mnemo_baseline/lib.rs
1//! v0.4.1 (P0-3) — agent behavioural-baseline exporter.
2//!
3//! RSAC 2026 (2026-04-26) called out the agentic-SOC telemetry gap:
4//! agents emit logs but no normalised behavioural baseline an SOC
5//! can alert on. This crate ships the missing surface — a per-agent
6//! rolling profile (recall rate, write rate, namespace fanout, tool
7//! mix, HMAC continuity) emitted in two canonical schemas:
8//!
9//! 1. **OpenTelemetry semconv 1.31** — `agent.*` attributes on a
10//! span the operator's existing OTel collector already ingests.
11//! 2. **OCSF 1.4 Application Activity** — JSON the SOC's SIEM
12//! pipeline already understands.
13//!
14//! A z-score + EWMA detector flags drift; the exporter is
15//! deliberately **signal, not enforcement** — it does not refuse
16//! ops. The README's threat-model section spells that out so a
17//! reader doesn't mistake the surface for a policy gate.
18//!
19//! Anti-leak invariant: emitted payloads never contain memory
20//! contents. Only metric aggregates. The unit tests sweep the
21//! payload with a regex to assert this.
22
23pub mod anomaly;
24pub mod exporter;
25pub mod profile;
26
27pub use anomaly::{BaselineDelta, BaselineMetric, Severity};
28pub use exporter::{BaselineExporter, JsonExporter};
29pub use profile::{AgentBaseline, ToolId};