model_or_connector","data":"tenant-policy-permitted model content or governed response request","protocol":"allow-listed service API","identity":"tenant-scoped provider or connector credential","failure_behavior":"missing route, key, authority, or policy denies the operation"}
  ],
  "store_roles": {"clickhouse_search":"searchable event and catalog data","postgres_workflow_metadata":"control-plane and workflow metadata","customer_object_archive":"retained archive chunks","durable_processing_state":"journals, checkpoints, evidence inventory, reports, spill, and connector state"},
  "operational_boundaries": {"rpo_rto":"deployment-specific and not publicly committed","capacity":"validated from EPS, event size, source mix, retention, outage window, and HA requirements","recovery":"must be exercised in the selected topology","attestation":"this contract describes architecture; it is not executed deployment evidence"},
  "ai_routing": {"optional":true,"content_modes":["full","schema_only","disabled"],"routes":["customer_allowlisted_or_in_cluster","explicit_public_provider_opt_in"],"disconnected_limit":"Public-provider inference is unavailable without egress; an approved inside-boundary model service is required."},
  "lifecycle": {"artifacts":"immutable and signed","site_upgrade":"Home-authorized exact artifact","site_rollback":"compatibility-gated and Home-authorized","private_install":"customer mirrors required images and packages"},
  "claim_boundaries": ["No universal zero-egress claim","No universal local-inference claim","No claim that every deployment uses the same store or identity mechanism","Exact infrastructure, scale, recovery objectives, connectors, and support path require customer validation"],
  "evidence_scope": "Derived from current deployment manifests, charts, Terraform modules, CLI lifecycle code, and governed model routing; this document is not a deployment certification."
}