HawkinsOperationsDetection Engineering SOC

Repository map

Six repositories. Three planes. Authority flows down only.

detections → validation → proof feeds the chain. .github and platform overlay it. website renders the receipts; it does not author them.

REPO_PLANE_SEPARATIONSOURCE_DOES_NOT_PROVE_RUNTIME

Public inspection layer

source truthseparate
runtime truthseparate
signal truthseparate
evidence truthseparate
public proofseparate
PLANE · GOV / RUNTIMEPLANE · AUTHORITY CHAINPLANE · RENDERINGfeedsfeedsrenders (read-only)01 · .githubgovernance / reviewer routingGOVERNANCE02 · platformruntime contracts / boundariesRUNTIME03 · detectionssource logicAUTHORITY04 · validationtests · fixtures · verifiersAUTHORITY05 · proofevidence boundary · ceilingAUTHORITY06 · websiterendering only · reviewer routingRENDERRENDER ≠ AUTHORITY
authority chain rendering governance / runtime overlay

Tabular view

Repository inventory

Same data as the DAG, indexable by reviewers who want to skim by repo name.

Governance routing

HawkinsOperations/.github

Organization profile, reviewer entry points, and governance routing.

Owns
START_HERE, organization map, and public review paths.
Does not prove
Detection behavior, runtime state, or signal observation.

Source Truth

hawkinsoperations-detections

Detection source candidates and detection-as-code materials.

Owns
Detection source, naming, and reviewable source history.
Does not prove
Runtime activity, signal observation, or public proof.

Validation Truth

hawkinsoperations-validation

Deterministic validation controls and expected-result contracts.

Owns
Validation cases, validators, and reproducible output format.
Does not prove
Runtime deployment or external-use authorization.

Runtime Truth

hawkinsoperations-platform

Platform/runtime design and operational integration boundaries.

Owns
Runtime architecture and platform control patterns.
Does not prove
Public-safe proof or fleet-wide state.

Evidence Truth / Public Proof

hawkinsoperations-proof

Proof records, evidence linkage, and public claim contracts.

Owns
Proof ledger records and promotion-state documentation.
Does not prove
Unlinked runtime state or claims outside the record.

Product / front door

hoxline

Product front-door repo for governed AI-assisted security work.

Owns
Hoxline product framing and Claim Authority capabilities, starting with Claim Firewall.
Does not prove
Runtime telemetry, signal observation, public-safe proof, deployment state, or claim approval.

Public rendering

hawkinsoperations-website

Public rendering, reviewer navigation, and claim-boundary presentation.

Owns
Human-readable routes into proof and governance records.
Does not prove
Source truth, runtime truth, signal truth, or evidence truth.