yikes,

Guard/Protocol/Detection.cs

@@ -0,0 +1,45 @@
+using System;
+using System.Collections.Generic;
+
+namespace VanadiumGuard.Protocol
+{
+    /// <summary>
+    /// One observation. The client fills these in and ships them; it draws no conclusions.
+    /// </summary>
+    public sealed class Detection
+    {
+        public DetectionCode Code { get; set; }
+
+        public Severity Severity { get; set; }
+
+        /// <summary>
+        /// 0-100. How sure the client is that the observation is what it looks like, rather
+        /// than a legitimate program that happens to match. The policy engine multiplies
+        /// weight by confidence, so a noisy heuristic can stay enabled at low confidence
+        /// without ever reaching a disconnect on its own.
+        /// </summary>
+        public int Confidence { get; set; }
+
+        /// <summary>Normalised subject: module base name, process image name, method signature.</summary>
+        public string Subject { get; set; } = string.Empty;
+
+        /// <summary>Which detector produced this, for triage.</summary>
+        public string Detector { get; set; } = string.Empty;
+
+        /// <summary>Supporting detail. Keep it small; it is stored verbatim.</summary>
+        public Dictionary<string, string> Evidence { get; set; } = new Dictionary<string, string>();
+
+        public DateTimeOffset FirstObservedUtc { get; set; }
+
+        public DateTimeOffset LastObservedUtc { get; set; }
+
+        /// <summary>Times this exact Code plus Subject pair was seen before the batch flushed.</summary>
+        public int OccurrenceCount { get; set; } = 1;
+
+        /// <summary>Dedupe key used by both the client sink and the server store.</summary>
+        public string DedupeKey()
+        {
+            return ((int)Code).ToString() + "|" + Subject;
+        }
+    }
+}