diff --git a/out/linux_server/README.md b/out/linux_server/README.md index 93abae3..6b29350 100644 --- a/out/linux_server/README.md +++ b/out/linux_server/README.md @@ -11,7 +11,7 @@ Standalone compiled executable binary distribution for Linux server environments ### Key Architecture & Capabilities - **Pre-compiled & Dependency-Free**: Ships as a standalone native Linux ELF binary (`Server.bin`). No Python runtime, pip dependencies, or GnuPG binaries are required on the host system. - **Authenticated TCP Ingestion Socket (Port 9443)**: Accepts framed OpenPGP encrypted log batches streamed by edge forwarders (`Linux_Client.bin` and `Win_Client.exe`). -- **4-Run Temporal Persistence Rule**: Ingested candidate error signatures are evaluated against an episodic threshold. An anomaly must occur across at least 4 distinct client transmission cycles within a sliding 12-hour evaluation window before promotion from transient noise to a `VERIFIED` anomaly. +- **Warning Persistence & Immediate Error Routing**: High-severity `ERROR`, `CRITICAL`, and `FATAL` events are promoted to `VERIFIED` immediately on their first occurrence. Operational `WARNING` and `INFO` events are evaluated against an episodic threshold, requiring persistence across at least 4 distinct client transmission cycles within a sliding 12-hour evaluation window before promotion from transient noise to `VERIFIED`. - **Embedded Hermes Reporting API (Port 8443)**: Integrated REST API exposing `/api/hermes/report` for external scrapers, SIEM collectors, and alerting dashboards. - **Pure-Python OpenPGP Cryptography**: Zero dependency on external `gpg` binaries. Automatically generates RSA-2048 encryption keys and SHA-256 fingerprints on first launch. - **State Database**: Tracks anomaly lifecycles, run counters, and machine telemetry in a local SQLite state database (`logar_state.db`). @@ -68,8 +68,8 @@ The generated `server_config.json` contains: | `hermes_port` | `8443` | HTTP port for the Hermes reporting endpoint | | `auth_token` | *(auto-generated)* | Pre-shared secret required in edge client envelopes | | `db_path` | `"logar_state.db"` | Path to persistent SQLite issue database | -| `evaluation_window_hours` | `12` | Sliding temporal window for 4-run rule persistence | -| `min_persistence_runs` | `4` | Number of distinct runs required to promote to `VERIFIED` | +| `evaluation_window_hours` | `12` | Sliding temporal window for warning persistence | +| `min_persistence_runs` | `4` | Number of distinct runs required to promote warnings to `VERIFIED` | ---