# AiSOC Roadmap

> **📌 Active planning has moved (2026-05-12)**
>
> This file is the **historical record** of major-version deliverables (v4 →
> v8 planned). Day-to-day planning, prioritization, and contributor-facing
> issue intake now live in the community-feedback-driven **Now / Next /
> Later** docs:
>
> - [`docs/community-feedback/2026-05-12/AiSOC_ROADMAP.md`](docs/community-feedback/2026-05-12/AiSOC_ROADMAP.md) — strategic narrative
> - [`docs/community-feedback/2026-05-12/AiSOC_Community_Feedback_Synthesis.md`](docs/community-feedback/2026-05-12/AiSOC_Community_Feedback_Synthesis.md) — themes (`F001`–`Fxxx`)
> - [`docs/community-feedback/2026-05-12/AiSOC_Proposed_Issues.md`](docs/community-feedback/2026-05-12/AiSOC_Proposed_Issues.md) — 23 implementation tickets
>
> Items in v7.1+ sections below that overlap with the new docs are flagged
> inline with `→ Now/Next/Later: [ID]`. Where the new docs supersede a
> deferred item entirely, the entry here is left intact for traceability
> but reasoned about against the newer plan.

This document captures the planned direction for AiSOC across major versions. All v4 deliverables and items deferred beyond v4 are listed here.

## World-Class Hardening Program (2026-07, in flight)

A proof-first, security-first program to make every README claim gate-backed, close four existential agent-security holes, and build the ingest-time-graph + multi-model-router moat. Executed one phase per PR with a mandatory CI gate each. Committed status is the checklist below (the six lettered deferrals — 3.5+, 5b, 7b+, 9b, 10b, 11b — are scoped in [`docs/audit/DEFERRED_SUBPHASES.md`](docs/audit/DEFERRED_SUBPHASES.md). They were previously said to be "tracked in `docs/audit/PROGRESS.md`", which is gitignored and was never committed, so six named commitments had no scope anywhere a contributor could read). Baseline audit: [`docs/audit/REALITY_REPORT.md`](docs/audit/REALITY_REPORT.md) and [`docs/audit/CLAIM_TO_GATE_MATRIX.md`](docs/audit/CLAIM_TO_GATE_MATRIX.md).

- [x] Phase 0 — Reality audit (claim-to-gate matrix, ranked overclaims/untested-paths/circular-gates)
- [x] Phase 1 — Four existential holes (prompt injection, memory poisoning, cross-store tenant isolation, data-exfiltration/redaction, cost DoS, vault)
- [x] Phase 2 — Supply chain + truth (security.yml scanners, claim-gate ratchet, hard-fail insecure prod defaults, TRADEMARK, verifying-releases, license fix; continuation landed: per-image cosign signatures + CycloneDX SBOM attestations + SLSA provenance, all actions SHA-pinned)
- [x] Phase 3 — Integration / E2E / chaos / DR (real-container spine test, backup-restore, chaos, upgrade, cross-store isolation live-replay; heavy-demo-stack Playwright E2E + demo-timing gate tracked as non-blocking 3.5+)
- [ ] Phase 4 — Real evals + detection content truth table (third-party-labeled corpus, hallucination/calibration/abstention, model matrix) — **4a/4b/4c landed**: de-circularised DAC candidate-rule gate; honest executable-vs-imported truth table; hallucination, abstention, calibration and containment metrics in `packages/aisoc-benchmark` with a documented adapter so a third-party agent can be graded on the same corpus; confidence calibration gated in `test_confidence_calibration.py`; and a **model matrix** (`scripts/run_model_matrix.py`) wired into the weekly wet eval, which grades the same corpus across several models by re-invoking the existing evaluator rather than defining a second notion of accuracy. **Remains open on one thing only, and it is not code:** the live-agent numbers need a funded provider key. Without one the matrix reports *not measured* per model rather than emitting zeros, because a zero is a measurement and "we did not run this" is not.
- [x] Phase 5 — Data spine correctness (versioned event-schema registry + dead-letter queue + source-event lineage in the fusion consumer; idempotency via AlertSink dedup + event-time watermarking; backfill/replay-from-offset tracked as 5b)
- [x] Phase 6 — Performance + cost (fusion hot-path throughput harness with a generous regression-floor gate; deterministic storage $/TB cost model + drift gate; storage-consolidation ADR-0005)
- [x] Phase 7 — Ingest-time graph + multi-model router — **graph-at-ingest already shipped** (v8 T1.1, `services/ingest/internal/graph/`); **7a landed**: unified deterministic→ML→LLM router with tier attribution + the `AISOC_DETERMINISTIC` determinism contract (`services/agents/app/routing/model_router.py`, gated). 7b+ (posture collection, effective-permissions snapshot loader, bi-temporal valid_from/valid_to, fusion-time ContextBundle) scoped in [`docs/audit/DEFERRED_SUBPHASES.md`](docs/audit/DEFERRED_SUBPHASES.md), which records that all five effective-permissions resolvers already ship and that what remains is one thing: no connector answers `__posture_snapshot__`
- [x] Phase 8 — LLMOps (version+hash-pinned prompt registry with a CI drift gate; model pins + deterministic-terminated provider-fallback chains; content-addressed response cache; fail-closed structured-output validation)
- [x] Phase 9 — Autonomy safety (dry-run-by-default policy, honest bounded rollback-capability contract replacing silent `return True`, mandatory post-action verification for unattended containment, break-glass HIGH-blast flag, autonomy scorecard — all gated at the policy layer; live-router wiring + durable approval-SLA timer table tracked as 9b)
- [x] Phase 10 — Connector + content quality (runtime-contract conformance suite across all 69 connectors registered when the phase landed; the generated [`conformance-matrix.md`](docs/connectors/conformance-matrix.md) now reads 84 / 84 — gates the "live Test connection" capability that had NO gate + secret-field-marking; the matrix is published with a drift gate on it; detection lifecycle already gated by Phase 4a DAC + Phase 4b truth table. Live-vendor sandbox smoke + rate-limit/checkpoint durability tracked as 10b)
- [x] Phase 11 — API / SDK / release engineering (pure-Python OpenAPI breaking-change detector `scripts/openapi_diff.py` + `openapi-breaking.yml` gate: PR spec vs base fails on removed endpoint/schema/field, type change, tightened request, or dropped enum value — closes the OpenAPI NO GATE row; per-language SDK generated-client contract-drift tracked as 11b)
- [x] Phase 12 — Observability + governance (per-service SLOs in `docs/operations/slos.yaml` with a coverage gate; `docs/operations/observability.md` documenting the four golden signals + single OTel trace across the spine; `GOVERNANCE.md` + `MAINTAINERS.md` + DCO sign-off in `CONTRIBUTING.md`; governance-completeness gate — `governance.yml`)

**Program status:** all 13 hardening phases (0–12) are landed. Building on them, the **Fully-Operational AI-SOC roadmap** (Phases A1–E1) is now complete — it wired the three end-to-end paths the reality audit found unwired and pushed the platform to competitive parity + beyond:

