RFCs
RFC index
Request for Comments (RFCs) document significant specification changes before they land in specs/.
Process
- Open a GitHub spec-change issue (never Linear; opentide tracking is public GitHub only)
- Draft an RFC from 0000-template.md
- Maintainer review and acceptance
- Update specs, fixtures,
SPECS.md, andCHANGELOG.mdin the same PR as the RFC, unless the request is for an RFC draft only - Implement opentide changes separately
Index
Proposed
- 0003Per-key vocabulary versioning and schema pinsThis RFC replaces file-level vocabulary versioning with per-key lifecycle metadata on each [[keys]] entry.Proposed
- 0002Vocabulary identifier versioning and schema pinsThis RFC introduces versioned vocabulary identifiers in the form field::major.minor, adds schema-level vocabulary pinning through tide.vocab, and defines bump rules when…Proposed
Draft
- 0012Rules should read like the other objectsA threat file has a threat: block. An objective file has an objective: block.Draft
- 0011Signal reuse across detection objectivesA detection objective (DOM) may incorporate a signal defined on another objective that is already in the repository.Draft
- 0009RFCThis repository is the normative source for opentide's taxonomy, but it publishes that taxonomy as documents for people rather than as a contract for machines.Draft
- 0008Optional review date on detection rulesAdd an optional metadata.reviewed timestamp so a consumer can list detection rules (MDR) that have no recorded review, or whose last review is older than a chosen window.Draft
- 0005RFCobjective.signals[].entities becomes stage-scoped: an authored value is <stage>::<key>, as threat.surface already is.Draft
Accepted
- 0010Deployment external idsVendor-assigned rule ids leave the rule file and move to .opentide/states/deployment/<metadata.uuid>.json (deployment.state::1.0).Accepted
- 0007Elastic Security detection platformAdd a detection platform, elastic (display name Elastic Security, schema platform::elastic::1.0), that deploys opentide rules as Elastic SIEM detection rules.Accepted
- 0006Sharing on the production mergeopentide setup and opentide setup ci gain an optional sharing stage, default off.Accepted
- 0005Sharing system and MISP connectorAdd a first-class sharing subsystem to opentide: pluggable connectors, one workspace file sharing.toml in which every destination is a block under its integration…Accepted
- 0001Authority model and change processThis RFC establishes the normative authority chain for opentide: markdown specs in the specifications repository are canonical; opentide Pydantic models implement them; JSON…Accepted
Reserved
Numbering
- Use four-digit zero-padded numbers:
0002,0003, … - Filename:
NNNN-short-kebab-title.md 0000-template.mdis the template only — not a live proposal