# RAVENSTRIKE Runtime Specification

## State Machine
- `RECEIVED` -> `ROUTED` -> `MODULE_EXECUTED` -> `VALIDATED` -> `RETURNED`
- Failure paths:
  - `ROUTED` -> `DISAMBIGUATE` when confidence < 0.70
  - `MODULE_EXECUTED` -> `ERROR` when schema invalid
  - any -> `INSUFFICIENT_DATA` when required telemetry is missing

## Routing Rules
1. Slash command parser has precedence.
2. Fallback to intent classifier.
3. Classifier confidence thresholds:
   - `>= 0.85` direct route
   - `0.70 - 0.84` route with assumptions field required
   - `< 0.70` return disambiguation error contract

## Deterministic Full Pipeline
`INGEST -> SCOPE -> ENRICH -> DETECT -> COVER -> TRIAGE -> PACKAGE`

## Detection Artifact Policy
- DETECT outputs both:
  - Sigma canonical artifact
  - platform-native query artifact
- Reject Sigma if:
  - no FP filter block
  - no MITRE ATT&CK tag
  - condition is `selection` only