ZAYNOR — Deterministic DFIR / DFIR determinista

ZAYNOR — Deterministic DFIR / DFIR determinista An architecture diagram generated by Archify. Declared incident · Architecture component · Input boundary Declared incident Input boundary Case freezer · Authoritative boundary · Immutable snapshot Case freezer Immutable snapshot Deterministic engine · Authoritative boundary · No LLM authority Deterministic engine No LLM authority Authoritative result · Authoritative boundary · Sealed state Authoritative result Sealed state Seal and audit · Authoritative boundary · Fail closed Seal and audit Fail closed Local Ollama · Local agentic boundary · Untrusted proposer Local Ollama Untrusted proposer Capability policy · Local agentic boundary · Allowlist gate Capability policy Allowlist gate Typed MCP adapter · Local agentic boundary · No authority Typed MCP adapter No authority Observation / evidence · Local agentic boundary · Bound to proposal Observation / evidence Bound to proposal Freeze + re-analysis · Authoritative boundary · Deterministic loop Freeze + re-analysis Deterministic loop Junior analyst chat · Architecture component Junior analyst chat Senior console · Architecture component Senior console Reports · Architecture component Reports freeze authorized facts proposal Authoritative boundary Local agentic boundary Legend Frontend Backend Security External

Authority

  • • Evidence is frozen before analysis
  • • Only the deterministic engine creates authoritative state
  • • Every result is sealed and auditable

Agentic control

  • • Ollama proposes questions, never findings
  • • Policy gates capabilities before MCP calls
  • • Observations remain untrusted until re-analysis

Analyst experience

  • • Junior chat explains cited facts
  • • Senior view exposes provenance and fractures
  • • Reports are projections of sealed state