Intelligence plugins

Engines enterprise

The deterministic core is complete on its own. Everything that is learned or operates at scale attaches to it from the outside, through a stable out-of-process plugin contract — never by linking into the engine.

The boundary

Plugins are separate executables. The engine launches each one named in the -plugins flag and talks to it over gRPC (HashiCorp go-plugin). This is a hard architectural line:

The open-source core never imports the commercial code.
A plugin can crash, hang or be upgraded without touching the engine — calls are bounded by a timeout and fail open (a slow plugin degrades to no enrichment, never to a stalled request).
The engine stays a clean, auditable, single-purpose binary.

The contract

A plugin is a Contributor with three methods:

Info()                       // name, version, what it wants
EnrichConnection(ConnContext) // once per connection
AnalyzeRequest(RequestView)   // per request

The engine hands over context and receives an Enrichment:

ConnContext — client IP and hash, JA3, JA4, SNI, TLS version, country, header order. Given once per connection.
RequestView — a read-only projection of the canonical request for the per-request call.
Enrichment — the findings, a reputation score, and tags the plugin returns.

Enrichment findings are merged into the same findings list as the built-in engines, so they flow through the identical risk → decision → telemetry path. To keep the boundary trustworthy, plugin engine IDs are reserved to ≥ 128 and the host drops any plugin finding claiming a core engine ID — a plugin can contribute, never impersonate.

What runs as a plugin

Plugin	What it adds	Status
Browser Identity	A composite 128-bit fingerprint of the client's TLS + HTTP stack (JA3/JA4 + header order + h2), UA classification (tool / scanner / bot), and a request-cadence timing detector that flags metronomic automation.	enterprise built
Browser Reputation	A decaying, in-memory reputation keyed on the client's TLS anchor — a bad-behavior score that accrues over time and feeds risk, independent of IP rotation.	enterprise built
Endpoint Intelligence (ML)	Real-time deviation scoring against a trained per-endpoint model, hot-reloaded from disk. (The Community core ships the statistical version of endpoint profiling.)	enterprise partial

Reputation and timing key on the TLS anchor (the part of the fingerprint a client cannot cheaply rotate) rather than the full composite, so a client cannot shed accumulated state by permuting a header. The reputation and timing tables are hardened against targeted eviction with a per-process secret index.

The open-core rule

The decision for what lives where follows one principle (ADR-0005):

Protection + deterministic + standard → Community. Scale, learned, or regulated → Enterprise.

So the entire deterministic protection path — capture, normalize, parse, detect, score, decide, enforce, plus the challenge/PoW anti-scraping, the plugin SDK itself, the control plane, GUI, Attack Explorer, policy distribution and multi-site — is Community and never crippled. The AI/ML tier, Browser Identity/Reputation, anti-bot, threat-intel feeds, clustering and central management are Enterprise. Trained models, reputation data and threat feeds are the commercial asset and are never published.

Status

The plugin SDK and host are live in the core. Browser Identity (fingerprint, classification, timing) and Browser Reputation are built and security-hardened. The Endpoint Intelligence ML plugin and the wider offline-ML consumers (anomaly, clustering, LLM analyst, federated learning) are the active frontier.