# SEMANTIC MODULE
class SemanticAgent:
    def __init__(self, embedding_model):
        self.embedding = embedding_model

    def annotate(self, event):
        vec = self.embedding.encode(event["description"])
        suspicious = vec[0] > 0.75  # threshold for suspicious axis
        return {"node": event["dst"], "suspicious": suspicious}

# TOPOLOGY MODULE (RL POLICY)
class TopologyAgent:
    def __init__(self, graph, policy_model):
        self.graph = graph
        self.policy = policy_model

    def act(self, node_tags):
        # node_tags: {node_id: {'suspicious': bool}}
        return [
            node for node, tag in node_tags.items()
            if tag["suspicious"] and self.graph.degree(node) < 10
        ]

# MESSAGE BUS (simplified)
def pipeline(events, embedding_model, graph, policy_model):
    sem_agent = SemanticAgent(embedding_model)
    topo_agent = TopologyAgent(graph, policy_model)
    node_tags = {}

    for event in events:
        annotation = sem_agent.annotate(event)
        node_tags[annotation["node"]] = annotation

    action_nodes = topo_agent.act(node_tags)
    return action_nodes