docs

IcebergSST documentation

Design specification and reference docs. Start with ../ARCHITECTURE.md.

Reference

• data-model.md — SQLModel entities and relationships
• api.md — REST surface (human + engine-facing)
• web.md — the console: HTMX/Alpine conventions, CSP, assets, design system
• connectors.md — connector interface + Confluence (MVP)
• rules.md — detection engine, rule packs, suppressions
• security.md — threat model and mitigations
• deployment.md — docker-compose (dev) + Helm (prod)
• backlog.md — milestones, epics, and issues (mirrors GitHub)

Decision records (ADRs)

• 0001 — Job queue: Redis + Dramatiq
• 0002 — Engine boundary: API-mediated results
• 0003 — Detection engine: custom regex + entropy + proximity
• 0004 — Finding storage: redacted snippet + salted hash
• 0005 — Auth: OIDC/SSO + RBAC
• 0006 — Fingerprint & reconciliation
• 0007 — Secret store: pluggable, env-key default
• 0008 — Rule management: code rules + DB suppressions
• 0009 — Task lifecycle: two-phase scans, API-authoritative leases