Console
Show live sessions, the attack story, replay, the environment transition, and the intelligence that came out.
Every layer writes to one ordered, durable event log, with Redis Streams in front and Postgres behind. The console reads that log and nothing else, which is why the same store powers the live view, historical investigation, and replay without three different code paths.
The design decision that makes this work is event-first: the schema was frozen before the UI was built, so the timeline never has to be reconstructed from logs after the fact. What you scrub through is what was recorded.
The primary screen is deliberately an attack story rather than a metrics dashboard. The question it answers, in order: what connected, what did they do, why did the score move, when was T crossed, what changed at conversion, what happened afterwards, and what came out of it.
- The event store
- Live operations
- Attack story
- Replay
- Environment
- Intelligence
Rules this layer holds to
Each of these is written down because relaxing it would be locally convenient and globally wrong.
In this build the recorded console runs on scripted sessions in the designed event shapes, and the homepage's “Watch it happen” follows the newest real gateway session, command by command, from the Console API, which holds it in memory; it polls once a second while on screen. Neither reads the event log yet: the gateway writes Redis Streams and Postgres, and only the risk engine reads them back.