- **Phase A (SIEM foundation):** A1 ClickHouse lake writer · A2 live detection-evaluation worker (2538 executable rules on the stream) · A3 default-on one-command deploy (connectors + graph on) · A4 UEBA behavioral-model fusion.
- **Phase A (SIEM foundation):** A1 ClickHouse lake writer · A2 live detection-evaluation worker (2538 executable rules on the stream) · A3 default-on one-command deploy (connectors + graph on) · A4 UEBA behavioral-model fusion.
- **Phase A (SIEM foundation):** A1 ClickHouse lake writer · A2 live detection-evaluation worker (2538 executable rules on the stream) · A3 default-on one-command deploy (connectors + graph on) · A4 UEBA behavioral-model fusion.
- **Phase A (SIEM foundation):** A1 ClickHouse lake writer · A2 live detection-evaluation worker (2538 executable rules on the stream) · A3 default-on one-command deploy (connectors + graph on) · A4 UEBA behavioral-model fusion.
- **Phase B (SOAR foundation):** B1 auto-triage worker (copilot default) · B2 credential resolver + `decide()`-governed live dispatch + 10 vendor adapters · B3 real rollback + post-action verification + durable approval-SLA timers · B4 Business Context Rules in the hot path.
- **Phase C (parity differentiators):** C1 Advanced Data Explorer · C2 Effective-Permissions live posture loader · C3 autopilot/copilot posture scorecard · C4 fuse-time attack-chain auto-grouping.
- **Phase D (breadth):** D1 eight connectors (QRadar/Exabeam/Securonix/Devo/Netskope/Windows-Sysmon/Zeek-Suricata/syslog-CEF) · D2 AI/LLM-usage audit connector + `llm-*` detections + hot/cold lake tiering · D3 live-vendor mock-server smoke.
- **Phase E (prove it):** E1 CI-gated benchmark scoreboard tied to a deterministic live-agent MITRE-accuracy run.

The claim-to-gate matrix stands at **352 rows — 347 GATED / 5 PARTIAL / 0 NO GATE**. Five rows are PARTIAL, each naming what closes it: "Cloud-native collection" until a capture recorded from a live Event Hub replaces the fixture synthesised from the Avro specification; "the retention window a tenant chooses is the one the lake honours" until a live ClickHouse test watches a row survive past the old 90-day boundary; "the AI estate is discovered on the endpoint" until a containerised osquery runs the shipped pack end to end; and "a reported phishing message can be purged across its recipients" until a maintainer-supplied Microsoft 365 or Google Workspace tenant lets the documented request shapes be exercised for real; and "every automatic closure of a production alert is checked against the current policy, grant and stop controls" until the live suite that proves it against real Postgres has been observed to pass on `main` rather than only in the pull request that added it. "SSO completes a sign-in" closed the way the programme requires — by building the gate it named: `sso-live.yml` stands up a containerised Keycloak and both legs have been observed to pass. Every other product claim is backed by a failing test, none is a named deferral either, and the ratchet (`MAX_NO_GATE=0`) forbids any regression. Every PARTIAL row was closed by building the gate it named, never by relabelling. Count the table rows with `python3 scripts/check_claim_gate_matrix.py` rather than trusting a figure quoted in prose — this line has gone stale before. The six lettered deferrals are scoped in [`docs/audit/DEFERRED_SUBPHASES.md`](docs/audit/DEFERRED_SUBPHASES.md).


## v4.0 — Shipped

### AI multi-agent investigator
- [x] Orchestrator (LangGraph state machine) in `services/agents/app/investigator/`
- [x] ReconAgent, ForensicAgent, ResponderAgent (dry-run with analyst approval)
- [x] ReportWriterAgent — streaming markdown + branded PDF
- [x] Investigation & Report tabs in Case Workspace UI
- [x] Eval harness: 20 synthetic incidents, ≥80% MITRE-tactic accuracy CI gate

### Visual SOAR studio
- [x] React Flow playbook editor over nine of the step types the engine
      implements (enrich, investigate, notify, block_ip, isolate_host,
      create_ticket, close_case, http, condition). The engine accepts 22 and
      runs 21; widening the palette to the rest is outstanding. Loop,
      Parallel, Wait and Human Approval were listed here and exist in neither
      the palette nor the engine.
- [x] Sequential playbook engine with conditions, branching, retries and
      cycle detection. Not a DAG: there is no `depends_on` and no parallel
      execution, and there are no idempotency keys.
- [x] Step-level risk grading, by dispatch rather than by a schema field.
      A step naming a response verb is dispatched to the action registry and
      graded against that verb's capability contract — impact, reversibility,
      approval requirement, verification probe — plus the tenant's autonomy
      tier and the finding's confidence. Per step, so authorising a playbook
      does not authorise what its steps contain. The old `blast_radius` step
      field promised this and was declared by a schema the engine could not
      read; it has been removed rather than left as a promise.
- [x] `schemas/playbook.schema.json` (JSON Schema draft-07) for portability
      and CI linting, held to the engine in both directions by
      `scripts/check_playbook_schema_parity.py`
- [x] Detection-as-Code: `detections/` directory with Sigma + AiSOC YAML, GitHub Action deploy-on-merge
- [x] 12 starter playbook templates
- [x] Community playbook marketplace (static index v4.0; publishing flow v4.1)

### Plugin platform, public API, SDKs, docs
- [x] Plugin SDK in Python (`packages/plugin-sdk-py/`) and Go (`packages/plugin-sdk-go/`)
- [x] `plugin.yaml` manifest spec (connector | enricher | responder | detection | widget)
- [x] Plugin loader with OCI image support (`oras pull`) in api/actions/enrichment/connectors
- [x] Public REST API v1 at `/api/v1`, OpenAPI 3.1 at `docs/openapi.yaml`
- [x] GraphQL gateway (Strawberry) proxying REST
- [x] Scoped API tokens (`cases:read`, `playbooks:run`, `plugins:install`)
- [x] Auto-generated client SDKs: `@aisoc/sdk` (TypeScript), `aisoc-sdk` (Python/PyPI), `github.com/beenuar/AiSOC/packages/sdk-go`
- [x] Docusaurus docs site at `docs/site/`, deployed to GitHub Pages
- [x] Demo Lab: `pnpm aisoc:lab` one-command full-stack + Conti-style ransomware scenario
- [x] 4 reference plugins: Okta connector, YARA enricher, Slack quarantine responder, MTTR sparkline widget

### Cross-cutting
- [x] OpenTelemetry traces: agents → actions → api → realtime (Jaeger/Tempo)
- [x] API token scopes (foundation for SSO)
- [x] `docs/upgrade/MIGRATION.md` for v3 → v4 upgrade path

