Architecture
xorappsec is one process with four roles. Inspection is a library. I/O lives in the attachment and the management plane.
Crate map
| Crate | Role |
|---|---|
xorsec-core | Policy, events, verdicts, runtime config |
xorsec-inspect | Decode, indicators, ML, engines, pipeline |
xorappsec | Proxy, management, CLI, demo origin |
Failure modes
- Handler panic or inspect timeout — fail-open (forward) or 503.
- Bad policy file — last good policy stays installed.
- SIGTERM —
/readygoes 503, in-flight requests drain, model flushed.
Deeper design notes live in the repository Architecture.md.