Capture
Receive telemetry or operational events at the edge.
Webhook, file ingest, scanner input, or other baseline adapters
Normalize records into a deterministic internal shape and reject obvious replay or structure issues early.
A stable event object ready for proofing and policy review.