---

## v4.1 — Shipped

- [x] Plugin publishing flow (signed community submissions, Ed25519 verification, review endpoints)
- [x] Plugin marketplace UI v2 (ratings, install counts, verified badges, category filter, sort)
- [x] Detection catalog: browse and install community Sigma rules via UI
- [x] Playbook community submissions and curation
- [x] `aisoc-cli` — developer CLI for scaffold, validate, publish plugins and detections

---

## v5.0 — Shipped

### Identity & Access
- [x] SAML 2.0 + OIDC authentication (Okta, Azure AD, Google Workspace)
- [x] Multi-tenant row-level security (Postgres RLS + SQLAlchemy middleware)
- [x] Granular RBAC with data-class and tenant scopes (`require_permission()` dependency)
- [x] Full analyst audit log (append-only `audit_log` table + middleware + UI)

### Compliance
- [x] Compliance evidence mapping for **24 controls across 5 frameworks** (SOC2, PCI-DSS, HIPAA, ISO27001, NIST-CSF), with PDF export. Not a SOC 2 Type II evidence dashboard: the console pages for it call routes that do not exist. Restored by parity 1.3
- [x] ISO 27001 control mapping
- [x] NIST CSF / NIST 800-53 control coverage heatmap
- [x] PCI-DSS and HIPAA control mappings. **DORA is not mapped** by any code path
- [x] MTTD / MTTR / MTTC SLA tracking per tenant

### High Availability & Operations
- [x] HA Helm chart with PodDisruptionBudgets and HorizontalPodAutoscalers
- [x] Backup / restore CLI (`scripts/backup.sh`, `scripts/restore.sh`)
- [x] Multi-region active-active topology guide (`docs/operations/multi-region.md`)
- [x] Operator runbook generation from OTel traces (`scripts/generate_runbook.py`)

---

## v5.1 — Shipped

### UEBA
- [x] Per-user, per-host, per-service behavioral baselines (Welford's algorithm)
- [x] Anomaly risk scores feeding the fusion engine (z-score composite scoring)
- [x] Peer-group analysis and deviation scoring
- [x] Kafka integration: consumes `security.events`, publishes `ueba.anomalies`

### Deception / Honeytokens
- [x] Token generation (AWS keys, URLs, DNS, file, DB credentials, custom types)
- [x] First-touch alerting via HMAC-SHA256-signed webhooks
- [x] Honeytoken lifecycle management UI (create, revoke, delete, trigger history)

### Purple-Team / Continuous Validation
- [x] Atomic Red Team YAML loader and test sync API
- [x] Caldera adversary emulation REST client integration
- [x] ATT&CK coverage heatmap by tactic/technique with detection tracking
- [x] Tabletop incident simulator with findings management UI

---

## v6.0 — Shipped (2026-05-06)

### Wave 3 — Operational Maturity

- [x] MSSP / parent-tenant console — onboard child tenants, delegate cross-tenant actions, view rollup metrics
- [x] Asset inventory + vuln-to-alert correlation — asset CRUD, vulnerability findings, blast-radius context
- [x] Insider threat module — user risk profiles, behavioural indicators, peer-group deviation scoring
- [x] L0–L4 auto-remediation maturity tiers — per-tenant autonomy gate with audit log and per-action whitelist

### Wave 4 — Advanced Capabilities

- [x] Internal threat intelligence — IOC harvesting, threat actor profiles, STIX/TAXII feed subscriptions
- [x] Cloud security posture management (CSPM/KSPM) — posture findings, drift tracking, suppress/resolve workflows
- [x] Identity-centric correlation graph — identity node/edge graph, alert-to-identity linking, attack-path queries
- [x] Auto-generated board reports — report templates, scheduled PDF/HTML artefacts, email/webhook delivery

### Platform

- [x] Dashboard metrics API — aggregated KPI endpoint powering frontend dashboard tiles
- [x] Tailscale connector — audit log and policy-change events with cursor-based pagination
- [x] AWS GuardDuty credential-exfiltration Sigma detection rule

---

## v6.1 — Shipped (2026-05-07) — v1.5 market-driven feature expansion

A review of G2, Gartner Peer Insights, and customer feedback on AI SOC / SIEM /
SOAR platforms drove this release.

### New autonomous agents (`services/agents/app/agents/`)

- [x] Master autonomous triage agent (`auto_triage_agent.py`) — classifies each
      alert as `true_positive` / `false_positive` / `benign` with confidence
- [x] Phishing triage sub-agent (`phishing_agent.py`)
- [x] Identity reasoning sub-agent (`identity_agent.py`)
- [x] Cloud reasoning sub-agent (`cloud_agent.py`)
- [x] Insider-threat reasoning sub-agent (`insider_threat_agent.py`)
- [x] All five exposed via `POST /api/v1/agents/triage`

### New console pages (`apps/web/src/components/`)

- [x] `/investigate` — redirects to `/hunt`; the multi-turn copilot is `CopilotDock` and `/copilot`
- [x] `/coverage-advisor` — ATT&CK techniques your rules reference, ranked by enabled coverage (not by adversary prevalence)
- [x] `/shifts` — analyst shift-handoff dashboard
- [x] `/easm` — External Attack Surface Management
- [x] `/mssp` — MSSP executive dashboard
- [x] `/noise-tuning` — per-rule false-positive rate and one-click tuning
- [x] `/analytics/team` — analyst leaderboard, MTTR per analyst, dispositions accuracy

### New API surfaces (`services/api/app/api/v1/endpoints/`)

- [x] `shifts.py` — shift-handoff CRUD
- [x] `stix_taxii.py` — STIX 2.1 / TAXII 2.1 publishing
- [x] `compliance.py`, automated compliance evidence for 24 controls across SOC 2, ISO 27001, NIST CSF, PCI-DSS and HIPAA. **DORA is not among them**
- [x] `deployment.py` — deployment / air-gap toggles

### New connectors (16 → 26)

- [x] SentinelOne (`sentinelone.py`)
- [x] Cortex XDR (`cortex_xdr.py`)
- [x] Wiz (`wiz.py`)
- [x] Snyk (`snyk.py`)
- [x] Zscaler (`zscaler.py`)
- [x] Proofpoint (`proofpoint.py`)
- [x] ServiceNow (`servicenow.py`)
- [x] Jira (`jira.py`)
- [x] 1Password (`1password.py`)
- [x] Duo Security (`duo_security.py`)

### Other

- [x] AI-generated incident reports — one-click "Export Report" generates PDF from the Investigation Ledger
- [x] Air-gap deployment configuration — per-tenant toggles disable external feeds

---

## v7.0 — Shipped ✅ (2026-05-10)

All items below were shipped as part of the v1.0 buyer-value plan.
Implemented and reviewed by Beenu Arora <beenu@cyble.com>.

