# Roadmap

**English** · [Português](ROADMAP.pt-BR.md)

This roadmap separates what exists from what is planned. The four pillars are
**not implemented** in `0.1.0`; they are the next body of work.

## Done

- Rust workspace with `acaua-core` and `acaua-cli`.
- CLI skeleton, Axum API skeleton and embedded vanilla UI.
- Tauri desktop shell with language and theme settings.
- Stubs for the four pillars, evidence fusion, storage, Zeek ingestion and the
  Gitea-based updater.
- English/Portuguese documentation, CI/release workflows and `scripts/check.sh`.
- Deterministic smoke tests and a bilingual UI check.

## Next

1. **Pillar 1 — beaconing.** Implement the Rayleigh/Schuster periodogram on
   event timestamps, add generalized Lomb–Scargle only when a real `y` exists,
   and ship golden fixtures with fixed expected values.
2. **Pillar 2 — persistent sessions.** Detect long connections that never
   produce a short interval, with explicit thresholds and no overlap with
   pillar 1.
3. **Real Zeek parser.** Read `conn.log`, `dns.log`, `ssl.log` and protocol logs
   with bounded memory, path confinement and deterministic ordering.
4. **Evidence record.** Emit a JSON record per alert with inputs, intermediate
   values, code version and dataset hash.

## Later

- Pillar 3 — deterministic protocol anomalies, including identity and
  lateral-movement features.
- Pillar 4 — bounded, symmetric fusion with reproducible weights.
- DuckDB/Parquet storage behind the optional `duckdb` feature, with a seven-day
  TTL and an export command.
- Desktop dataset view, alert detail with evidence, and scheduled `serve` runs.
- NetFlow/IPFIX as a documented degraded mode and Suricata EVE JSON as an
  optional secondary input.
- Signed release metadata, SBOM and reproducible builds.

## Non-goals

- Opaque AI scoring that cannot explain an alert.
- A required cloud service or telemetry pipeline.
- Python in the shipped runtime.
- Treating flow records as equivalent to full Zeek protocol logs.
- Automatic desktop self-update.

## Versioning

The project follows SemVer 2.0.0. `0.x` means the API and detection output may
change between minor versions. A `1.0.0` release will require stable evidence
format, documented thresholds and a migration path for stored data.