Platform / Endpoint intelligence
Continuum
Every device, continuously understood.
A headless Rust agent owns collection on each endpoint: hardware and software inventory, live resources, processes, connections, and targeted diagnostics, retained locally and synchronized to a fleet console. When something breaks, Continuum shows what the device was, what it was connected to, and what changed before it happened.
- Runtime components
- 5
- Agent tests, last recorded run
- 227
- Processes per snapshot
- 4,096
- Architecture documents
- 36
The questions it answers
When a device breaks, the evidence is already there.
Continuum is built to answer the questions IT teams ask during an incident, from the endpoint's own continuous record instead of reconstruction after the fact.
- What exact device is this: board, processor, memory, GPU, storage, firmware, adapters?
- What OS build, patch level, drivers, services, and applications are present?
- Which adapter is carrying traffic, and what network was the user on at a specific time?
- Was a VPN, SASE client, or tunnel adapter active; did routes, DNS, or the gateway change?
- Which processes were consuming resources during an incident, and what did they connect to?
- Did a driver, OS update, software deployment, or hardware change precede the issue?
- Do other devices with the same model, driver, BIOS, build, SSID, or gateway show the same symptom?
- What evidence can be exported and attached to an incident?
Runtime
Collection lives in the agent, not the window.
Five components, each with one job. Closing a user interface never stops collection, and every endpoint stays useful with no server at all.
- Headless collector
continuum-agent
Owns telemetry, inventory, Time Machine history, bootstrap, and outbound sync. Keeps collecting with no UI open.
- Tauri 2 tray
Local client
Tray-resident support client for this device, consuming only the local agent API. One binary with client and server roles; closing it hides to tray and never stops collection.
- Telemetry ingest
continuum-ingest
Token enrollment and batch intake with gzip transport, explicit size and expansion limits, and matching acknowledgements.
- Product API
continuum-api
Fleet, device, timeline, analytics, and operations API behind the console, with a delegated session flow.
- SvelteKit web
Fleet console
Managed fleet and device experience for IT teams, deployable as a standalone Node runtime or a transferable bundle.
Capabilities
Available in the endpoint lab build.
- 01
Connect and enroll
Guided endpoint configuration with validation, save, test, and enroll as explicit steps; retryable enrollment; retained drafts; and a local-only mode that collects without a server.
- 02
Device overview
Live resource samples and history with collection freshness. During failures the last successful snapshot is retained and clearly marked stale, never replaced by nothing.
- 03
Process investigation
Measured CPU intervals across up to 4,096 processes with truncation metadata, search, sorting, identity and start time, command details, filtered JSON export, and a jump to the sockets a PID owns.
- 04
Connection investigation
Observed connection paths with an exact PID filter, search, and export. Previous observations are kept when a refresh fails.
- 05
Targeted diagnostics
On-demand TCP, DNS, IPv4 ping and traceroute, HTTPS, and TLS checks with validated targets and custom TLS ports. Probes run only on an operator-chosen target; reading diagnostics never contacts public services.
- 06
Hardware, software, and security inventory
In-process WMI and registry collection without script spawning: OS build and domain, board and BIOS, GPUs, memory, disks, displays, USB, adapters, routes, TPM, Secure Boot, BitLocker, antivirus, firewall profiles, scheduled tasks, software, drivers, services, and startup items.
- 07
Device Time Machine
Local SQLite history of snapshots and inventory with per-capability errors that preserve the last valid inventory. Historical views disclose gaps and never substitute future data.
- 08
Durable delivery
Persist-before-send with FIFO replay across outages, restarts, and sleep. Queues reclaim space after draining; permanent rejections and pressure are meant to stay visible.
Principles
Evidence that stays honest under failure.
- Collection is the agent
- The headless agent owns collection. User interfaces read from it; closing them never stops it.
- Local first
- Every endpoint keeps its own history and queue and remains useful with no server at all.
- Typed, in-process diagnostics
- ICMP through the IP Helper API, DNS resolver, and HTTPS/TLS checks run in-process. No CLI spawns, no script soup.
- Stale is labeled, never hidden
- A failed refresh keeps the last good evidence and says so. Unknown stays unknown.
Product boundaries by design
- Not an EDR or XDR replacement
- Not antivirus
- Not employee monitoring
- No keystroke logging
- No browser-history collection
- No content inspection
Architecture
Rust end to end, from endpoint to fleet.
Versioned contracts in a shared schema crate bind the agent, ingest, API, and both clients.
Clients
- Tauri 2
- Svelte 5
- SvelteKit
Tray-resident local client and the managed fleet console.
Endpoint agent
- Rust
- WMI
- IP Helper
- SQLite
Collection, local time series, encrypted outbound queue, status API on loopback.
Server
- continuum-ingest
- continuum-api
- Axum
Enrollment, batch intake, fleet and device APIs, timelines, and analytics.
Shared crates
- schema
- store
- collector
- dataplane
- diagnostics
- authz
- policy
- eventbus
Versioned contracts, storage, collection, transport, diagnostics, and authorization.
Data
- SQLite
- PostgreSQL
SQLite by default; PostgreSQL as the transactional target store.
Program
Twenty phases, gated by evidence.
Each phase exits only on its own definition of done. Labels here follow the project's evidence, not its roadmap table.
- PHASE 00 Discovery, evidence governance, and GHOSTOPS baseline Exited
- PHASE 01 Canonical schema, security, and agent platform foundation In progress
- PHASE 02-07 Hardware, OS and software, adapters, Ethernet, Wi-Fi, VPN and SASE intelligence In progress
- PHASE 08-09 Temporal telemetry, Device Time Machine, connection history and path intelligence In progress
- PHASE 10-12 Central ingestion and streaming, fleet experience, enterprise identity, RBAC, ABAC, and audit Planned
- PHASE 13-16 Remote diagnostics, fleet analytics and anomaly detection, integrations, scale and regional architecture Planned
- PHASE 17-19 macOS and Linux depth, AI-assisted investigation, pilot and general availability Planned
Endpoint acceptance gates open
- Installation and lifecycle: clean install, boot-time service, upgrade, rollback, repair, uninstall, verified signatures
- Collection usefulness: inventory agrees with the OS; denied fields are explicit; process identity survives PID reuse
- Investigation workflow: a real issue followed from resources to sockets, diagnostics, and an export
- Offline recovery: outages, sleep, and network changes replay in order without silent loss
- Sustained resource use: multi-day CPU, memory, latency, disk growth, and queue-age measurement
- Security foundation: database encryption, privileged IPC, device trust, certificate rotation, update integrity
- Operational ownership: support evidence export and documented recovery without database edits
Continuum is a working lab build, not a released product. Its own acceptance plan lists the gates above as open, and short live checks are not presented as multi-day durability or production readiness.
Next
Endpoint evidence that survives the incident.
Continuum is a working lab build moving through its endpoint acceptance gates.