- [x] axe-core CI gate over the landing and chrome components **plus three of the five operator views** parity 4.7 names: the alerts queue and list, the investigation rail, and settings. **Still not a full WCAG AA pass**: the case workspace is not covered, and axe catches a subset of WCAG rather than all of it. Each view asserts it rendered real markup before axe runs, because axe passes on an empty div
- [x] Light theme persisted in user profile (`ThemeProvider.tsx` + `PATCH /api/v1/users/me/preferences`)
- [x] Saved views and custom drag-drop dashboard widgets per analyst (`saved_views.py` + `DashboardView.tsx`)
- [x] AI-generated weekly executive digest — auto-emailed PDF (`digest_pdf.py` + `weekly_digest_task.py`)
- [x] Slack native bot for alert triage without opening the UI (`services/slack-bot/` — 61 tests)
- [x] Threat actor attribution engine v0 (`services/threatintel/app/actors/attribution.py`)
- [x] Air-gap / Ollama local-LLM mode (`infra/compose/docker-compose.airgap.yml` + `apps/docs/docs/operations/air-gapped.md`)
- [x] BYOK per-tenant LLM credentials UI + API (`llm_credentials.py` + `SettingsView.tsx`)
- [x] MSSP console — per-child-tenant KPI aggregation, SLA posture, parent_tenant_id hierarchy
- [x] Team analytics view — analyst MTTR, leaderboard, shift workload (`TeamAnalyticsView.tsx`)
- [x] Case auto-summary + PDF export (`case_summary.py` + `case_summary_html.py`)
- [x] Investigation timeline (replayable) (`InvestigationTimeline.tsx`)
- [x] Playbook gallery with 12 curated packs + GitHub PR integration for detection proposals
- [x] Mobile responder console — decide an approval from a phone
      _(shipped in v9.0. The "not started" note this line used to carry was
      true about React Native and misleading about the product: the responder
      console already existed as a **PWA** — nine routes under
      `apps/web/src/app/(responder)/`, a service worker, an IndexedDB offline
      approval queue, Web Push with VAPID, and passkeys. `apps/mobile` is a
      distribution channel on top of that, and it exists for one reason worth
      the build: iOS Web Push requires an installed PWA and has been
      unreliable even then, which for "approve a containment from your phone"
      is the same as the feature not existing. Its `src/lib` unit tests and
      type-check run in CI; **no device build, simulator run or store
      submission has been performed**, and APNs/FCM credentials are an
      account action rather than an engineering one — see
      `apps/mobile/README.md`.)_
- [ ] Plugin publishing marketplace v3 (commercial plugins, revenue sharing)
      _(**open and unscheduled**, and never in fact scheduled against a
      particular release. The "deferred past v8.0" this line used to carry
      dated the label rather than the decision, and survived five majors.
      Revenue sharing is a commercial decision rather than an engineering one,
      and the free packaging path is itself still blocked on registry
      credentials — see v8.1.)_

---

## v7.0.x — Endpoint telemetry wave + hardening (2026-05-10)

Six-PR feature wave that closes [#44](https://github.com/beenuar/AiSOC/issues/44)
("osctrl connector for fleet-wide osquery telemetry") and significantly extends
osquery coverage end to end. All six PRs were implemented sequentially as part of
the v7.0 release window and then patched through 7.0.1 → 7.0.3.

### Endpoint telemetry — osquery feature wave (PR1–PR6)

- [x] **PR1 — osctrl + FleetDM connectors** (`services/connectors/app/connectors/osctrl.py`,
      `fleetdm.py`). Schema-driven setup, live `Test connection` round-trip, secrets
      encrypted via `CredentialVault`, polling on per-instance schedule, plus marketplace
      manifests at `plugins/osctrl/plugin.yaml` and `plugins/fleetdm/plugin.yaml`.
- [x] **PR2 — Native osquery detection schema migration** — 16 osquery rules
      (`detections/endpoint/osquery-*.yaml`, IDs `det-endpoint-281..296`) migrated from
      `_quarantine/` to the native schema, with positive/negative test fixtures
      (`detections/fixtures/osquery_*.json`) gated by the Detection Validation workflow.
- [x] **PR3 — Live-query playbook step** (`services/actions/app/clients/osctrl_client.py`,
      `fleetdm_client.py`, `osquery_allowlist.py`, `services/agents/app/playbook/steps/osquery_live_query.py`).
      Allowlisted distributed queries pushed to single hosts or fleet-wide via
      osctrl/FleetDM with HMAC-signed ChatOps approval.
- [x] **PR4 — `aisoc-osquery-tls` FastAPI service + `aisoc-direct` agent connector**
      (`services/osquery-tls/`, `services/connectors/app/connectors/aisoc_direct.py`).
      First-party self-hosted osquery TLS plugin, FleetDM-compatible config/log endpoints,
      direct-from-agent ingest path that bypasses third-party SaaS.
- [x] **PR5 — Osquery packs + FIM endpoint + FIM dashboard**
      (`services/osquery-tls/app/api/v1/endpoints/fim.py`, `apps/web/src/components/dashboard/FimDashboard.tsx`).
      Bundled IR / OSquery-ATT&CK / FIM packs; ingests `file_events` and synthesises
      alerts on writes to `/etc/passwd`, `/etc/shadow`, sshd configs, sudoers, Windows
      registry hives. FIM-specific detection IDs `det-endpoint-297..300`.
- [x] **PR6 — AiSOC osquery extensions** (`services/osquery-extensions/tables/*.go`).
      5 custom Go-based virtual tables: `aisoc_browser_extensions`, `aisoc_kernel_modules`,
      `aisoc_attck_persistence`, `aisoc_pending_actions`, `aisoc_alert_cache` — ship
      richer endpoint visibility plus a bidirectional response channel.

### Patch releases

#### v7.0.1 — Web app hardening (CodeQL + Turbopack)

- [x] **42 CodeQL code-scanning alerts cleared** (`py/unused-global-variable`,
      `py/cyclic-import`, `py/empty-except`, `py/log-injection`,
      `py/clear-text-logging-sensitive-data`, `py/incomplete-url-substring-sanitization`,
      `py/stack-trace-exposure`, `py/call/wrong-arguments`, `py/unused-import`,
      `js/unused-local-variable`).
- [x] **`apps/web/next.config.js`** — Removed deprecated `eslint.ignoreDuringBuilds`
      key Next.js 16 no longer accepts; added `turbopack.root` for workspace package
      resolution.
- [x] **`apps/web/src/app/layout.tsx`** — Added `suppressHydrationWarning` to `<html>`
      so the render-blocking `themeBootstrapScript` can write `data-theme` /
      `data-theme-preference` / `style.colorScheme` without React reporting an
      attribute mismatch.

#### v7.0.2 — Version alignment + landing-page footer + docs

- [x] **`apps/web/package.json`** bumped to `7.0.2`; sidebar shows `v7.0.2` dynamically.
- [x] **`apps/web/src/components/landing/Footer.tsx`** — Replaced hard-coded `v6.1.0`
      with a dynamic import of `package.json`.
- [x] **`README.md`** — Added `osquery-tls` (port 8090) and `osquery-extensions` to the
      services / Swagger / directory-tree / dev-surface tables.

