CipherShift365 -- Architecture Overview

Stakeholders and Concerns

Composition View

flowchart TB
    subgraph AE["Analysis Engine -- shared, BUILD-TIME only"]
        SRC["Source Analyzer (Roslyn)"]
        DEP["Dependency Analyzer (IL + catalog)"]
        CC["Cert/Config Parser"]
    end
    subgraph CORE["Shared Core -- lightweight, AOT-friendly"]
        KB["Knowledge Base (versioned, signed)"]
        CRE["Classification & Recommendation"]
        RSE["Risk Scoring Engine"]
        CBOM["CBOM Model & Serializer"]
        ID["Identity Service"]
        SIGN["Signing & Verification"]
        POL["Policy Engine"]
    end
    subgraph COMPASS["Compass (Discover)"]
        PLAN["Plan Generator (costed)"]
        REP["Report Generator"]
        CLI["CLI (dotnet tool)"]
        CIT["CI task / GitHub Action"]
    end
    subgraph VAULT["Vault (Migrate) -- ships INTO customer apps"]
        API["Crypto-Agility API"]
        PROV["Provider Abstraction + Registry"]
        HYB["Hybrid/Composite Engine"]
        HDR["Artifact Header Codec"]
        KSA["Key-Store Adapter"]
        OBS["Observability Emitter"]
    end
    subgraph GUARD["Guardian (Guard)"]
        GATE["CI/CD Gate"]
        BM["Baseline Manager"]
        RL["Runtime Listener"]
        DRIFT["Drift Engine"]
        EVT["Event Mapper + SIEM Connectors"]
        HRM["Health/Recovery Manager"]
    end

    COMPASS --> AE
    COMPASS --> CORE
    AE --> CORE
    GATE --> AE
    GATE --> POL
    GUARD --> CORE
    VAULT --> CORE
    OBS -.-> RL
    DRIFT --> ID
    PROV --> KSA

The Three Dependency Rules

1. Shared Core is the hub. All three modules depend on Core (KB, classification, scoring, CBOM, identity, signing, policy) and never reimplement it.
2. Build-time and runtime dependencies are separated. The Analysis Engine (Roslyn, IL inspection) is heavy and runs only at build time. Vault ships into customers' production applications, so it depends on the lightweight Core only -- never on the Analysis Engine.
3. One analysis engine, two consumers. The static analysis engine is a shared component consumed by both Compass (CLI/CI) and Guardian's gate.

Component Catalog