Architecture decision records 0001 Replay recorded telemetry 0002 Sigma evaluator 0003 CTI prioritization from ATT&CK groups 0004 Safety boundary