#### v7.0.3 — Structural hydration fix + font preload

- [x] **`apps/web/src/components/layout/AppShell.tsx`** — Wrapped `<DemoBanner />` in
      a new `<ClientOnly>` boundary so the banner (which reads
      `NEXT_PUBLIC_DEMO_MODE`) is never server-rendered. Eliminates React
      hydration error #418 caused by stale env-var inlining producing a structural
      tree mismatch (server saw `<button>` from `Sidebar`, client expected `<div>`
      from `DemoBanner`).
- [x] **`apps/web/src/app/layout.tsx`** — Added `preload: false` to the
      `JetBrains_Mono` `next/font/google` config; eliminates "preloaded but not
      used within a few seconds" Chrome warnings without any visible FOUT.

---

## v7.1.0 — Shipped ✅ (2026-05-10) — Cloud Security Coverage Wave

Six new connectors, three documentation backfills, and a new ingest template
closing the biggest cloud-security gap in the connector catalogue. Every Tier-1
cloud workload protection platform now has a first-class AiSOC integration,
AWS gets three native data sources, and Kubernetes audit logs land via a
dual-mode connector that works on both managed and air-gapped clusters.

### Track A — Documentation backfill for existing cloud connectors

- [x] **`apps/docs/docs/connectors/wiz.md`** — Service-account creation,
      `read:issues` + `read:vulnerabilities` scopes, token rotation, normalised
      severity map, worked Wiz `Issue` → inbox event example.
- [x] **`apps/docs/docs/connectors/aws-security-hub.md`** — IAM-role vs.
      static-key auth, `securityhub:GetFindings` permission, and the
      `BLOCK_IP`/`ALLOW_IP` capability documented end-to-end against
      `services/actions/app/clients/aws_security_groups.py`.
- [x] **`apps/docs/docs/connectors/lacework.md`** — API-token flow, `api_url`
      regional variants, alert → event severity collapse.
- [x] **`apps/docs/sidebars.ts`** — All three backfilled pages + the four new
      Track B–D pages registered under the `Connectors` category.

### Track B — New CNAPP connectors

- [x] **`PrismaCloudConnector`** (`services/connectors/app/connectors/prisma_cloud.py`)
      — Full CSPM/CWPP coverage. JWT auth via `POST /login`, paginated
      `GET /alert/v1/alert` with windowed `time.from`/`time.to`, severity collapse,
      `compute_url` override for self-hosted Compute Edition.
- [x] **`OrcaConnector`** (`services/connectors/app/connectors/orca.py`) —
      `https://api.orcasecurity.io/api/alerts` with `api_token` auth, severity
      collapse with Orca-specific `hazardous → high` rule.
- [x] Manifests at `plugins/prisma-cloud/plugin.yaml` and `plugins/orca/plugin.yaml`,
      docs at `apps/docs/docs/connectors/{prisma-cloud,orca}.md`, full test
      suites under `services/connectors/tests/test_{prisma_cloud,orca}.py`.

### Track C — Native AWS connectors

- [x] **`AWSGuardDutyConnector`** (`services/connectors/app/connectors/aws_guardduty.py`)
      — boto3-based, supports IAM-role + static-key auth via `_resolve_session`,
      iterates detectors with `list_findings` + `get_findings`. Collapses
      GuardDuty's continuous numeric severity scale (`0.1`–`10.0`) into AiSOC's
      four-tier `info|low|medium|high` ladder.
- [x] **`AWSCloudTrailConnector`** (`services/connectors/app/connectors/aws_cloudtrail.py`)
      — `cloudtrail.lookup_events` with a curated 21-event allow-list covering
      identity abuse, persistence, data-plane abuse, network exposure, and trail
      tampering. Allow-list overridable via the `event_names` field.
- [x] **`AWSVPCFlowLogsConnector`** (`services/connectors/app/connectors/aws_vpc_flow.py`)
      — `cloudwatch_logs.filter_log_events`, v2 + v5 format parsing,
      RFC-5735-aware public-IP heuristic, default `?REJECT` filter pattern,
      severity heuristic (`public REJECT → medium`, `internal REJECT → low`,
      `ACCEPT → info`).
- [x] Manifests + docs + tests for all three connectors. 27 unit tests for
      `AWSVPCFlowLogsConnector` covering v2/v5 parsing and public-IP edge cases.

### Track D — Kubernetes audit logs (dual-mode)

- [x] **`KubernetesAuditConnector`** (`services/connectors/app/connectors/kubernetes_audit.py`)
      ships with two delivery modes selected via the `mode` config field:
      - **`webhook` (recommended)** — apiserver pushes audit events to AiSOC's
        new dedicated `POST /v1/ingest/k8s-audit/{tenant_id}` route,
        authenticated with a shared secret in the `X-AiSOC-K8s-Token` header
        (constant-time compared so a partial-prefix attacker can't shave
        bytes off via timing). Legacy `/v1/inbox/{token}` path with the
        `k8s-audit` template is kept as a fallback for control planes that
        cannot inject custom headers into the audit-webhook kubeconfig.
      - **`file_tail`** — AiSOC's connector pod tails a local `audit.log` using
        a byte-position cursor (atomically written via `os.replace` to a
        `.aisoc-cursor` sidecar) with rotation/truncation detection and a hard
        per-poll byte cap so a backlog can't blow up a single poll cycle.
- [x] **`services/ingest/internal/handler/k8s_audit.go`** — Dedicated Go
      handler for the webhook route. Caps body size via
      `K8S_AUDIT_MAX_BODY_BYTES` (default 16 MiB), rejects oversized batches
      with `413` so the apiserver shrinks `--audit-webhook-batch-max-size`
      and retries, and publishes each `EventList.items[]` entry through the
      existing normalizer + Kafka publisher using
      `connector_type: kubernetes_audit`. The route is disabled (returns
      `503`) until an operator sets `K8S_AUDIT_SHARED_SECRET`, so a fresh
      install never accidentally accepts unauthenticated audit traffic.
- [x] **`kubernetes_audit` normalizer profile**
      (`services/ingest/internal/normalizer/normalizer.go`) — Maps `auditID`
      to `external_id`, `verb` to `activity_name`, `user.username` to
      `actor.user.name`, `objectRef.{namespace,resource,name}` to a
      composite `target.resource.name`, and translates the connector's
      string severity (`critical|high|medium|low|info`) into OCSF integer
      severities (5/4/3/2/1).
- [x] **`k8s-audit` inbox template**
      (`services/ingest/internal/normalizer/templates/k8s-audit.yaml`) —
      maps apiserver `Event` payloads onto AiSOC's normalised event shape
      for the legacy inbox-token path; severity is derived in the
      connector's `_classify_severity` heuristic so the same logic applies
      to both delivery modes.
- [x] **Severity heuristic** — `exec`/`attach`/`portforward` on Pod and
      `create` on `ClusterRoleBinding` → `high`; writes to `Secret`/`ConfigMap`/
      `ClusterRole`/`Role` → `medium`; successful reads on sensitive resources
      → `low`; everything else → `info`.
- [x] **`plugins/kubernetes-audit/plugin.yaml`** — 4-field config schema
      (`mode`, `cluster_name`, `inbox_token`, `audit_log_path`, `cursor_path`),
      `category: cloud`, capabilities `pull_audit` + `pull_alerts`.
- [x] **`apps/docs/docs/connectors/kubernetes-audit.md`** — Sample `AuditPolicy`
      + sample `AuditSink` for both managed and self-hosted clusters.

