chore: initial project skeleton

Acauã: Network Detection & Threat Hunting, heuristic analysis over a
rolling 7-day window using deterministic math (time series, graph
theory, information theory) instead of opaque ML models. Third
product in the Ciberfauna ecosystem, alongside Guará and Sabiá.

Follows the ecosystem's established conventions: OpenWolf project
memory, bilingual PT-BR/EN docs and UI, Gitea Actions CI/CD on the
same self-hosted runners, Conventional Commits, SemVer, logo and
productName handling, MIT OR Apache-2.0 licensing.

Architecture decision (made with the project owner after a dedicated
consultation, not the original blueprint's suggested stack): Rust
throughout, not Python/FastAPI/React. Most of the statistics (Bowley
skew, MADM, Shannon entropy, PCR, Z-score, novel-edge detection,
pivot chains) reduces to SQL over an embedded DuckDB/Parquet store;
only the spectral analysis and graph centrality need host-language
code, and both have workable Rust crates. Documented in full, including
six corrections to the original blueprint's math (Rayleigh/Schuster
instead of a degenerate Lomb-Scargle over bare timestamps, an explicit
sentinel for Bowley skew's Q3=Q1 case, Jensen-Shannon instead of
unbounded KL, a dedicated long-connection detector, JA4 vs. JA4+
licensing caution, deterministic per-alert evidence), in
docs/architecture.md.

Skeleton only: crates/acaua-core has the four detection pillars,
fusion, storage, zeek log parsing and the updater as typed stubs that
compile and return a clear "skeleton" status rather than real
detection logic — that is separate, future work. crates/acaua-cli has
serve/analyze/doctor/update. apps/gui is a minimal Tauri shell. Also
already includes the one-click desktop self-update mechanism shared
with Guará and Sabiá (AppImage/.deb/Windows installer), even with no
release published yet, for consistency across the ecosystem.

No Gitea repository exists for this project yet; this is a local-only
commit.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD

apps/gui/src-tauri/Cargo.toml

@@ -0,0 +1,24 @@
+[package]
+name = "acaua-gui"
+description = "Acauã: graphical network threat hunting interface"
+version = "0.1.0"
+edition = "2021"
+license = "MIT OR Apache-2.0"
+authors = ["Acauã contributors"]
+repository = "https://git.lucasrguerra.dev.br/ciberfauna/acaua"
+rust-version = "1.80"
+
+[workspace]
+
+[build-dependencies]
+tauri-build = { version = "2", features = [] }
+
+[dependencies]
+acaua-core = { path = "../../../crates/acaua-core" }
+serde_json = "1"
+tauri = { version = "2", features = [] }
+
+[profile.release]
+lto = "thin"
+codegen-units = 1
+strip = true

apps/gui/src-tauri/build.rs

@@ -0,0 +1,5 @@
+fn main() {
+    println!("cargo:rerun-if-changed=../../../logo.png");
+    let _ = std::fs::copy("../../../logo.png", "../ui/logo.png");
+    tauri_build::build();
+}

apps/gui/src-tauri/capabilities/default.json

@@ -0,0 +1,7 @@
+{
+  "$schema": "../gen/schemas/desktop-schema.json",
+  "identifier": "default",
+  "description": "Main window permissions",
+  "windows": ["main"],
+  "permissions": ["core:default", "core:window:allow-destroy", "core:window:allow-close"]
+}

apps/gui/src-tauri/src/main.rs

@@ -0,0 +1,62 @@
+#![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
+
+use acaua_core::{doctor, update, zeek};
+
+#[tauri::command]
+fn app_info() -> serde_json::Value {
+    serde_json::json!({
+        "version": env!("CARGO_PKG_VERSION"),
+        "mode": "desktop",
+        "status": "skeleton"
+    })
+}
+
+#[tauri::command]
+fn doctor_report() -> Result<serde_json::Value, String> {
+    serde_json::to_value(doctor::run()).map_err(|error| error.to_string())
+}
+
+#[tauri::command]
+fn analyze_dataset(path: String) -> Result<serde_json::Value, String> {
+    let report = zeek::analyze_dir(&path).map_err(|error| error.to_string())?;
+    serde_json::to_value(report).map_err(|error| error.to_string())
+}
+
+#[tauri::command]
+fn list_alerts() -> serde_json::Value {
+    serde_json::json!([])
+}
+
+#[tauri::command]
+fn update_check() -> Result<serde_json::Value, String> {
+    let status = update::check(env!("CARGO_PKG_VERSION")).map_err(|error| error.to_string())?;
+    serde_json::to_value(status).map_err(|error| error.to_string())
+}
+
+#[tauri::command]
+fn update_apply(app: tauri::AppHandle) -> Result<String, String> {
+    use tauri::Emitter;
+    let exe = std::env::var_os("APPIMAGE")
+        .map(std::path::PathBuf::from)
+        .filter(|p| p.is_file())
+        .or_else(|| std::env::current_exe().ok())
+        .unwrap_or_else(|| std::path::PathBuf::from("acaua-gui"));
+    update::apply_desktop_with_progress(&exe, move |phase| {
+        let _ = app.emit("update-progress", serde_json::json!({ "phase": phase }));
+    })
+    .map_err(|error| error.to_string())
+}
+
+fn main() {
+    tauri::Builder::default()
+        .invoke_handler(tauri::generate_handler![
+            app_info,
+            doctor_report,
+            analyze_dataset,
+            list_alerts,
+            update_check,
+            update_apply
+        ])
+        .run(tauri::generate_context!())
+        .expect("failed to run Acauã");
+}

