Skip to main content

Source of Truth (Canonical Facts)

This page is the canonical reference for facts that commonly drift in documentation.

If you update architecture, ports, runtime versions, or agent topology, update this page in the same pull request.

Runtime and Tooling Baselines​

These values are sourced from project configuration and runtime manifests.

AreaCanonical ValueSource
Python runtime>=3.12pyproject.toml
Ruff targetpy312pyproject.toml
Mypy version target3.12pyproject.toml
Dashboard Node.js22 recommendeddashboard/package.json + CI
Docs Node.js>=18 supporteddocs/package.json
Rust1.83+Makefile + CI

Agent Topology (Canonical)​

AuroraSOC has 17 agents total:

  • 1 orchestrator
  • 16 specialist agents

Specialists:

  1. SecurityAnalyst
  2. ThreatHunter
  3. MalwareAnalyst
  4. IncidentResponder
  5. NetworkSecurity
  6. NetworkAnalyzer
  7. CPSSecurity
  8. ThreatIntel
  9. UEBAAnalyst
  10. ForensicAnalyst
  11. EndpointSecurity
  12. WebSecurity
  13. CloudSecurity
  14. ComplianceAnalyst
  15. VulnerabilityManager
  16. ReportGenerator

A2A Ports (Canonical)​

AgentPort
Orchestrator9000
SecurityAnalyst9001
ThreatHunter9002
MalwareAnalyst9003
IncidentResponder9004
NetworkSecurity9005
WebSecurity9006
CloudSecurity9007
CPSSecurity9008
ThreatIntel9009
EndpointSecurity9010
UEBAAnalyst9011
ForensicAnalyst9012
ComplianceAnalyst9013
VulnerabilityManager9014
ReportGenerator9015
NetworkAnalyzer9016

Data and Event Plane (Canonical)​

ComponentPurpose
PostgreSQLRelational persistence for cases, alerts, approvals, reports
RedisStreams, cache, and operational runtime state
pgvector (PostgreSQL ext.)Vector search for memory and similarity workflows
NATS JetStreamDurable event federation
Mosquitto MQTTCPS/IoT ingress channel

Documentation Rules to Prevent Drift​

  1. Do not hard-code moving counts when avoidable. Use phrasing such as "multiple", "dozens", or provide generated references.

  2. If exact counts are required, tie them to source files. For example, agent topology must match aurorasoc/agents/factory.py and settings ports must match aurorasoc/config/settings.py.

  3. Update docs and code together. Every change in these files must include doc review:

  • aurorasoc/agents/factory.py
  • aurorasoc/config/settings.py
  • aurorasoc/api/main.py
  • aurorasoc/tools/
  • pyproject.toml
  • dashboard/package.json
  1. Prefer generated API references for endpoints. Manual endpoint tables are useful for explanation, but OpenAPI should remain the protocol source of truth.

Quick Audit Checklist​

Use this checklist before merging major changes:

  • Agent count and names still match factory definitions.
  • A2A ports and ranges still match settings.
  • Runtime versions in docs match project files.
  • User onboarding pages still reflect actual startup commands.
  • API examples still authenticate and execute successfully.