digraph exec_image_flow {
  graph [
    rankdir=TB,
    bgcolor="white",
    pad="0.25",
    nodesep="0.34",
    ranksep="0.46",
    splines=spline,
    size="10,7.5",
    ratio=compress,
    newrank=true,
    fontname="DejaVu Sans"
  ];
  node [
    shape=box,
    style="rounded,filled",
    fillcolor="#F7FAFC",
    color="#4A5568",
    fontcolor="#1A202C",
    fontname="DejaVu Sans",
    fontsize=12,
    margin="0.16,0.10"
  ];
  edge [
    color="#4A5568",
    fontcolor="#2D3748",
    fontname="DejaVu Sans",
    fontsize=10,
    arrowsize=0.75
  ];

  start [
    label="User space\nstart system-wide monitor",
    fillcolor="#EBF8FF",
    color="#3182CE"
  ];
  prepare [
    label="load LSM + ring buffer",
    fillcolor="#EBF8FF",
    color="#3182CE"
  ];
  exec [
    label="any process calls exec",
    fillcolor="#EBF8FF",
    color="#3182CE"
  ];
  hook [
    label="bprm_committed_creds\nobserve every committed exec",
    fillcolor="#FFFAF0",
    color="#DD6B20"
  ];
  pending [
    label="pending[pid_tgid]\nscheduled_ns + task work",
    shape=cylinder,
    fillcolor="#FFF5F5",
    color="#C05621"
  ];
  schedule [
    label="bpf_task_work_schedule_signal\ninspect_executable",
    fillcolor="#FAF5FF",
    color="#805AD5"
  ];
  callback [
    label="sleepable task-work callback\nrecord callback latency",
    fillcolor="#FAF5FF",
    color="#805AD5"
  ];
  file [
    label="bpf_get_task_exe_file\nresolve path",
    fillcolor="#FAF5FF",
    color="#805AD5"
  ];
  read [
    label="file-backed dynptr\nread ELF header\ndiscard dynptr + put file",
    fillcolor="#FAF5FF",
    color="#805AD5"
  ];
  event [
    label="ring buffer event\npath + ELF + latency\ndelete pending entry",
    fillcolor="#F0FFF4",
    color="#38A169"
  ];
  collect [
    label="User space\nstream events until SIGINT/SIGTERM\nfinal drain + stats",
    fillcolor="#EBF8FF",
    color="#3182CE"
  ];

  { rank=same; start; prepare; exec; }
  { rank=same; hook; pending; schedule; }
  { rank=same; callback; file; read; }
  { rank=same; event; collect; }

  start -> prepare;
  prepare -> exec [label="READY"];
  exec -> hook [label="each committed exec"];
  hook -> pending;
  pending -> schedule;
  schedule -> callback [label="task work runs"];
  callback -> file;
  file -> read;
  read -> event;
  event -> collect;
  collect -> exec [label="keep monitoring", style=dashed];
}