apps/gui/src-tauri/tauri.conf.json

@@ -0,0 +1,39 @@
+{
+  "$schema": "https://schema.tauri.app/config/2",
+  "productName": "Acauã",
+  "version": "0.1.0",
+  "identifier": "dev.acaua.app",
+  "build": {
+    "frontendDist": "../ui"
+  },
+  "app": {
+    "withGlobalTauri": true,
+    "windows": [
+      {
+        "title": "Acauã",
+        "width": 1280,
+        "height": 820,
+        "minWidth": 460,
+        "minHeight": 600,
+        "resizable": true
+      }
+    ],
+    "security": {
+      "csp": "default-src 'self'; img-src 'self' data:; connect-src 'self' ipc: http://ipc.localhost; style-src 'self' 'unsafe-inline'; script-src 'self'; object-src 'none'"
+    }
+  },
+  "bundle": {
+    "active": true,
+    "targets": "all",
+    "category": "Utility",
+    "shortDescription": "Caça a ameaças em rede",
+    "longDescription": "Acauã é uma ferramenta de caça a ameaças em rede com evidência determinística, processamento local e sem IA opaca.",
+    "icon": [
+      "icons/32x32.png",
+      "icons/128x128.png",
+      "icons/128x128@2x.png",
+      "icons/icon.icns",
+      "icons/icon.ico"
+    ]
+  }
+}

