This directory holds executable design and specification artifacts that accompany the PRD for development, integration, and operations.
本目录存放与 PRD（产品需求文档）配套的可执行设计与规范，供开发、集成与运维使用。
PRD Location: ../SPEC.md
Brand Asset: images/docsentinel-mascot.png is the README mascot logo used across the project documentation.
品牌资产：images/docsentinel-mascot.png 是项目文档统一使用的 README 吉祥物 logo。
| ID | Document | Purpose | Timing |
|---|---|---|---|
| 01 | Architecture and Tech Stack | Technology choices (LangGraph, LangChain), architecture, interfaces, data flow. | Start / Design Phase |
| 02 | Generated API Contract | Authoritative REST API contract exported from FastAPI. | Every API change |
| 02A | Historical API Draft | Deprecated design draft retained for traceability. | Reference only |
| 03 | Assessment Report and Skill Contract | JSON Schemas for SSDLC phase reports and phase-specific Skills. | Pre-Development |
| 04 | Integration Guide | AAD, ServiceNow, SAST/DAST tool configuration and mapping. | Integration Phase |
| 05 | Deployment Runbook | Deployment, config reference, ops. | Pre-Release |
| 06 | Agent Integration (MCP + A2A) | Local/remote MCP and A2A agent integration. | Integration Phase |
| RFC-001 | Product Trust Contract | Evidence, human-review, data-boundary, and release guarantees for v5. | v5 Foundation |
| ADR-001 | Modular Monolith | Target backend module and persistence architecture. | v5 Foundation |
| ADR-002 | Evidence Model | Control-level conclusions, evidence locators, and review decisions. | v5 Foundation |
| ADR-003 | Frontend Design System | Console layout, interaction, component, and accessibility rules. | v5 Foundation |
| ADR-004 | Agent Interoperability | MCP/A2A roles, shared task boundary, and remote access policy. | v5 Phase 1 |
Aligned with PRD and current implementation:
- Language: Python 3.11+
- Web/API: FastAPI + MCP (stdio/Streamable HTTP) + A2A 1.0
- Agent Orchestration: LangGraph (stateful graph-based workflows with SSDLC routing)
- LLM Framework: LangChain (unified LLM abstraction, prompts, tools, RAG)
- SSDLC Phases: 6-stage pipeline (Requirements → Design → Development → Testing → Deployment → Operations)
- Vector DB: Chroma + LightRAG (hybrid vector/graph retrieval)
- Parsing: Docling (primary) + PyMuPDF, python-docx, openpyxl (legacy fallback)
- LLM Providers: OpenAI / Ollama (via LangChain)
See 01-architecture-and-tech-stack.md for details.
- Start with 01: Confirm stack and architecture (LangGraph + LangChain).
- Generate contracts: Run
python scripts/export_contracts.py; committedopenapi.jsonandschemas/assessment-report.jsonare generated artifacts. - Generate frontend types: Run
npm run api:generate --prefix frontend. - Refine 04/05: Update when integrating with real environments (AAD, ServiceNow, SAST/DAST tools).
docs/
├── README.md
├── 01-architecture-and-tech-stack.md
├── openapi.json
├── 02-api-specification.yaml (deprecated)
├── 03-assessment-report-and-skill-contract.md
├── 04-integration-guide.md
├── 05-deployment-runbook.md
├── 06-agent-integration.md
└── schemas/
└── assessment-report.json