CONSOLE V1 / CUSTOMER GUIDE

Current capabilities and limits

Implemented candidate behavior versus planned or unavailable features.

Implementation snapshot

This documentation describes console-v1 at source revision 23fdccfaa88f69e858769f1dad70f82739e2740f. The source of behavior is the implemented API/auth/query/rule/workflow modules and console-v1 contract. Public docs are a curated projection, not a dump of internal runbooks. Implemented candidate is not qualified deployment, generally available service, or proof that a connector is live in your environment.

Supported candidate surface

Same-origin opaque cookie sessions; explicitly gated isolated evaluation signup; source-scoped bearer ingestion/status; partial native-to-OCSF mapping; bounded hot queries with SQL preview; time/source historical filters through PyIceberg; strict stateless scalar rules; deterministic cited narratives; versioned cases and approved local case workflows; local-console outbox; operator-configured cost snapshot.

Planned or separately unqualified

Production HA/TLS/SSO and account lifecycle, generated full OCSF coverage, stateful/windowed Sigma, advanced SQL editor, Presto/Trino integration, OAuth self-service, broad cloud/SaaS connectors, external ticket delivery, budget communications, cloud containment and production retention/holds/recovery. System One advisory is planned with no action authority; actual inference is disabled. Unrestricted raw SQL is not offered.

Machine-readable entry points

Use /llms.txt, /docs/console-v1/openapi.json and /docs/console-v1/capabilities.json. Source-versioned Markdown pages and the publication manifest are linked in the docs. Machine clients should check contract_version, source_revision, stage and supported/planned boundaries before selecting an operation. There is no published third-party SDK, agent MCP endpoint, unrestricted SQL API or hidden /signals endpoint in this surface.

Safety bounds, not service promises

Maximum 8 MiB/1,000 records per ingestion, 500 rows/31 days per query, 10,000 unique events and raw batches per tenant, 256 MiB retained request bytes, 1–20 workflow steps and ten-minute plan expiry. These are evaluation safety limits, not measured throughput, production retention, pricing or performance guarantees. See the capabilities manifest for exact numeric bounds.