apps/gui/ui/app.css

@@ -0,0 +1,304 @@
+:root {
+  color-scheme: dark;
+  --bg: #071018;
+  --bg-2: #0b1722;
+  --panel: rgba(15, 30, 43, 0.78);
+  --panel-solid: #0f1e2b;
+  --line: rgba(148, 188, 205, 0.18);
+  --line-strong: rgba(148, 188, 205, 0.34);
+  --text: #e8f2f4;
+  --muted: #8fa8b3;
+  --accent: #45d6b0;
+  --accent-2: #f0b35b;
+  --danger: #f27878;
+  --shadow: 0 24px 60px rgba(0, 0, 0, 0.32);
+  --radius: 16px;
+  --mono: "SFMono-Regular", Consolas, "Liberation Mono", monospace;
+  --sans: "Inter", "Segoe UI", system-ui, -apple-system, sans-serif;
+}
+
+html[data-theme="light"] {
+  color-scheme: light;
+  --bg: #eef4f3;
+  --bg-2: #e2ece9;
+  --panel: rgba(255, 255, 255, 0.84);
+  --panel-solid: #ffffff;
+  --line: rgba(20, 58, 64, 0.14);
+  --line-strong: rgba(20, 58, 64, 0.28);
+  --text: #10262b;
+  --muted: #5d7479;
+  --accent: #087f68;
+  --accent-2: #a05b09;
+  --danger: #b42323;
+  --shadow: 0 20px 50px rgba(20, 58, 64, 0.12);
+}
+
+* { box-sizing: border-box; }
+
+html, body { min-height: 100%; }
+
+body {
+  margin: 0;
+  font-family: var(--sans);
+  color: var(--text);
+  background:
+    radial-gradient(900px 520px at 12% -8%, rgba(69, 214, 176, 0.15), transparent 60%),
+    radial-gradient(760px 480px at 95% 0%, rgba(240, 179, 91, 0.12), transparent 58%),
+    linear-gradient(150deg, var(--bg), var(--bg-2));
+  background-attachment: fixed;
+}
+
+button, input, select { font: inherit; color: inherit; }
+button { cursor: pointer; }
+h1, h2, p { margin: 0; }
+
+.app {
+  display: grid;
+  grid-template-columns: 286px minmax(0, 1fr);
+  min-height: 100vh;
+}
+
+.sidebar {
+  display: flex;
+  flex-direction: column;
+  gap: 22px;
+  padding: 28px 22px;
+  border-right: 1px solid var(--line);
+  background: linear-gradient(180deg, rgba(8, 19, 28, 0.72), rgba(8, 19, 28, 0.36));
+  backdrop-filter: blur(18px);
+  position: sticky;
+  top: 0;
+  height: 100vh;
+}
+
+html[data-theme="light"] .sidebar {
+  background: linear-gradient(180deg, rgba(255, 255, 255, 0.7), rgba(255, 255, 255, 0.4));
+}
+
+.brand { display: flex; align-items: center; gap: 12px; }
+.logo { width: 46px; height: 46px; object-fit: contain; filter: drop-shadow(0 8px 18px rgba(0, 0, 0, 0.25)); }
+.brand strong { display: block; font-size: 1.18rem; letter-spacing: 0.01em; }
+.brand small { display: block; color: var(--muted); font-size: 0.78rem; margin-top: 2px; }
+
+.side-title {
+  color: var(--muted);
+  font-size: 0.7rem;
+  letter-spacing: 0.16em;
+  text-transform: uppercase;
+}
+
+.nav { display: grid; gap: 6px; }
+.nav-item {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  width: 100%;
+  padding: 11px 12px;
+  border: 1px solid transparent;
+  border-radius: 12px;
+  background: transparent;
+  text-align: left;
+  color: var(--muted);
+  transition: 160ms ease;
+}
+.nav-item:hover { border-color: var(--line); background: rgba(69, 214, 176, 0.06); color: var(--text); }
+.nav-item.active { border-color: var(--line-strong); background: rgba(69, 214, 176, 0.1); color: var(--text); }
+.nav-icon { width: 20px; color: var(--accent); text-align: center; }
+.nav-label { display: block; font-size: 0.92rem; font-weight: 600; }
+.nav-sub { display: block; font-size: 0.72rem; color: var(--muted); margin-top: 2px; }
+
+.side-foot { margin-top: auto; display: grid; gap: 12px; }
+.status-row { display: flex; align-items: center; justify-content: space-between; gap: 10px; }
+.pill {
+  display: inline-flex;
+  align-items: center;
+  gap: 7px;
+  padding: 5px 9px;
+  border: 1px solid var(--line);
+  border-radius: 999px;
+  font-size: 0.72rem;
+  color: var(--text);
+  background: rgba(255, 255, 255, 0.03);
+}
+.pill.muted { color: var(--muted); }
+.dot { width: 7px; height: 7px; border-radius: 50%; background: var(--accent); box-shadow: 0 0 12px var(--accent); }
+.pill.offline .dot { background: var(--danger); box-shadow: 0 0 12px var(--danger); }
+.mono { font-family: var(--mono); font-size: 0.75rem; color: var(--muted); }
+
+.main { padding: 38px clamp(22px, 4vw, 56px) 42px; min-width: 0; }
+.topbar { display: flex; align-items: flex-start; justify-content: space-between; gap: 24px; margin-bottom: 26px; }
+.eyebrow { color: var(--accent); font-size: 0.72rem; letter-spacing: 0.2em; text-transform: uppercase; margin-bottom: 8px; }
+h1 { font-size: clamp(1.9rem, 3.3vw, 3.1rem); line-height: 1.04; letter-spacing: -0.035em; }
+.sub { color: var(--muted); margin-top: 10px; font-size: 0.98rem; }
+h2 { font-size: 1.08rem; letter-spacing: -0.01em; }
+
+.icon-btn {
+  display: inline-grid;
+  place-items: center;
+  width: 40px;
+  height: 40px;
+  border: 1px solid var(--line);
+  border-radius: 12px;
+  background: var(--panel);
+  color: var(--text);
+  font-size: 1.05rem;
+}
+.icon-btn:hover { border-color: var(--line-strong); }
+
+.notice {
+  display: flex;
+  gap: 10px;
+  align-items: baseline;
+  padding: 14px 16px;
+  margin-bottom: 14px;
+  border: 1px solid var(--line);
+  border-radius: 12px;
+  background: var(--panel);
+  color: var(--muted);
+  font-size: 0.86rem;
+  line-height: 1.5;
+}
+.notice strong { color: var(--text); white-space: nowrap; }
+.notice-warn { border-color: rgba(240, 179, 91, 0.34); background: rgba(240, 179, 91, 0.07); }
