SQLite first
A migrated local database keeps deployment and recovery comprehensible. Storage interfaces remain explicit so high-volume telemetry can evolve later.
Architecture
Trustworthy foundations before clever automation.
Watchpost separates observation, deterministic state, investigation, and execution. That boundary makes the agent useful without making it the source of operational truth.
InputCollectors
Bounded, authenticated observations from posts and integrations.
CoreNormalize
Typed signals, events, quality, time, and provenance.
StateEvaluate
Deterministic rules, alert lifecycle, and routing.
HistoryIncidents
Evidence, notes, decisions, actions, and resolution.
AssistAgent
Read-only investigation; typed actions behind policy.
Initial implementation
A small operational core.
The proposed first node is a Go service with a Nift-built frontend embedded into one binary and SQLite for configuration, inventory, rules, incidents, audit, and modest telemetry.
Structured domains
Collection, storage, evaluation, incidents, notifications, investigation, actions, and federation have distinct packages and contracts.
Bounded ingestion
Payload size, label cardinality, retention, retries, queues, and log volume are budgets—not accidental properties discovered under load.
Versioned edges
Collector payloads, database migrations, rule semantics, action schemas, and peer protocols receive compatibility tests.
A deliberate boundary
Useful as one node.
Composable as a fleet.
Federation is planned as an additive capability. A node continues collecting and evaluating while disconnected, then reconciles explicitly when connectivity returns.
See the implementation programme