Architecture

Acquisition stays separate from inference. Reports stay separate from codegen.

┌──────────────┐    ┌───────────────────┐    ┌─────────────────┐
│  Importers / │───▶│ Inference engine  │───▶│ Structured      │
│  CaptureSrc  │    │ passes + compete  │    │ Report (JSON)   │
│  hex/bin/    │    │ cluster / index   │    └────────┬────────┘
│  pcapng/dir  │    └───────────────────┘             │
└──────────────┘                                      ▼
                                           CLI / TUI / SVG / codegen

Principles

Observation vs hypothesis — measured facts vs evidence-backed guesses
Competing candidates — pruned/ranked per offset; losers explained
Determinism — same inputs ⇒ same ordered outputs (--jobs merges by name)
Budgets — quick / normal / exhaustive
Extensibility — public Pass registry
Annotations trusted — never auto-overwritten
Honest entropy — never claim “encrypted” without caveats

Packages

Path	Role
`pkg/wiretap`	Public API + Pass registry
`internal/capture`	Hex/binary/PCAPNG + drop-folder
`internal/analysis`	Pipeline, parallel passes
`internal/inference`	Field/checksum/TLV/…/compete
`internal/cluster`	Multi-signal clustering
`internal/index`	On-disk sample index
`internal/visualize`	SVG/HTML field maps
`internal/compare`	Diff, correlation, experiments
`internal/eval`	Measured evaluation
`internal/tui`	Interactive report browser
`schema`	AST + Go/Kaitai/Wireshark codegen

Full write-up: docs/architecture.md in the repository (wiretap docs architecture).