+
+.pillars {
+  display: grid;
+  grid-template-columns: repeat(4, minmax(0, 1fr));
+  gap: 14px;
+  margin: 24px 0;
+}
+.card {
+  display: flex;
+  flex-direction: column;
+  gap: 9px;
+  min-height: 178px;
+  padding: 20px;
+  border: 1px solid var(--line);
+  border-radius: var(--radius);
+  background: linear-gradient(160deg, var(--panel), rgba(15, 30, 43, 0.36));
+  box-shadow: var(--shadow);
+}
+html[data-theme="light"] .card { background: linear-gradient(160deg, var(--panel), rgba(255, 255, 255, 0.5)); }
+.card-kicker { color: var(--accent); font-size: 0.68rem; letter-spacing: 0.18em; text-transform: uppercase; }
+.card h2 { font-size: 1.02rem; }
+.card p { color: var(--muted); font-size: 0.83rem; line-height: 1.5; }
+.tag { margin-top: auto; align-self: flex-start; color: var(--accent-2); font-size: 0.68rem; letter-spacing: 0.08em; text-transform: uppercase; }
+
+.panel {
+  margin-top: 16px;
+  padding: 22px;
+  border: 1px solid var(--line);
+  border-radius: var(--radius);
+  background: var(--panel);
+  box-shadow: var(--shadow);
+  scroll-margin-top: 20px;
+}
+.panel-head { display: flex; align-items: flex-start; justify-content: space-between; gap: 18px; margin-bottom: 18px; }
+.hint { color: var(--muted); font-size: 0.84rem; line-height: 1.5; margin-top: 5px; }
+
+.field-row { display: flex; align-items: flex-end; gap: 10px; }
+.field { display: grid; gap: 7px; flex: 1; }
+.field > span { color: var(--muted); font-size: 0.74rem; letter-spacing: 0.08em; text-transform: uppercase; }
+input, select {
+  width: 100%;
+  padding: 10px 12px;
+  border: 1px solid var(--line-strong);
+  border-radius: 10px;
+  background: rgba(0, 0, 0, 0.16);
+  outline: none;
+}
+html[data-theme="light"] input, html[data-theme="light"] select { background: rgba(255, 255, 255, 0.7); }
+input:focus, select:focus { border-color: var(--accent); box-shadow: 0 0 0 3px rgba(69, 214, 176, 0.12); }
+
+.btn {
+  padding: 10px 14px;
+  border: 1px solid var(--line-strong);
+  border-radius: 10px;
+  background: rgba(255, 255, 255, 0.04);
+  color: var(--text);
+  font-size: 0.84rem;
+  font-weight: 600;
+  white-space: nowrap;
+}
+.btn:hover { border-color: var(--accent); }
+.btn.primary { background: var(--accent); border-color: var(--accent); color: #06211b; }
+.btn.primary:hover { filter: brightness(1.06); }
+.btn:disabled { opacity: 0.5; cursor: progress; }
+
+.link-btn { border: 0; background: transparent; color: var(--accent); font-size: 0.75rem; padding: 0; }
+.link-btn:hover { text-decoration: underline; }
+
+.output {
+  min-height: 92px;
+  margin: 16px 0 0;
+  padding: 14px;
+  overflow: auto;
+  border: 1px solid var(--line);
+  border-radius: 10px;
+  background: rgba(0, 0, 0, 0.2);
+  color: var(--muted);
+  font-family: var(--mono);
+  font-size: 0.76rem;
+  line-height: 1.55;
+  white-space: pre-wrap;
+}
+html[data-theme="light"] .output { background: rgba(20, 58, 64, 0.04); }
+
+.alert-list { display: grid; gap: 8px; margin: 0; padding: 0; list-style: none; }
+.alert-list li {
+  padding: 12px 14px;
+  border: 1px solid var(--line);
+  border-radius: 10px;
+  background: rgba(255, 255, 255, 0.02);
+  font-size: 0.84rem;
+}
+.alert-list .empty { color: var(--muted); border-style: dashed; }
+.alert-meta { display: flex; justify-content: space-between; gap: 12px; margin-bottom: 4px; }
+.alert-meta strong { font-size: 0.78rem; color: var(--accent-2); }
+.alert-summary { color: var(--muted); line-height: 1.5; }
+
+.foot {
+  display: flex;
+  justify-content: space-between;
+  gap: 16px;
+  margin-top: 26px;
+  color: var(--muted);
+  font-size: 0.74rem;
+}
+
+dialog {
+  width: min(460px, calc(100vw - 32px));
+  padding: 22px;
+  border: 1px solid var(--line-strong);
+  border-radius: var(--radius);
+  background: var(--panel-solid);
+  color: var(--text);
+  box-shadow: var(--shadow);
+}
+dialog::backdrop { background: rgba(2, 8, 12, 0.62); backdrop-filter: blur(3px); }
+.dialog-head { display: flex; align-items: center; justify-content: space-between; margin-bottom: 18px; }
+dialog .field { margin-bottom: 14px; }
+dialog menu { display: flex; justify-content: flex-end; gap: 8px; margin: 20px 0 0; padding: 0; }
+.segmented { display: flex; gap: 4px; padding: 3px; border: 1px solid var(--line); border-radius: 10px; }
+.segmented button { flex: 1; padding: 7px 8px; border: 0; border-radius: 7px; background: transparent; color: var(--muted); font-size: 0.78rem; }
+.segmented button.active { background: rgba(69, 214, 176, 0.16); color: var(--text); }
+
+@media (max-width: 1120px) {
+  .pillars { grid-template-columns: repeat(2, minmax(0, 1fr)); }
+}
+
+@media (max-width: 820px) {
+  .app { grid-template-columns: 1fr; }
+  .sidebar { position: static; height: auto; border-right: 0; border-bottom: 1px solid var(--line); }
+  .nav { grid-template-columns: repeat(2, minmax(0, 1fr)); }
+  .side-foot { margin-top: 0; }
+  .main { padding-top: 26px; }
+}
+
+@media (max-width: 560px) {
+  .pillars { grid-template-columns: 1fr; }
+  .field-row { flex-direction: column; align-items: stretch; }
+  .notice { flex-direction: column; gap: 4px; }
+  .panel-head { flex-direction: column; }
+  .foot { flex-direction: column; }
+}

