Pipeline
Windows endpoint agent → event collection (file, clipboard, USB, screenshot) → detection engine → policy engine → alert/block → React dashboard (Node/Express + PostgreSQL).
Why this shape
Separation keeps local validation sane: you can exercise collectors without pretending the whole fleet is live.
Status
Architecture and documentation stage; locally deployed for testing. Next: VPS + HTTPS agent registration.