Architecture decision records

• ADR 0001: Static-only analysis, and no live malware anywhere in the pipeline
• ADR 0002: The stdlib dissector emits the EMBER v2 raw-feature schema
• ADR 0003: An interpretable feature set with XGBoost and TreeSHAP for the triage verdict
• ADR 0004: Structural YARA rules (pe module) that can be validated on real data
• ADR 0005: Adversarial evaluation as feature-space simulation of functionality-preserving edits
• ADR 0006: A single-file vanilla-JS triage UI instead of a React app
• ADR 0007: Memory-bounded baselines, and published numbers shown only as context