apps/gui/ui/app.js

@@ -0,0 +1,222 @@
+import { setLang, tr } from './i18n.js';
+
+const $ = (selector) => document.querySelector(selector);
+const tauriInvoke = window.__TAURI__?.core?.invoke;
+
+const connection = $('#connection');
+const connectionText = $('#connectionText');
+const version = $('#version');
+const updateBtn = $('#updateBtn');
+const datasetPath = $('#datasetPath');
+const analyzeBtn = $('#analyzeBtn');
+const refreshBtn = $('#refreshBtn');
+const output = $('#output');
+const alertList = $('#alertList');
+const settingsDlg = $('#settingsDlg');
+const settingsBtn = $('#settingsBtn');
+const closeSettings = $('#closeSettings');
+const doneSettings = $('#doneSettings');
+const langSel = $('#langSel');
+const themePick = $('#themePick');
+
+let lastAlerts = [];
+let themePreference = localStorage.getItem('acaua-theme') || 'auto';
+
+async function fetchJson(path, options = {}) {
+  const response = await fetch(path, options);
+  const body = await response.json().catch(() => ({}));
+  if (!response.ok) throw new Error(body.error || response.statusText);
+  return body;
+}
+
+async function call(command, args = {}) {
+  if (tauriInvoke) return tauriInvoke(command, args);
+  switch (command) {
+    case 'app_info':
+      return fetchJson('/api/status');
+    case 'analyze_dataset':
+      return fetchJson('/api/analyze', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(args),
+      });
+    case 'list_alerts':
+      return fetchJson('/api/alerts');
+    case 'update_check':
+      return fetchJson('/api/update');
+    case 'doctor_report':
+      return fetchJson('/api/health');
+    default:
+      throw new Error(`unsupported command: ${command}`);
+  }
+}
+
+function message(template, ...values) {
+  let index = 0;
+  return tr(template).replace(/\{n\}/g, () => values[index++] ?? '');
+}
+
+function renderAlerts(alerts) {
+  lastAlerts = Array.isArray(alerts) ? alerts : [];
+  alertList.replaceChildren();
+  if (!lastAlerts.length) {
+    const empty = document.createElement('li');
+    empty.className = 'empty';
+    empty.textContent = tr('Nenhum alerta ainda.');
+    alertList.append(empty);
+    return;
+  }
+  for (const alert of lastAlerts) {
+    const item = document.createElement('li');
+    const meta = document.createElement('div');
+    meta.className = 'alert-meta';
+    const pillar = document.createElement('strong');
+    pillar.textContent = message('Pilar {n}', alert.pillar);
+    const score = document.createElement('span');
+    score.className = 'mono';
+    score.textContent = Number(alert.score).toFixed(3);
+    meta.append(pillar, score);
+    const summary = document.createElement('div');
+    summary.className = 'alert-summary';
+    summary.setAttribute('data-i18n-skip', '');
+    summary.textContent = alert.summary;
+    item.append(meta, summary);
+    alertList.append(item);
+  }
+}
+
+async function refreshStatus() {
+  try {
+    const info = await call('app_info');
+    version.textContent = `v${info.version}`;
+    connectionText.textContent = tr('Serviço local ativo');
+    connection.classList.remove('offline');
+  } catch (error) {
+    connectionText.textContent = tr('Serviço indisponível');
+    connection.classList.add('offline');
+    version.textContent = '—';
+    console.error(error);
+  }
+}
+
+async function refreshAlerts() {
+  try {
+    renderAlerts(await call('list_alerts'));
+  } catch (error) {
+    console.error(error);
+  }
+}
+
+async function analyzeDataset() {
+  const path = datasetPath.value.trim();
+  if (!path) {
+    output.textContent = tr('Nenhum dataset selecionado.');
+    return;
+  }
+  analyzeBtn.disabled = true;
+  output.textContent = tr('Analisando…');
+  try {
+    const report = await call('analyze_dataset', { path });
+    output.textContent = message(
+      'Análise concluída: {n} registros e {n} alertas.',
+      report.records,
+      report.alerts.length,
+    );
+    await refreshAlerts();
+  } catch (error) {
+    output.textContent = message('Falha na análise: {n}', error.message);
+  } finally {
+    analyzeBtn.disabled = false;
+  }
+}
+
+async function checkUpdate() {
+  updateBtn.disabled = true;
+  updateBtn.textContent = tr('Verificando atualização…');
+  try {
+    const status = await call('update_check');
+    updateBtn.textContent = status.update_available
+      ? message('Atualização {n} disponível.', status.latest_version)
+      : message('Versão {n} é a mais recente.', status.current_version);
+  } catch (error) {
+    updateBtn.title = message('Não foi possível verificar a atualização: {n}', error.message);
+    updateBtn.textContent = tr('checar atualização');
+  } finally {
+    updateBtn.disabled = false;
+    window.setTimeout(() => {
+      updateBtn.textContent = tr('checar atualização');
+      updateBtn.title = '';
+    }, 6000);
+  }
+}
+
+function applyTheme(preference) {
+  themePreference = preference;
+  localStorage.setItem('acaua-theme', preference);
+  const light = window.matchMedia('(prefers-color-scheme: light)').matches;
+  const effective = preference === 'auto' ? (light ? 'light' : 'dark') : preference;
+  document.documentElement.dataset.theme = effective;
+  themePick.querySelectorAll('[data-theme-pick]').forEach((button) => {
+    button.classList.toggle('active', button.dataset.themePick === preference);
+  });
+}
+
+function openSettings() {
+  langSel.value = localStorage.getItem('acaua-lang') || 'auto';
+  settingsDlg.showModal();
+}
+
+function closeDialog() {
+  settingsDlg.close();
+}
+
+function setActiveNav(target) {
+  document.querySelectorAll('.nav-item').forEach((button) => {
+    button.classList.toggle('active', button.dataset.target === target);
+  });
+}
+
+function init() {
+  applyTheme(themePreference);
+  langSel.value = localStorage.getItem('acaua-lang') || 'auto';
+  setLang(langSel.value);
+  refreshStatus();
+  refreshAlerts();
+
+  analyzeBtn.addEventListener('click', analyzeDataset);
+  datasetPath.addEventListener('keydown', (event) => {
+    if (event.key === 'Enter') analyzeDataset();
+  });
+  refreshBtn.addEventListener('click', async () => {
+    await refreshStatus();
+    await refreshAlerts();
+  });
+  updateBtn.addEventListener('click', checkUpdate);
+  settingsBtn.addEventListener('click', openSettings);
+  closeSettings.addEventListener('click', closeDialog);
+  doneSettings.addEventListener('click', closeDialog);
+  langSel.addEventListener('change', () => {
+    localStorage.setItem('acaua-lang', langSel.value);
+    setLang(langSel.value);
+    refreshStatus();
+    renderAlerts(lastAlerts);
+    updateBtn.textContent = tr('checar atualização');
+  });
+  themePick.addEventListener('click', (event) => {
+    const button = event.target.closest('[data-theme-pick]');
+    if (button) applyTheme(button.dataset.themePick);
+  });
+  window.matchMedia('(prefers-color-scheme: light)').addEventListener('change', () => {
+    if (themePreference === 'auto') applyTheme('auto');
+  });
+  document.querySelectorAll('.nav-item').forEach((button) => {
+    button.addEventListener('click', () => {
+      const target = button.dataset.target;
+      setActiveNav(target);
+      if (target === 'settings') openSettings();
+      else document.getElementById(target)?.scrollIntoView({ behavior: 'smooth', block: 'start' });
+    });
+  });
+}
+
+init();

