# taimourmushtaq/techfusion-hackathon-26 architecture

> Architecture diagram of the GitHub repository taimourmushtaq/techfusion-hackathon-26, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-14). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/taimourmushtaq/techfusion-hackathon-26
- Repository: https://github.com/taimourmushtaq/techfusion-hackathon-26

## Overview

Orbit Triage is a security-incident triage assistant. Analysts provide a dataset through the CLI or web app; deterministic analysis normalizes logs and references, correlates identities and events, identifies findings and gaps, checks approved changes, scores severity, and produces a cited incident report. The web app also supports grounded follow-up questions, with optional LLM generation and citation validation. The graph follows the documented workflow and sampled imports/calls; several internal details are represented at subsystem level where implementation excerpts were incomplete.

Main entry points: [`triage/pipeline.py`](https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/triage/pipeline.py) (Analysis pipeline), [`app/main.py`](https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/app/main.py) (Web API), [`triage/llm.py`](https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/triage/llm.py) (LLM client), [`triage/__main__.py`](https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/triage/__main__.py) (CLI entry)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_access["Analyst access"]
  node_cli["CLI entry<br/>[__main__.py]"]
  node_web["Web API<br/>[main.py]"]
  node_ui["Web interface<br/>[index.html]"]
end

subgraph group_normalize["Dataset normalization"]
  node_ingest["File ingestion<br/>[ingest.py]"]
  node_time["Time parsing<br/>[timeparse.py]"]
  node_events["Event parsing<br/>[events.py]"]
  node_coverage["Log coverage<br/>[coverage.py]"]
  node_gaps["Data gaps<br/>[gaps.py]"]
end

subgraph group_analysis["Incident analysis"]
  node_pipeline["Analysis pipeline<br/>[pipeline.py]"]
  node_entities["Entity resolution<br/>[entities.py]"]
  node_detect["Finding detection<br/>[detect.py]"]
  node_reference["Reference evaluation<br/>[reference.py]"]
end

subgraph group_outputs["Reports and follow-up"]
  node_report["Incident report<br/>[report.py]"]
  node_qa["Question answering<br/>[qa.py]"]
  node_llm["LLM client<br/>[llm.py]"]
end

node_analyst(("Analyst"))
node_dataset["Dataset files"]
node_groq{{"Groq API"}}
node_openrouter{{"OpenRouter API"}}

node_analyst -->|"runs analysis"| node_cli
node_analyst -->|"uses web app"| node_ui
node_ui -.->|"requests analysis"| node_web
node_dataset -->|"supplies files"| node_cli
node_dataset -->|"uploads files"| node_web
node_cli -->|"runs analysis"| node_pipeline
node_web -->|"analyzes dataset"| node_pipeline
node_pipeline -->|"loads files"| node_ingest
node_pipeline -->|"normalizes timestamps"| node_time
node_pipeline -->|"builds events"| node_events
node_pipeline -->|"checks coverage"| node_coverage
node_pipeline -->|"finds missing data"| node_gaps
node_pipeline -->|"resolves identities"| node_entities
node_pipeline -->|"detects findings"| node_detect
node_pipeline -->|"evaluates references"| node_reference
node_pipeline -->|"renders report"| node_report
node_web -->|"answers questions"| node_qa
node_qa -->|"requests generation"| node_llm
node_llm -.->|"tries provider"| node_groq
node_llm -.->|"falls back"| node_openrouter

click node_cli "https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/triage/__main__.py"
click node_web "https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/app/main.py"
click node_ui "https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/app/static/index.html"
click node_ingest "https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/triage/ingest.py"
click node_time "https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/triage/timeparse.py"
click node_events "https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/triage/events.py"
click node_coverage "https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/triage/coverage.py"
click node_gaps "https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/triage/gaps.py"
click node_pipeline "https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/triage/pipeline.py"
click node_entities "https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/triage/entities.py"
click node_detect "https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/triage/detect.py"
click node_reference "https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/triage/reference.py"
click node_report "https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/triage/report.py"
click node_qa "https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/triage/qa.py"
click node_llm "https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/triage/llm.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_web,node_ui toneBlue
class node_ingest,node_time,node_events,node_coverage,node_gaps toneAmber
class node_pipeline,node_entities,node_detect,node_reference,node_groq,node_openrouter toneMint
class node_report,node_qa,node_llm toneRose
class node_analyst,node_dataset toneIndigo
```

## Components

### Analyst access

- [CLI entry](https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/triage/__main__.py): `triage/__main__.py`
- [Web API](https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/app/main.py): `app/main.py`
- [Web interface](https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/app/static/index.html): `app/static/index.html`

### Dataset normalization

- [File ingestion](https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/triage/ingest.py): `triage/ingest.py`
- [Time parsing](https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/triage/timeparse.py): `triage/timeparse.py`
- [Event parsing](https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/triage/events.py): `triage/events.py`
- [Log coverage](https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/triage/coverage.py): `triage/coverage.py`
- [Data gaps](https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/triage/gaps.py): `triage/gaps.py`

### Incident analysis

- [Analysis pipeline](https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/triage/pipeline.py): `triage/pipeline.py`
- [Entity resolution](https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/triage/entities.py): `triage/entities.py`
- [Finding detection](https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/triage/detect.py): `triage/detect.py`
- [Reference evaluation](https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/triage/reference.py): `triage/reference.py`

### Reports and follow-up

- [Incident report](https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/triage/report.py): `triage/report.py`
- [Question answering](https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/triage/qa.py): `triage/qa.py`
- [LLM client](https://github.com/taimourmushtaq/techfusion-hackathon-26/blob/main/triage/llm.py): `triage/llm.py`

### Other components

- **Analyst**
- **Dataset files**
- **Groq API**
- **OpenRouter API**

## Connections

- Analyst → CLI entry: runs analysis (evidence: `README.md`)
- Analyst → Web interface: uses web app (evidence: `README.md`)
- Web interface → Web API: requests analysis
- Dataset files → CLI entry: supplies files (evidence: `README.md`)
- Dataset files → Web API: uploads files (evidence: `README.md`)
- CLI entry → Analysis pipeline: runs analysis (evidence: `triage/__main__.py`)
- Web API → Analysis pipeline: analyzes dataset (evidence: `app/main.py`)
- Analysis pipeline → File ingestion: loads files (evidence: `README.md`)
- Analysis pipeline → Time parsing: normalizes timestamps (evidence: `README.md`)
- Analysis pipeline → Event parsing: builds events (evidence: `README.md`)
- Analysis pipeline → Log coverage: checks coverage (evidence: `triage/pipeline.py`)
- Analysis pipeline → Data gaps: finds missing data (evidence: `triage/pipeline.py`)
- Analysis pipeline → Entity resolution: resolves identities (evidence: `README.md`)
- Analysis pipeline → Finding detection: detects findings (evidence: `README.md`)
- Analysis pipeline → Reference evaluation: evaluates references (evidence: `README.md`)
- Analysis pipeline → Incident report: renders report (evidence: `triage/pipeline.py`)
- Web API → Question answering: answers questions (evidence: `app/main.py`)
- Question answering → LLM client: requests generation (evidence: `triage/qa.py`)
- LLM client → Groq API: tries provider (evidence: `triage/llm.py`)
- LLM client → OpenRouter API: falls back (evidence: `triage/llm.py`)