In scope
- Repository layout
- Flutter shell (timeline / settings / diagnostics placeholders)
- Windows Service lifecycle (
--console,--install,--uninstall) - Named-pipe IPC with Protobuf-compatible framing
- ClientHello / ServerHello, Ping / Pong, Heartbeat
- Per-connection queue structures (server)
- Flutter I/O isolate for pipe I/O
- Logging, config placeholder, CMake, CI skeleton
Out of scope
- Event Log / Wevtapi collection
- ETW / WMI
- Timeline business logic
- SQLite persistence of events
- Enrichment rules runtime
- Build
PulseService.exe - Run
PulseService.exe --console - Run
pulse_ipc_ping.exeor Flutter Diagnostics → Ping - Observe Pong
- Ctrl+C service — clean shutdown
- Event Log pull adapter (doc 21)
- Collector hot path + async SQLite writer (ADR-008)
- Live event batches to UI
- Timeline Level 1 rendering
Follow ADRs 007 and 008 strictly.