apps/gui/ui/i18n-en.js

@@ -0,0 +1,66 @@
+export const EN = {
+  'Acauã': 'Acauã',
+  'caça a ameaças em rede': 'network threat hunting',
+  'Navegação': 'Navigation',
+  'Visão geral': 'Overview',
+  'painel e estado': 'dashboard and status',
+  'Alertas': 'Alerts',
+  'evidências recentes': 'recent evidence',
+  'Análise': 'Analysis',
+  'dataset Zeek': 'Zeek dataset',
+  'Configurações': 'Settings',
+  'idioma e tema': 'language and theme',
+  'Conectando…': 'Connecting…',
+  'esqueleto': 'skeleton',
+  'checar atualização': 'check for updates',
+  'Caça a ameaças em rede': 'Network threat hunting',
+  'Pesquisa determinística, sem IA opaca': 'Deterministic research, no opaque AI',
+  'Aviso de escopo.': 'Scope notice.',
+  'Este é um esqueleto pré-implementação. Os quatro pilares matemáticos, o parser Zeek e o armazenamento DuckDB ainda não estão implementados.': 'This is a pre-implementation skeleton. The four mathematical pillars, the Zeek parser and the DuckDB storage are not implemented yet.',
+  'Uso autorizado.': 'Authorized use.',
+  'Use somente em redes próprias ou com autorização explícita. Nenhum pacote é enviado para fora.': 'Use only on your own networks or with explicit authorization. No packet leaves the machine.',
+  'Pilares de detecção': 'Detection pillars',
+  'Pilar {n}': 'Pillar {n}',
+  'Pilar 1': 'Pillar 1',
+  'Periodograma de Rayleigh/Schuster. Em desenvolvimento.': 'Rayleigh/Schuster periodogram. Under development.',
+  'em desenvolvimento': 'under development',
+  'Pilar 2': 'Pillar 2',
+  'Sessões persistentes': 'Persistent sessions',
+  'Detector de conexões longas. Em desenvolvimento.': 'Long-connection detector. Under development.',
+  'Pilar 3': 'Pillar 3',
+  'Anomalias de protocolo': 'Protocol anomalies',
+  'Features determinísticas por protocolo. Em desenvolvimento.': 'Deterministic per-protocol features. Under development.',
+  'Pilar 4': 'Pillar 4',
+  'Fusão de evidências': 'Evidence fusion',
+  'Jensen-Shannon e prova por alerta. Em desenvolvimento.': 'Jensen-Shannon and per-alert proof. Under development.',
+  'Analisar dataset': 'Analyze dataset',
+  'Aponte para um diretório de logs Zeek ou para um dataset local.': 'Point to a Zeek log directory or a local dataset.',
+  'Diretório de logs': 'Log directory',
+  'Analisar': 'Analyze',
+  'Atualizar status': 'Refresh status',
+  'Nenhuma análise executada.': 'No analysis has run yet.',
+  'Alertas recentes': 'Recent alerts',
+  'Cada alerta futuro carregará a evidência determinística que o sustenta.': 'Every future alert will carry the deterministic evidence behind it.',
+  'Nenhum alerta ainda. O motor de detecção será ligado nas próximas specs.': 'No alerts yet. The detection engine will be enabled in upcoming specs.',
+  'Acauã · esqueleto pré-implementação': 'Acauã · pre-implementation skeleton',
+  'Fechar configurações': 'Close settings',
+  'Fechar': 'Close',
+  'Idioma': 'Language',
+  'Tema': 'Theme',
+  'Claro': 'Light',
+  'Escuro': 'Dark',
+  'Navegação principal': 'Main navigation',
+  'Serviço local ativo': 'Local service online',
+  'Serviço indisponível': 'Service unavailable',
+  'Nenhum dataset selecionado.': 'No dataset selected.',
+  'Analisando…': 'Analyzing…',
+  'Análise concluída: {n} registros e {n} alertas.': 'Analysis complete: {n} records and {n} alerts.',
+  'Falha na análise: {n}': 'Analysis failed: {n}',
+  'Verificando atualização…': 'Checking for updates…',
+  'Versão {n} é a mais recente.': 'Version {n} is the latest.',
+  'Atualização {n} disponível.': 'Update {n} available.',
+  'Não foi possível verificar a atualização: {n}': 'Could not check for updates: {n}',
+  'Nenhum alerta ainda.': 'No alerts yet.',
+  'Alertas carregados: {n}': 'Alerts loaded: {n}',
+  'versão {n}': 'version {n}',
+};