### Cross-cutting

- [x] **`pnpm marketplace:sync`** — `marketplace/index.json` +
      `apps/web/public/marketplace/index.json` rebuilt; plugin count rose
      `43 → 49`. Total: `total=7104 detections=6993 playbooks=62 plugins=49
      mitre_techniques=493`.
- [x] **`apps/web/package.json`** bumped to `7.1.0`; sidebar and landing-page
      footer surface the new version dynamically.

---

## v7.2.0 — Shipped ✅ (2026-05-13) — Stage-2 Connector + Surface Wave (`feat/wazuh-connector`)

Eight-commit feature wave broadening connector reach (Wazuh + auditd), making
the response-action layer vendor-pluggable, replacing the NL→query template
fallback with a deterministic translator, closing the threat-intel write loop
to MISP, adding a blameless case post-mortem surface, and standing up a GCP
Terraform skeleton equivalent to the existing AWS module.

### Connectors

- [x] **`WazuhConnector`** (`services/connectors/app/connectors/wazuh.py`)
      — polls the Wazuh Indexer `wazuh-alerts-*` indices over HTTPX with
      basic-auth, paginates time-windowed queries, retries on 5xx with
      capped backoff, and normalises severity into the four-tier ladder.
      Marketplace manifest + per-connector docs + 24 unit tests.
- [x] **`AuditdConnector`** (`services/connectors/app/connectors/auditd.py`)
      — file-tail of `/var/log/audit/audit.log` with multi-record
      reassembly by msg id, hex `proctitle`/`argv` decode, and
      `(inode, byte_offset)` cursor for log rotation. Ships with
      `profiles/auditd/aisoc.rules` opinionated auditctl ruleset whose
      `-k` keys map 1:1 to detection rules; 4 new detection rules pivot
      off `auditd_key` for sudoers / SSH / kernel-module / systemd
      tampering. 444-test full connectors suite green (excluding
      `test_scheduler.py` which needs the `apscheduler` dev dep).
- [x] Connector registry now declares **91 first-party connectors**;
      `pnpm marketplace:sync` rebuilt `marketplace/index.json` +
      `apps/web/public/marketplace/index.json`.

### CLI

- [x] **`aisoc plugin new <NAME> --type {enricher|connector|responder|detection|widget}`**
      replaces the old hard-coded `plugin scaffold` with per-type templates
      shipped inside the `aisoc-cli` wheel via `importlib.resources`.
      `string.Template` substitution for `${slug}`, `${name}`, `${author}`;
      tests parameterised across all five plugin types asserting manifest
      validation and zero placeholder leakage. `aisoc plugin scaffold`
      retained as alias.

### Live Actions

- [x] **Generic `(vendor_id, capability)` dispatcher**
      (`services/actions/app/live_actions/`) — pluggable
      `LiveActionExecutor` ABC + module-level registry + dispatcher with
      structured logging and error translation. Unknown pairs return
      `LiveActionResult(status=FAILED, error="executor_not_found")` so the
      agent degrades gracefully. Adapters wrap CrowdStrike, Okta,
      AWS SG, Splunk so they show up as `builtin` descriptors.
- [x] **`/api/v1/live-actions`** — `discover`, `dispatch`, `dry-run`. Honours
      `dry_run` + missing-credentials → `SIMULATED`, never `PARTIAL`.
- [x] 45 new tests across models / registry / dispatcher / router / builtins
      (full actions suite: 99 passed).
- [x] **`apps/docs/docs/concepts/live-actions.md`** + sidebar entry.

### Agents

- [x] **Deterministic NL→ES|QL translator**
      (`services/agents/app/nl_query/`) — IR + grammar validator + renderers
      for ES|QL / KQL / SPL. Replaces every `# TODO: translate` comment in
      `services/api/app/api/v1/endpoints/nl_query.py`. Optional
      `enhance_with_llm` (`gpt-4o-mini`) path with deterministic fallback
      so the air-gapped story keeps working.
- [x] **50-pair NL→ES|QL eval set**
      (`services/agents/tests/eval_data/nl_query_eval.json`) +
      `test_nl_query_eval.py` harness — 100% syntactic validity, 100%
      semantic match (50/50 perfect) against gold intents.

### API surfaces

- [x] **Blameless case post-mortem** —
      `GET /api/v1/cases/{case_id}/postmortem?format=json|html`. Pure
      builder + async DB orchestrator
      (`services/api/app/services/case_postmortem.py`) reusing the
      `case_summary` fetchers; HTML renderer with inline CSS, defensive
      escaping, no external assets. Tests assert XSS escaping,
      deterministic ordering, and explicit blamelessness (analyst handles
      must not surface in the narrative; assignee header line is
      explicitly allow-listed).
- [x] **STIX → MISP push** (Stage 3 #20) — closes the threat-intel write
      loop. `POST /stix/indicators` and `POST /stix/bundles` accept
      `?push_to_misp=true` and return a structured `misp` block on the same
      response. `GET /stix/misp/health` and `POST /stix/misp/dry-run`
      added for operator verification + air-gap audits. Pure mappers
      cover `ipv4`/`ipv6`, `domain-name`, `url`, `email-addr`,
      `file:hashes` (MD5/SHA-1/SHA-256/SHA-512) and `file:name`. Push
      failures are non-fatal: AiSOC store remains source of truth, MISP is
      best-effort. Reuses the existing `enforce_airgap_for_url` chokepoint.
      76 new tests.

### Infrastructure

- [x] **`infra/terraform/gcp/`** — Cloud Run for `api`/`web`/`ingest`,
      Cloud SQL Postgres 16 + Memorystore Redis 7.2 on private IPs through
      a dedicated VPC + Serverless VPC Access connector, Secret Manager
      for every credential, Artifact Registry for images, one service
      account per Cloud Run service with least-privilege `secretAccessor`
      bindings. Skeleton points at the public GHCR demo images so a fresh
      `apply` works zero-config. `apps/docs/docs/deployment/gcp.md` +
      sidebar slot between `kubernetes` and `env-vars`.

