# Roadmap

**English** · [Português](ROADMAP.pt-BR.md)

This roadmap separates what exists from what is planned. The four pillars are
**under development**; they represent the core analytical work.

## Done

- Rust workspace with `acaua-core` and `acaua-cli`.
- CLI commands, Axum API and embedded web dashboard.
- 100% Docker containerization, compose deployment, non-root hardened profile.
- Prebuilt DuckDB linking and Parquet storage foundations.
- Stubs for the four pillars, evidence fusion, and Zeek ingestion.
- English/Portuguese documentation, CI/release workflows and `scripts/check.sh`.
- Deterministic smoke tests and bilingual UI coverage checks.

## Next

1. **Pillar 1 — beaconing.** Implement the Rayleigh/Schuster periodogram on
   event timestamps, add harmonic resistance, and verify with deterministic fixtures.
2. **Pillar 2 — persistent sessions.** Detect long connections that never
   produce a short interval, with explicit thresholds and no overlap with
   pillar 1.
3. **Real Zeek parser.** Read `conn.log`, `dns.log`, `ssl.log` and protocol logs
   with bounded memory, path confinement and deterministic ordering.
4. **Evidence record.** Emit a JSON record per alert with inputs, intermediate
   values, code version and dataset hash.

## Later

- Pillar 3 — deterministic protocol anomalies, including identity and
  lateral-movement features.
- Pillar 4 — bounded, symmetric fusion with reproducible weights.
- Analytical store optimizations, daily Parquet partitioning and TTL pruning.
- Scheduled ingestion and automated log rotation handling in daemon mode.
- NetFlow/IPFIX as a documented degraded mode and Suricata EVE JSON as an
  optional secondary input.
- Signed release metadata, SBOM and reproducible builds.

## Non-goals

- Opaque AI scoring that cannot explain an alert.
- A required cloud service or telemetry pipeline.
- Python in the shipped runtime.
- Treating flow records as equivalent to full Zeek protocol logs.
- Native desktop shell or binary self-mutation.