apps/gui/ui/i18n.js

@@ -0,0 +1,145 @@
+import { EN } from './i18n-en.js';
+
+let lang = 'pt';
+export const isEn = () => lang === 'en';
+export const currentLang = () => lang;
+export const LOC = () => (lang === 'en' ? 'en-US' : 'pt-BR');
+
+export function resolveLang(pref) {
+  if (pref === 'pt' || pref === 'en') return pref;
+  return (navigator.language || 'pt').toLowerCase().startsWith('pt') ? 'pt' : 'en';
+}
+
+const ATTRS = ['placeholder', 'title', 'aria-label', 'alt', 'data-empty'];
+const SKIP = '.ssid, .bssid, .mono, pre, code, input, textarea, script, style, [data-i18n-skip]';
+
+const exact = new Map(Object.entries(EN).filter(([key]) => !key.includes('{n}')));
+const patterns = Object.entries(EN)
+  .filter(([key]) => key.includes('{n}'))
+  .map(([key, value]) => {
+    const parts = key.split('{n}').map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'));
+    return { re: new RegExp('^' + parts.join('(.+?)') + '$', 's'), to: value };
+  })
+  .sort((a, b) => b.re.source.length - a.re.source.length);
+
+const cache = new Map();
+export function tr(text) {
+  if (!isEn()) return text;
+  const lead = text.match(/^\s*/)[0];
+  const trail = text.match(/\s*$/)[0];
+  const core = text.trim();
+  if (!core) return text;
+  if (cache.has(core)) return lead + cache.get(core) + trail;
+  let out = exact.get(core);
+  if (out === undefined) {
+    for (const pattern of patterns) {
+      const match = core.match(pattern.re);
+      if (match) {
+        let index = 0;
+        out = pattern.to.replace(/\{n\}/g, () => tr(match[++index] ?? ''));
+        break;
+      }
+    }
+  }
+  if (out === undefined) out = core;
+  if (cache.size > 5000) cache.clear();
+  cache.set(core, out);
+  return lead + out + trail;
+}
+
+const original = new WeakMap();
+let observer = null;
+
+function translateNode(node) {
+  if (node.nodeType === 3) {
+    if (node.parentElement?.closest(SKIP)) return;
+    const source = original.get(node) ?? node.nodeValue;
+    const translated = tr(source);
+    if (translated !== node.nodeValue) {
+      if (!original.has(node)) original.set(node, source);
+      node.nodeValue = translated;
+    }
+  } else if (node.nodeType === 1) {
+    if (node.matches?.(SKIP) && node.tagName !== 'INPUT') return;
+    for (const attribute of ATTRS) {
+      if (node.hasAttribute?.(attribute)) {
+        const key = `i18n-${attribute}`;
+        const source = node[key] ?? node.getAttribute(attribute);
+        const translated = tr(source);
+        if (translated !== node.getAttribute(attribute)) {
+          node[key] = source;
+          node.setAttribute(attribute, translated);
+        }
+      }
+    }
+    for (const child of node.childNodes) translateNode(child);
+  }
+}
+
+function restoreAll(root) {
+  const walker = document.createTreeWalker(root, NodeFilter.SHOW_TEXT);
+  let node;
+  while ((node = walker.nextNode())) {
+    if (original.has(node)) {
+      node.nodeValue = original.get(node);
+      original.delete(node);
+    }
+  }
+  root.querySelectorAll('*').forEach((element) => {
+    for (const attribute of ATTRS) {
+      const key = `i18n-${attribute}`;
+      if (element[key] !== undefined) {
+        element.setAttribute(attribute, element[key]);
+        delete element[key];
+      }
+    }
+  });
+}
+
+function start() {
+  translateNode(document.body);
+  document.title = tr(document.title);
+  if (observer) return;
+  observer = new MutationObserver((mutations) => {
+    observer.disconnect();
+    for (const mutation of mutations) {
+      if (mutation.type === 'childList') mutation.addedNodes.forEach(translateNode);
+      else if (mutation.type === 'characterData') {
+        original.delete(mutation.target);
+        translateNode(mutation.target);
+      } else if (mutation.type === 'attributes') {
+        delete mutation.target[`i18n-${mutation.attributeName}`];
+        translateNode(mutation.target);
+      }
+    }
+    observer.observe(document.body, {
+      childList: true,
+      subtree: true,
+      characterData: true,
+      attributes: true,
+      attributeFilter: ATTRS,
+    });
+  });
+  observer.observe(document.body, {
+    childList: true,
+    subtree: true,
+    characterData: true,
+    attributes: true,
+    attributeFilter: ATTRS,
+  });
+}
+
+function stop() {
+  observer?.disconnect();
+  observer = null;
+  restoreAll(document.body);
+}
+
+export function setLang(pref) {
+  const next = resolveLang(pref);
+  const changed = next !== lang;
+  lang = next;
+  document.documentElement.lang = lang === 'en' ? 'en' : 'pt-BR';
+  if (lang === 'en') start();
+  else if (changed || observer) stop();
+}