### Documentation

- [x] **`apps/docs/docs/operations/notifications.md`** — complete inventory
      of every notification surface in AiSOC (Web Push, Slack/Teams
      ChatOps, playbook `notify_slack`, `create_ticket` simulation,
      honeytoken first-touch webhooks, connector freshness alerts, on-call
      gating, suppression / quiet-hours, per-mechanism testing recipe).
- [x] **`apps/docs/docs/plugins/lifecycle.md`** — operator's view of plugin
      states, trust modes (`strict | warn | disabled`), filesystem + OCI
      discovery, the full operator REST API with required permissions,
      configuration reference, upgrade/rollback semantics, and the
      structlog events worth alerting on.
- [x] **`apps/docs/docs/integrations/misp-push.md`** — operator doc with
      config, endpoints, the STIX→MISP type table, failure modes, and the
      dry-run-as-air-gap-proof workflow.
- [x] **`apps/docs/docs/operations/case-reports.md`** — covers both
      `/summary` and `/postmortem` with audience, output, automation, and
      runbook archive guidance. Cases summary breadcrumb now points
      operators at both endpoints.
- [x] **`apps/docs/docs/connectors/{wazuh,auditd}.md`** + per-connector
      sidebar entries.
- [x] **`apps/docs/docs/plugins/cli.md`** — documents the new `aisoc
      plugin new --type` surface.
- [x] **`apps/docs/sidebars.ts`** — every new page registered in the
      correct category (Connectors, Plugin SDK, Operations, Integrations,
      Concepts, Deployment).

### Quality

- [x] `ruff check services/` and `ruff format --check services/` clean
      across the whole `services/` tree (CI scope).
- [x] Targeted lint fixes committed: `E741` (ambiguous `l`),
      `F402` (loop var shadowing `dataclasses.field`),
      `E402` (post-`sys.path` import), `E501` long-string refactors in
      `case_postmortem_html.py`, `test_misp_push.py`, and `auditd.py`.

---

## v8.0 — Shipped (2026-09-22)

v8.0 shipped as the **close-the-loop** release rather than the feature list
below. It had been reserved for the package-publish milestone, but nothing can
publish without registry credentials, so packaging moved out (see v8.1) and the
release instead wired capabilities the codebase already contained and never
called. What v8.0 actually delivered is recorded under `[8.0.0]` in
[`CHANGELOG.md`](CHANGELOG.md) and summarised in [`RELEASES.md`](RELEASES.md).

Disposition of every item that had been listed against v8.0:

- ~~Automated IOC sharing to community MISP instances via STIX/TAXII push~~ → **shipped in v7.2.0**
- ~~NL→query: "show me failed logins from new ASNs last 24h" → ES|QL / KQL~~ → **shipped in v7.2.0** (deterministic translator + 50-pair eval set)
- ~~SOC-in-a-box one-click cloud deploy (Terraform module for AWS / GCP)~~ → **GCP module shipped in v7.2.0** (AWS already shipped)
- ~~Automated retro/blameless post-mortem drafting from case timeline~~ → **shipped in v7.2.0** (ideas backlog item promoted)
- Mobile responder console (React Native) — **shipped in v9.0**; see the note
  under v7.0 above. The "no React Native code exists in the tree" this line
  used to carry is false: `apps/mobile` declares `react-native` and Expo, and
  the capability itself had shipped earlier still as a PWA under
  `apps/web/src/app/(responder)/`. What genuinely remains is not engineering:
  **no device build, simulator run or store submission has been performed**,
  and the APNs and FCM credentials needed to deliver a push to a real handset
  are an account action, the same class of blocker as the npm and PyPI
  publish. `apps/mobile/README.md` states both halves.
- Plugin publishing marketplace v3 (commercial plugins, revenue sharing) —
  **open and unscheduled**, and never in fact scheduled against a particular
  release. This line read "deferred past v8.0" through five majors, which
  dated the label rather than the decision; it is a scope decision, not a
  slipped commitment. Revenue sharing is a commercial decision rather than an
  engineering one, and the free packaging path is itself still blocked on
  registry credentials.
- MSSP RBAC enforcement on `/api/v1/actors/*` (threat attribution) — **shipped
  in v7.5.0** as part of the threat-actor attribution RBAC + port fix.
- AI-generated threat intelligence briefings from public feeds — **open**, not
  scheduled.
- Embedded red-team scoring (ATT&CK coverage %) as a live dashboard widget —
  **open**, not scheduled. The underlying coverage heatmap shipped in v5.1; the
  dashboard widget did not.
- SLA breach predictor (ML model on historical MTTR data) — **open**, not
  scheduled.
- Incident cost estimator (breach impact calculator) — **open**, not scheduled.

---

## v8.1 — Shipped (2026-09-23)

Wave-2 features plus release integrity. Every backlog item was audited against
the tree before any code was written, and the backlog was wrong in both
directions: two items were already built, and four had the capability present
with the path that feeds it broken. Two remain partial and say so — the two
attack-chain implementations still never exchange data, and ChatOps still has
no proactive card push or durable approval store.

Full inventory under `[8.1.0]` in [`CHANGELOG.md`](CHANGELOG.md). Tracked in
[`docs/roadmap/v8-progress.md`](docs/roadmap/v8-progress.md) and, for the
community-facing view, issue
[#362](https://github.com/beenuar/AiSOC/issues/362).

**Packaging is not in v8.1 either, and the reason is worth stating plainly:**
`release.yml` already builds, packs and would upload all eight packages — the
npm and PyPI jobs are written and run on every tag. The repository's only
secret is `FLY_API_TOKEN`. There is no `NPM_TOKEN` and no PyPI trusted
publisher, so the upload steps skip with a warning by design rather than
failing the release. This is an account action, not an engineering task, and
promising it in a release that cannot perform it is the kind of claim this
project's claim-to-gate matrix exists to prevent. Packaging is therefore named
against **v8.2**, and it becomes a re-tag the moment the credentials exist.

---

## v8.1.1 — Shipped (2026-09-23)

An adoption audit, and no new capability. The recurring feedback on this
project — hard to install, fabricated data, architecture nobody could follow,
documentation describing things a reader could not reproduce — turned out to
share one root cause: **the documented quick start did not run the product.**
`./install.sh` started a compose file with no ingest service, no fusion
service and `AISOC_DISABLE_KAFKA: true`, and the populated console a reader
saw was a seed script writing rows into Postgres.

The pipeline itself works. It had simply never been demonstrated, and now
`make smoke` demonstrates it on every CI run: one real event through ingest,
Kafka, fusion and detection, read back from the API, eight stages each
reporting independently.

Also in this release: `/readyz` on `services/ingest` that dials Kafka rather
than answering unconditionally, `make doctor`, CORE as the default ten-service
profile, five fabricated-data surfaces gated behind demo mode, the three
packages that could not be built at the v8.1.0 tag, and three new documents —
`docs/audit/REPOSITORY_REALITY.md`, a data-flow rewrite of
`docs/architecture/README.md`, and `docs/testing/CLEAN_INSTALL.md`.

Full inventory under `[8.1.1]` in [`CHANGELOG.md`](CHANGELOG.md).

