Quorum Documentation¶
Welcome to the enterprise documentation for Quorum (quorum-sec-scan) — a
consensus security scanning tool delivered as a CLI + Docker images. This folder describes the
product AS-IS at version v0.8.3 (branch main as the source of truth). The site is bilingual —
English is the default; use the language selector in the header for the Brazilian-Portuguese version.
📖 The full master index is
00-index.md— it holds the reading trails by role, the Assumptions Register (A-01…A-21), the Gaps Register (G-01…G-19), the Open Questions for stakeholders and the metadata. ThisREADME.mdis just the shortcut that GitHub renders when you open thedocs/folder.
Scope (important)¶
Quorum is CLI/Docker only. The domains below are N/A by architecture and are documented as such (with justification and, where useful, a separate "future proposal"):
| Domain | Status | Where |
|---|---|---|
| Web frontend / UI | N/A (UX is the terminal) | 08-frontend |
| Relational database | N/A (only rebuildable file caches) | 07-persistencia-e-artefatos |
| HTTP REST API | N/A (the interface is the CLI + image) | 06-interfaces-cli-e-formatos |
| Authentication / accounts | N/A | 12-seguranca |
| AI / LLM / ML | N/A in the deterministic core; opt-in advisory layer (--advice, off by default) |
13-ia |
Summary¶
| # | Document | Description |
|---|---|---|
| 00 | Master Index | Landing, trails, assumptions, gaps, questions, metadata. |
| 01 | Overview | What Quorum is, scope, principles and N/A boundaries. |
| 02 | Functional Requirements | Commands, flags, exit codes, scanners and target matrix. |
| 03 | Non-Functional Requirements | Performance, SLO/SLI, supply chain, compliance. |
| 04 | Architecture | Pipeline, internal/* packages, fan-out and sequence diagram. |
| 05 | Data Modeling | model.Finding, MergedFinding, fingerprints, JSON/XML. |
| 06 | Interfaces (CLI) and Formats | CLI contract, list-scanners, SARIF/JSON/XML. |
| 07 | Persistence and Artifacts | Alias cache, Grype DB, crosswalk, baseline, reports. |
| 08 | Frontend / Terminal | Terminal UX: stdout/stderr, summary, color/TTY. |
| 09 | Backend | cmd/quorum + internal/* as the CLI backend. |
| 10 | Infrastructure | Build, GHCR distribution (:full/:slim), cosign + SLSA. |
| 11 | DevOps | CI/e2e/release workflows, PR flow, moving v0 tag. |
| 12 | Security | Threat model, risks, supply chain, frameworks. |
| 13 | AI | No AI in the core; opt-in local/remote advisory layer (off by default). |
| 14 | Observability | [quorum] logs, SARIF/JSON fields, advisory metrics. |
| 15 | Testing | Strategy, contract tests, consensus e2e, coverage, evals. |
| 16 | Roadmap | V1/V2/V3 phases and SemVer release gates. |
| 17 | Backlog | Prioritized Epics/Stories (MoSCoW, story points). |
| 18 | Risk Matrix | Technical/supply-chain/operational risks. |
| 19 | Costs | Actions/GHCR/headcount, licenses, FX. |
| 20 | Improvements | Prioritized opportunities (impact × effort). |
| 21 | Proposal — Advisory AI | The advisory-layer design (Phases 0-3, now implemented): recommendations + remediation + OWASP RAG, without touching the core. |
| 99 | Checklists | Adoption, QA, security, deploy and production. |
Quick trails by role¶
- First contact: 01 → 06 → 99
- How it works: 04 → 05 → 09
- Adopt in a pipeline: 06 → 10 → 11 → 14
- Security posture: 12 → 18 → 13
- Plan evolution: 16 → 17 → 20
Convention: files follow NN-arquivo.md (00 index, 99 checklists); cross-links are relative
within docs/. Descriptive product documentation at v0.8.3 — for the product itself, see the
main README.