docs(adr): truth-up 0014 + define the Retire-Falco corroboration-parity bar (JEF-305)

[thejefflarson]

Closes JEF-305 — F1 of the "Retire Falco (agent is the sole deployed corroboration source)" epic. Docs + one chart comment only — no code/behavior change.

Why

Falco 0.44.1 crash-loops on the cluster's 7.0.0-1014-raspi arm64 kernel (a libsinsp ABI mismatch), down on 3/6 nodes; the first-party eBPF agent runs healthy there. The epic moves live corroboration to the agent. F1 records the decisions the rest builds on.

The four decisions recorded (ADR-0014 addendum + corrected Status block)

1. Per-objective corroboration is landed, not deferred. The stale "phase-1 / deferred / fill after a shadow bake" note is corrected — the corroborates(behavior, objective) relation shipped in engine/src/engine/reason/proof/corroborate.rs (corroborates / corroborated_for: egress→exfil, secret-read→cred-access, lib-load→foothold + the JEF-77 foothold relation, notable-exec→any), wired at engine/src/engine/reason/proof/mod.rs. Verified against current code.
2. Parity bar = measured decision-path corroboration coverage, NOT Falco rule-replication. Retiring Falco means covering what the decision path consumes (the alert/is_alert corroboration signal), measured at the later F6/F7 gate — not porting Falco's YAML (which would re-create the ADR-0003 coupling being removed).
3. "Retire Falco" = retire the Falco adapter (/ ingest) + external deploy — KEEP the tool-agnostic port. Behavior::Alert + the /behavior ingest port stay (ADR-0003 — any sensor, e.g. Tetragon, can still corroborate); only the Falco-specific / adapter and the external Falco/falcosidekick workload retire.
4. "Alarming-now → blanket corroboration" is an engine-side classifier policy (JEF-113 pattern: wire behavior type stays pure data; classification lives engine-side like observe/exec_class.rs).

Files

• docs/adr/0014-behavioral-telemetry-ebpf.md — corrected Status block + JEF-305 addendum; un-deferred rollout step 3.
• docs/adr/0009-asymmetric-action-bar.md — light amendment note: its "live Falco signal" is now the tool-agnostic, per-objective corroboration of 0014.
• docs/adr/README.md — index statuses for 0009 and 0014.
• charts/protector/values.yaml — fixed the stale "only an alert behavior corroborates" comment.

Honesty / zero-egress / shadow-by-default framing kept intact.

Tests / gates

No .rs touched (docs + one YAML comment), so no Rust tests apply. helm template charts/protector --set ingestAuth.token=x renders OK. All changed files well under the 1,000-line cap. All 4 decision claims verified against the actual code before asserting them.

🤖 Generated with Claude Code