Rust Core Decision

rust_core is not part of the default AuroraSOC runtime profile.

The default stack uses the Python API and event-processing path. rust_core is currently an opt-in fast path.

Current Position

rust_core provides high-throughput event normalization, ingestion, attestation, and publishing logic, but it does not currently define the supported default runtime.

That means AuroraSOC must not describe it as mandatory production architecture unless the deployment model and operational support actually require it.

Decision

The default engineering bias is to simplify the flagship runtime.

That leads to this decision rule:

1. If AuroraSOC does not require rust_core for flagship throughput goals, absorb its necessary responsibilities into the Python backend and deprecate the opt-in fast path.
2. If AuroraSOC does require rust_core, promote it from optional experiment to supported production component with benchmarks, health checks, tests, runbooks, and explicit documentation.

Leaving it in an ambiguous middle state is not acceptable.

What Must Be True to Keep It

To keep rust_core as a supported component, AuroraSOC must provide:

• benchmark-backed throughput justification
• clear runtime coupling and deployment guidance
• integration tests across ingest to persistence to API/UI visibility
• observability and alerting for the service
• operations docs and recovery guidance

What Must Be True to Remove It

To absorb rust_core into Python, AuroraSOC must provide:

• equivalent ingest and normalization behavior in the Python path
• equivalent attestation behavior or a documented replacement
• migration notes for anyone using the opt-in profile today
• updated architecture docs and runtime manifests

Canonical Runtime Statement

Until a later decision supersedes this one, the canonical statement is:

AuroraSOC's default supported runtime is the Python API and event-processing path. rust_core is an optional fast path, not a required flagship dependency.