Architecture decision records

• ADR-0001: Freeze contracts first; engines communicate only via the graph
• ADR-0002: In-memory networkx graph first; Neo4j as an optional mirror
• ADR-0003: Transparent rule-based confidence model
• ADR-0004: Schema 0.2.0 - additive vocabulary for real endpoint telemetry and engine outputs
• ADR-0005: Windows process identity is host/pid/image, with the Sysmon GUID as a fallback
• ADR-0006: Engines may report their own probability; calibration is a separate, fitted map
• ADR-0007: Sibling projects plug in as pinned optional extras, not vendored code
• ADR-0008: Two ACH engines each write one competing attribution claim; UNKNOWN is a hypothesis