annaconda · vigia-live — system architecture

The autonomous DFIR analyst that keeps the model out of the verdict.

A fleet of Gemini + ADK agents works forensic cases unattended on Google Cloud. But a deterministic core seals the verdict before any agent speaks — the model puts the sealed result into words, it cannot change it.

live on Cloud Run · us-central1 · Vertex AI · Firestore
deterministic & sealed (no LLM, no float) LLM layer (Gemini via ADK) Google Cloud service pure output of the seal

Agent layer — orchestration, memory, words

the model lives here — never the verdict

Fleet-commander

Works a case autonomously across cycles; keeps a hash-chained mission journal; self-schedules the next look, escalates, or stands down.

Dispatcher

Triages the case and routes collection to the specialists.

Windows / Persistence hunters

Collect running-state and persistence telemetry — each its own sealed window.

Threat-intel · Detection-engineer

VirusTotal / MISP enrichment; Sigma rule drafts. Read-only context.

correlator ── the one role that may reach the core ──▶ adjudicate()
disjoint tool contracts · sealed registry (agent = hash of its tools) · catalog gate
the model receives a compressed, read-only summary — it cannot supply a score, a state, or a hash
SHA-256 · SEAL The boundary. The deterministic engine scores and seals the result before any agent is called. Swap the narrator backend and only the wording changes — the seal is bit-for-bit identical.

Deterministic core — stdlib-only, exact arithmetic

no LLM · no float · reproducible

Evidence windows

Velociraptor VQL (or bundled demo telemetry) → normalized artifacts, frozen into an immutable window and hashed.

window_hash = sha256(canonical)

CAIE adjudication

Scores the window with exact fractions (never floats); maps MITRE ATT&CK; produces score + confidence.

MALICE BENIGN ABSTAIN ESCALATE

Sealed verdict chain

Each verdict seals onto the previous one; reads re-verify end-to-end. Enrichment is sealed beside the evidence, never among it.

entry_hash ← prev_entry_hash

every sealed verdict is a pure, deterministic projection ▼

DFIR interoperability — output of the seal, never an input

STIX 2.1

/cases/{id}/stix

CACAO 2.0

/cases/{id}/cacao

Independent verifier

annaconda-verify

Sigma synthesis

detection-engineer

SecOps push

Pub/Sub → Chronicle

MISP / OpenCTI

feed match, sealed

VirusTotal / GTI

needs VT_API_KEY

Court exhibit

/cases/{id}/exhibit

Runs unattended · Google Cloud

Cloud Scheduler → Pub/Subcron wakes the fleet: POST /tasks/sweep
Cloud RunFastAPI backend — vigia-live
Vertex AIGemini 3.5 Flash (global endpoint)
Firestorecase store + verdict & mission chains
Pub/Subsealed-verdict push to SecOps
Cloud TraceOpenTelemetry reasoning spans

the one invariant

A language model can read the evidence correctly and still reach the wrong conclusion under narrative pressure — and you cannot put "the model felt sure" in front of a court. So the model never touches the decision path. Autonomy where it helps; determinism where it must hold.