System Architecture

# app.py - Streaming upload for large files (6GB+)
@app.post("/api/upload")
async def upload_file(file: UploadFile):
    # SHA256 hash computed during streaming (zero extra I/O)
    hasher = hashlib.sha256()
    async with aiofiles.open(save_path, 'wb') as out_file:
        while content := await file.read(1024 * 1024):  # 1MB chunks
            await out_file.write(content)
            hasher.update(content)
    file_hash = hasher.hexdigest()
    # Return chain of custody metadata

# engine/ingestor.py
lf, df_eager, file_cat = ingest_file(file_path, ext)
# Returns LazyFrame for large files, DataFrame for small ones

task_results = await asyncio.gather(
    asyncio.to_thread(sub_analyze_timeline, ...),      # Task 1
    asyncio.to_thread(sub_analyze_context, ...),       # Task 2
    asyncio.to_thread(sub_analyze_hunting, ...),       # Task 3
    asyncio.to_thread(sub_analyze_identity_and_procs, ...), # Task 4
    asyncio.to_thread(evaluate_sigma_rules, ...),      # Task 5
    asyncio.to_thread(scan_with_yara, ...),            # Task 6
    asyncio.to_thread(build_correlation_chains, ...),  # Task 7
    asyncio.to_thread(analyze_sessions, ...),          # Task 8
    asyncio.to_thread(calculate_smart_risk_m4, ...),   # Task 9
)

# engine/sigma_engine.py
def evaluate_sigma_rules(df: pl.DataFrame, rules: list) -> dict:
    sigma_hits = []
    for rule in rules:
        # Translate YAML detection block to Polars expressions
        expr = _build_detection_expr(rule['detection'], df.columns)
        matched_df = df.filter(expr)
        if len(matched_df) > 0:
            sigma_hits.append({
                'title': rule['title'],
                'level': rule['level'],
                'mitre_technique': rule.get('tags', []),
                'matched_rows': len(matched_df),
                'sample_evidence': matched_df.head(150),
                'all_row_ids': matched_df['_id'].to_list()[:500]
            })
    return sigma_hits

// static/js/state.js
const ChronosState = {
    currentFilename: null,
    selectedIds: new Set(),
    globalSearch: '',
    timeRange: { start: null, end: null },
    columnFilters: {}
};
// Events: FILTERS_CHANGED, SELECTION_CHANGED, TIME_RANGE_CHANGED, STATE_RESET

# Enforces code quality before every commit
1. app.py < 2000 lines
2. Zero pandas imports
3. pytest test suite passing