apps/gui/ui/index.html

@@ -0,0 +1,167 @@
+<!doctype html>
+<html lang="pt-BR">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Acauã</title>
+<link rel="icon" href="/logo.png">
+<link rel="stylesheet" href="/app.css">
+</head>
+<body>
+<div class="app">
+  <aside class="sidebar">
+    <div class="brand">
+      <img class="logo" src="/logo.png" alt="">
+      <div>
+        <strong>Acauã</strong>
+        <small>caça a ameaças em rede</small>
+      </div>
+    </div>
+
+    <div class="side-title">Navegação</div>
+    <nav class="nav" aria-label="Navegação principal">
+      <button type="button" class="nav-item active" data-target="overview">
+        <span class="nav-icon">◈</span>
+        <span><span class="nav-label">Visão geral</span><span class="nav-sub">painel e estado</span></span>
+      </button>
+      <button type="button" class="nav-item" data-target="alerts">
+        <span class="nav-icon">◎</span>
+        <span><span class="nav-label">Alertas</span><span class="nav-sub">evidências recentes</span></span>
+      </button>
+      <button type="button" class="nav-item" data-target="analysis">
+        <span class="nav-icon">⌁</span>
+        <span><span class="nav-label">Análise</span><span class="nav-sub">dataset Zeek</span></span>
+      </button>
+      <button type="button" class="nav-item" data-target="settings">
+        <span class="nav-icon">⚙</span>
+        <span><span class="nav-label">Configurações</span><span class="nav-sub">idioma e tema</span></span>
+      </button>
+    </nav>
+
+    <div class="side-foot">
+      <div class="status-row">
+        <span id="connection" class="pill"><span class="dot"></span><span id="connectionText">Conectando…</span></span>
+        <span class="pill muted">esqueleto</span>
+      </div>
+      <div class="status-row">
+        <span id="version" class="mono" data-i18n-skip>—</span>
+        <button id="updateBtn" type="button" class="link-btn">checar atualização</button>
+      </div>
+    </div>
+  </aside>
+
+  <main class="main">
+    <header class="topbar" id="overview">
+      <div>
+        <p class="eyebrow">Acauã</p>
+        <h1>Caça a ameaças em rede</h1>
+        <p class="sub">Pesquisa determinística, sem IA opaca</p>
+      </div>
+      <button id="settingsBtn" type="button" class="icon-btn" aria-label="Configurações" title="Configurações">⚙</button>
+    </header>
+
+    <section class="notice notice-warn">
+      <strong>Aviso de escopo.</strong>
+      <span>Este é um esqueleto pré-implementação. Os quatro pilares matemáticos, o parser Zeek e o armazenamento DuckDB ainda não estão implementados.</span>
+    </section>
+
+    <section class="notice">
+      <strong>Uso autorizado.</strong>
+      <span>Use somente em redes próprias ou com autorização explícita. Nenhum pacote é enviado para fora.</span>
+    </section>
+
+    <section class="pillars" aria-label="Pilares de detecção">
+      <article class="card">
+        <span class="card-kicker">Pilar 1</span>
+        <h2>Beaconing</h2>
+        <p>Periodograma de Rayleigh/Schuster. Em desenvolvimento.</p>
+        <span class="tag">em desenvolvimento</span>
+      </article>
+      <article class="card">
+        <span class="card-kicker">Pilar 2</span>
+        <h2>Sessões persistentes</h2>
+        <p>Detector de conexões longas. Em desenvolvimento.</p>
+        <span class="tag">em desenvolvimento</span>
+      </article>
+      <article class="card">
+        <span class="card-kicker">Pilar 3</span>
+        <h2>Anomalias de protocolo</h2>
+        <p>Features determinísticas por protocolo. Em desenvolvimento.</p>
+        <span class="tag">em desenvolvimento</span>
+      </article>
+      <article class="card">
+        <span class="card-kicker">Pilar 4</span>
+        <h2>Fusão de evidências</h2>
+        <p>Jensen-Shannon e prova por alerta. Em desenvolvimento.</p>
+        <span class="tag">em desenvolvimento</span>
+      </article>
+    </section>
+
+    <section class="panel" id="analysis">
+      <div class="panel-head">
+        <div>
+          <h2>Analisar dataset</h2>
+          <p class="hint">Aponte para um diretório de logs Zeek ou para um dataset local.</p>
+        </div>
+        <button id="refreshBtn" type="button" class="btn">Atualizar status</button>
+      </div>
+      <div class="field-row">
+        <label class="field">
+          <span>Diretório de logs</span>
+          <input id="datasetPath" type="text" placeholder="/var/log/zeek/current" autocomplete="off" spellcheck="false">
+        </label>
+        <button id="analyzeBtn" type="button" class="btn primary">Analisar</button>
+      </div>
+      <pre id="output" class="output">Nenhuma análise executada.</pre>
+    </section>
+
+    <section class="panel" id="alerts">
+      <div class="panel-head">
+        <div>
+          <h2>Alertas recentes</h2>
+          <p class="hint">Cada alerta futuro carregará a evidência determinística que o sustenta.</p>
+        </div>
+      </div>
+      <ul id="alertList" class="alert-list">
+        <li class="empty">Nenhum alerta ainda. O motor de detecção será ligado nas próximas specs.</li>
+      </ul>
+    </section>
+
+    <footer class="foot">
+      <span>Acauã · esqueleto pré-implementação</span>
+      <span class="mono">MIT OR Apache-2.0</span>
+    </footer>
+  </main>
+</div>
+
+<dialog id="settingsDlg" aria-labelledby="settingsTitle">
+  <form method="dialog">
+    <div class="dialog-head">
+      <h2 id="settingsTitle">Configurações</h2>
+      <button type="button" id="closeSettings" class="icon-btn" aria-label="Fechar configurações" title="Fechar">×</button>
+    </div>
+    <label class="field">
+      <span>Idioma</span>
+      <select id="langSel">
+        <option value="auto">Auto</option>
+        <option value="pt">Português</option>
+        <option value="en">English</option>
+      </select>
+    </label>
+    <div class="field">
+      <span>Tema</span>
+      <div class="segmented" id="themePick">
+        <button type="button" data-theme-pick="auto">Auto</button>
+        <button type="button" data-theme-pick="light">Claro</button>
+        <button type="button" data-theme-pick="dark">Escuro</button>
+      </div>
+    </div>
+    <menu>
+      <button type="button" id="doneSettings" class="btn primary">Fechar</button>
+    </menu>
+  </form>
+</dialog>
+
+<script type="module" src="/app.js"></script>
+</body>
+</html>

apps/gui/ui/vendor/README.md

@@ -0,0 +1,8 @@
+# Vendor
+
+Third-party browser assets live here and are copied into the application at
+build time. Do not add a frontend framework or a package manager dependency for
+the interface: the UI stays vanilla HTML, CSS and JavaScript, like Guará and
+Sabiá.
+
+Document every vendored file with its project URL, version and license.