Engineering Specifications

Engineering-grade specifications for the Superheld platform. These documents describe how the system works at implementation level — components, data contracts, trust boundaries, failure modes.

Audience

These specifications are intended for Superheld engineers, security auditors, and integration architects. They contain implementation details that go beyond the public documentation. For integration guidance, see the Integrator-Quickstart.

Engineering Gap Policy

Missing engineering facts are tracked with internal engineering-gap identifiers in the specification set. Each open item links to either IMPLEMENTATION_FACTS.md or API_FACTS.md. See the Open Engineering Questions page for the current backlog.

---

P1 — Core Specifications

System Overview

Component map, trust boundaries, deployment topology, data flow summary.

Device Agent

Signal collection, OS permissions, local buffering, platform constraints.

Detection Engine

Rule-based vs. ML classifiers, confidence scoring, evasion resistance.

Context Risk Engine

Compound risk scoring, temporal correlation, signal multipliers.

Policy Engine

Evaluation model, action catalog, conflict resolution, fail-closed semantics.

Event Pipeline

Event lifecycle, immutability, delivery guarantees, schema contracts.

API Contract

OpenAPI canonical contract, endpoint inventory, auth model, error semantics.

Privacy Model

Data inventory, trust boundary flows, retention, feature vector transforms.

P2 — Extended Specifications

Telemetry Schema

Event types, PII classification, redaction rules, export pathways.

Threat Intelligence

Feed ingestion, signed updates, cloud enrichment, poisoning resistance.

Tracking

Open Engineering Questions

All open engineering questions, grouped by owner and priority.