Console
Show live sessions, the attack story, replay, the environment transition, and the intelligence that came out.
Every layer writes to one ordered, durable event log, with Redis Streams in front and Postgres behind. The console reads that log and nothing else, which is why the same store powers the live view, historical investigation, and replay without three different code paths.
The design decision that makes this work is event-first: the schema was frozen before the UI was built, so the timeline never has to be reconstructed from logs after the fact. What you scrub through is what was recorded.
The primary screen is deliberately an attack story rather than a metrics dashboard. The question it answers, in order: what connected, what did they do, why did the score move, when was T crossed, what changed at conversion, what happened afterwards, and what came out of it.
- The event store
- Live operations
- Attack story
- Replay
- Environment
- Intelligence
Rules this layer holds to
Each of these is written down because relaxing it would be locally convenient and globally wrong.
The console in this build runs on recorded and synthetic sessions. The event shapes are the real ones; the traffic is not.