acaua/CHANGELOG.md

Changelog

English · Português

Format based on Keep a Changelog; versions follow SemVer.

[Unreleased]

Added

• Pillar 1 (v1.2): Rayleigh/Schuster periodogram with grid bounded by the observed span (T \le \text{span}/3), regularity gating, and infrastructure exclusions (NTP, mDNS/LLMNR/NBNS, SSDP, non-TCP/UDP).
• Pillar 2 (v1.0): Persistent TCP session detector with inactivity chaining (gaps $\le 3600$s without SYN), logarithmic duration scoring, and PCR / failed attempt metrics in evidence.
• Pillar 3 (v1.0): DNS subdomain information capacity detector (I = H \times C bits/h) to identify high-entropy tunnels, with Jensen-Shannon Divergence (JSD) recorded in evidence.
• Pillar 4 (v1.0): Per-host weighted noisy-OR fusion (w_1=w_2=w_3=0.75) with deterministic evidence linkage, ranking hosts in acaua analyze human output via the hosts: section.
• Zeek dns.log ingestion: Daily Hive Parquet partitioning for DNS queries with deterministic column mapping by TSV header.
• Parquet storage schema (v1.2): 15-column schema for conn.log supporting conn_state, history, orig_pkts, resp_pkts, orig_ip_bytes, resp_ip_bytes.
• In-memory alert reporting: Web daemon /api/alerts route now serves alerts from the most recent analysis run.
• Real dashboard UI: Sidebar navigation now switches panels instead of a no-op scroll. New Hosts panel ranks observed hosts by fusion score with per-pillar (P1/P2/P3) drill-down. Alerts panel is filterable/sortable by pillar and score, with full evidence rendered as a formatted table. Overview panel adds KPI tiles and two interactive SVG charts (top hosts by fusion score, alert distribution by pillar).

Changed

• Breaking (0.x): Pillar 1 formula v1.2 modifies scores and changes Alert.id generation to reflect the corrected bounded grid and session-based aggregation.
• Distribution pivoted to 100% Docker and docker-compose (server daemon and web dashboard); native binary tarballs and desktop installers are discontinued.
• DuckDB is now a mandatory runtime dependency, dynamically linked against the official prebuilt libduckdb.so (v1.5.6) with fixed SHA-256 via scripts/fetch-libduckdb.sh.
• Upgraded workspace MSRV to Rust 1.88 (required by duckdb ~1.10506.1).
• Upgraded container runtime and base image to Debian 13 trixie.

Fixed

• Fixed critical false positives in short captures where period candidates exceeded the observed span.
• Corrected partition counting in ingest_dir to take the union of partition dates instead of summing file counts.
• DuckDB execution errors are now tracked in files_failed instead of miscounted as bad rows.
• Updated doctor check status from "skeleton" to "ok" / "degraded".
• Graceful shutdown on SIGTERM when running as PID 1 in container environments.

Removed

• Tauri desktop application (apps/gui/src-tauri) and associated desktop build scripts.
• Self-update flag (acaua update --apply) and in-place binary overwrite. Updates are now handled via image pulls (docker compose pull).

[0.1.0] - 2026-10-31

Added

• Rust workspace with acaua-core and acaua-cli.
• CLI skeleton with serve, analyze, doctor and update [--apply].
• Axum API skeleton with health, status, alerts, analyze and update-check routes.
• Embedded vanilla UI and Tauri desktop shell.
• Deterministic pillar, fusion, storage, Zeek and updater stubs with smoke tests.
• English/Portuguese documentation, CI/release workflows and local check script.

Notes

• The four mathematical pillars are not implemented.
• The Zeek parser and DuckDB storage are stubs.
• No release artifact has been published.