Lucas RayanandClaude Sonnet 5
8a80504c45
Acaua is a collective SOC daemon consuming only Zeek log files, not a single-user tool needing local hardware like its siblings. Drop the Tauri desktop shell, installers and self-update entirely; the server and its web dashboard ship as a container, updated by pulling a new image tag. Link against the official prebuilt libduckdb instead of compiling it from source via the bundled feature, cutting image build time from 15+ minutes to about 3. Fix a real bug found along the way: as PID 1 in a container, the daemon ignored SIGTERM and was always killed after the stop timeout; it now shuts down gracefully. Also corrects the Pillar 1 beaconing score: the period estimate had a harmonic alias (a perfectly periodic 4h series resolved to 600s), and the old score formula flagged pure random traffic as suspicious (p95 = 0.839 on Poisson noise). The new formula was validated against 300 samples per scenario. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD
2.7 KiB
Contributing to Acauã
English · Português
Thanks for helping. The project is an NDR engine built around deterministic evidence. The most useful contributions right now are tests, fixtures, documentation and small, well-scoped design corrections.
- Authorized monitoring only. Acauã is defensive software for networks you own or are explicitly authorized to observe. Do not add collection paths that hide scope, retention or evidence.
- Evidence is part of the feature. A detection change must state its inputs, fixed-order reductions and intermediate values. A score without a reproducible evidence record is not accepted.
- Be honest about what works. If a feature is a stub, Linux-only or limited to one Zeek log, say so in the README, the CLI help and the test.
- 100% English codebase. Source code, comments, scripts, workflows and
commit messages are English. The web dashboard remains bilingual (PT-BR and EN
through
i18n-en.js).
Workflow
scripts/install-hooks.sh
scripts/fetch-libduckdb.sh ~/.cache/acaua/duckdb
export DUCKDB_LIB_DIR=~/.cache/acaua/duckdb LD_LIBRARY_PATH=~/.cache/acaua/duckdb
scripts/check.sh
scripts/check.sh --full
check.sh runs formatting, clippy with warnings as errors, UI translation
coverage, shell syntax, workflow YAML, SemVer consistency, DuckDB version pin
verification and forbidden terms inspection. --full adds workspace tests and cargo audit.
Research
research/ is an isolated Python workspace for scientific validation. It may
use astropy, scipy, networkx, pandas and notebooks. It must never be imported by
the Rust runtime, copied into a release or required to build the product.
Interface and translation
The interface source text is Portuguese. English comes from
apps/gui/ui/i18n-en.js, applied at runtime by i18n.js. When adding visible
text, run node scripts/check-ui-i18n.mjs and include the English pair.
Documentation
Keep the pair: every *.md and docs/* file has an English version and a
Portuguese version (*.pt-BR.md, docs/pt-BR/). File names are translated only
when the word actually changes, as in architecture.md → arquitetura.md.
Commits and releases
Commits follow Conventional Commits 1.0.0 in English (feat:, fix:, chore:,
ci:, docs:, refactor:, test:, perf:, build:). Versions follow SemVer
2.0.0.
Releases are published as multi-arch container images (linux/amd64 and linux/arm64)
to the Gitea registry. Pushing a v* tag creates a Gitea Release from the matching
CHANGELOG.md section and tags the existing container image.
License
By contributing, you agree to license under MIT or Apache-2.0, like the rest of the project.