A module is a small folder of plain files.

What a module supplies

The engine owns the rest. Safety handling and evidence checking live in the engine, not the module. A module author cannot make the tool unsafe, by design. A module is just files, so you share it as a folder. No account, no upload, no gatekeeper.

What a module contains

module-name/
  module.yml        required  who and what this module is (the manifest)
  knowledge.md      required  how you troubleshoot this, in plain language
  connection.yml    optional  where to read the data (defaults to file drop)
  evidence.yml      optional  field labels, for a later feature (not read yet)
  examples/         optional  sample data and a sample question
  README.md         optional  extra notes for other authors

The engine validates the manifest against its schema when it loads, and rejects an unknown or misspelled layer. It checks that module.yml and knowledge.md exist and are not empty. The optional connection.yml is read if present and checked for basic shape. Only a file-drop connection is accepted today. evidence.yml is not read by the engine yet.

The knowledge file

This is the part only you can write. It is plain markdown, no code. The engine reasons from it.

# What this module checks
One or two sentences.

# What healthy looks like
- Bullet list of good states.

# What broken looks like
- Bullet list of failure modes.

# What to check, in order
1. Ordered troubleshooting steps.

# Common causes and how to spot them
- Cause: X. Spot it: evidence pattern Y.

Four doors to your data

Pick the door by your comfort level. Everyone can build a module. Nobody is forced to code. The engine tries them in a fixed order: MCP, then the API, then the file drop. A module whose live door is not configured still loads and still teaches, and reads nothing until you configure it.

The eight layers a module can read

The access path is vendor-neutral. A module declares the one layer it reads. Vendors are modules, never layers.

• deviceEndpoint health, config, posture
• local networkLAN, Wi-Fi, gateway, VPN tunnel
• userAuthentication and identity
• rightsAuthorization, firewall and access policy
• resolutionName to address: cache, hosts, DNS
• routingReachability and the listening port
• session-trustTLS handshake, certificate, cipher, clock
• destinationThe service is listening, healthy, backend up

What the engine guarantees

• No changes. A module's interface has one method, a read. There is no write, execute, or mutate method to implement, and the engine stamps every module tool read-only itself. That holds on a live API or MCP connection exactly as it holds on a dropped file. A module author does not get to set that field.
• Evidence, not opinion. The engine grounds each claim in the data the module supplied, with a confidence level and a note on what it could not verify.
• Validation. The manifest is checked against a schema at load time, and an unknown layer is rejected. Required files must be present and non-empty.
• Open standards. Where a standard already exists, the format uses it, so your module is portable and not locked to us.