---

## v12.0 — Shipped (2026-09-28)

The deployment a stranger actually starts, treated as the threat model. Three
reported vulnerabilities sat in the profile `make up` brings up, and none of
them needed a credential to reach: the actions service skipped authentication
entirely whenever its service token was empty and `AISOC_DEV_MODE` was set —
which compose defaults on while nothing generated the token — so
`isolate_host`, `disable_user`, `block_ip` and `run_script` were available to
anything that could reach the port; the realtime edge verified connection
tickets against a constant committed to this repository and read an unset
`/internal/*` token as authorized rather than as unconfigured; and `viewer`
could write to cases on all nine write routes, where a permission deliberately
withheld from the role was enforced nowhere. All three now refuse to serve
until the credential they need is set, which is what makes this a major, and
`scripts/ensure_env.py` backfills the generated secrets into an existing
`.env` so the documented path repairs itself.

Capability work in the same release: hunting stopped being a library of hunts
somebody had already written, with an agent that turns a hypothesis into a
plan whose fields and operators are closed enums and a compiler that binds
every model-supplied value as a parameter, so injection is unrepresentable
rather than filtered; the hunt corpus went from 5 to 68, and the grading over
it stopped being satisfiable by accident once a negative scenario had to
differ from its positive in exactly one indicator field — which found eight
violations on its first run against a corpus the old grading was passing. And
autonomy is now earned from a measured track record rather than typed into a
setting, with promotion refusing an unmeasured rate and demotion ignoring one.

Two gates that reported success over nothing were rebuilt on what the app
actually serves: the route-shadowing check read `app.routes` and filtered for
`APIRoute`, which `include_router` no longer populates, so it compared zero
pairs across 456 published operations — and the defect it should have caught
had left `DELETE /api/v1/autonomy-policy/grants` unreachable since it shipped,
answering 204 while deleting from the wrong table.

Full inventory — 44 entries — under `[12.0.0]` in [`CHANGELOG.md`](CHANGELOG.md).

---

## v11.1 — Shipped (2026-09-25)

One user's bug report, and the audit it turned into. A self-hoster bringing
AiSOC up with Compose on a single host reported that it "always deploys the
demo environment, even if I add the right variables". They were right, for two
independent reasons. `next build` freezes *both* halves of the console's
routing — `NEXT_PUBLIC_*` values are inlined into the bundle and the
destinations returned by `rewrites()` are compiled into
`routes-manifest.json` — so a pulled image could only ever talk to the hosts
it was built against, while `docker-compose.yml` set the variables on the web
service where nothing read them. And every host port published to a literal
`127.0.0.1`, so the stack came up healthy and unreachable from anywhere but
the machine it ran on. The console's addresses are now resolved when the
container starts, and an address that is set and cannot be applied stops the
container rather than silently falling back.

**A minor: nothing here requires an operator to act.** Every new variable
defaults to the behaviour that was previously compiled in, and the only
removals are two variables the console never read.

The second root cause was that the fix would have shipped to nobody. The
console image a quickstart pulls was built from a commit two releases behind
`main` and `aisoc-web:v11.0.0` was never pushed at all, while the rest of that
release was — every workflow green throughout, because a green workflow says a
job ran, not that the registry holds anything. The cause was arm64
cross-building under QEMU, measured at roughly 7x on a good run and
non-converging on a bad one: one arm64 `pnpm install` ran 6,358 seconds
without finishing while the amd64 leg of the same build took 100s. Both
publish workflows now build each architecture natively and merge the results
into a manifest list, and `scripts/check_published_images.py` asks the
registry whether every image the compose file, the chart and the docs name is
actually there — 14 findings against `main` before it existed. The Helm chart
could not have installed at all, and `aisoc-honeytokens`, `aisoc-purple-team`
and `aisoc-osquery-tls` are published here for the first time.

Also in this release: a recorded 2 min 57 s deployment walkthrough against the
published images, with real data and real token counts. Both triage runs in it
fell back to the deterministic path because the bundled 3B model's output
failed schema validation — the closing card says so. No hosted provider has
been exercised; there is still no funded key.

Full inventory under `[11.1.0]` in [`CHANGELOG.md`](CHANGELOG.md).

---

## v11.2 — Shipped (2026-09-26)

The answer to a question this repository had been asked for months: why 833
executable rules against a library of roughly 7,000? Not a missing feature —
Windows events nest their payload under `System`/`EventData`, one level below
anything the engine flattened, so `CommandLine` (2,173 rules) and `Image`
(2,300 rules) read `None` and no Windows rule could fire however correctly it
was written. The fix is in `windows_event.normalize()`, because those are
names from the Windows event schema and the engine is shared by every
connector; the engine and matcher are byte-identical.

**The engine now runs 2,603 rules, and every added rule was watched to fire.**
`scripts/sigma_compiler.py` translates imported Sigma into `match_when` or
refuses: of 3,132 rules considered, 1,770 ship and 1,362 are refused with a
recorded reason. The largest refusals are 556 whose log source no connector
emits and 464 whose negation would flip on a missing field, since Sigma treats
`not filter` as true when the field is absent and only two matcher operators
do. A rule enters the compiled ruleset only after a vendor-shaped event has
been replayed through the real connector and the real engine and produced a
hit, with an empty event of the same shape producing nothing — and
`compile_sigma_ruleset.py --prove-gate` reverts the connector and requires all
1,687 Windows rules to stop firing, so the proof is known to be able to fail.
It is a claim about reachability, not about detection.

**A minor: nothing here requires an operator to act.** No configuration
change, no migration, no API change; the connector fix only adds fields and a
normalized key still wins on collision. The detection surface is 3.1x wider
though, so a deployment with Windows telemetry should expect more alerts from
the same stream; `upstream_status` travels onto the alert so the 125
`experimental` rules can be filtered without disabling the rest.

Also here: upstream lifecycle status no longer gates execution (fireability
does), all 122 previously phantom-enabled rules are resolved, windowed
aggregation rules went from 10 to 18, and auto-triage asks the provider for
JSON rather than correcting prose afterwards — measured 44/50 to 50/50 on the
bundled local model. Four counters that still classified rules by directory
were moved onto the compiled ruleset, which is what closed the long-standing
disagreement between the validator, the coverage page, the marketplace index
and the truth table.

Full inventory under `[11.2.0]` in [`CHANGELOG.md`](CHANGELOG.md).

---

## v11.0 — Shipped (2026-09-25)

What a first run actually produced. Most of this was found by bringing the
stack up from the documented path and photographing the result, and nearly
every item passed the existing test suite while failing on a real deployment.
Following the README broke the credential vault, because `cp .env.example .env`
wrote a placeholder the vault treats as fatal while treating *empty* as fine.
`make up` then reported the stack broken on every machine, scoring the one-shot
model pull's normal exit as a dead container. And the profile a new user runs
had no real data and no model behind it, which is also why the console's threat
page had recently been caught rendering invented indicators: the missing feed
and the fabrication were one hole.

**A major because upgrading requires action on two items.** `POST /v1/ingest`
and `POST /v1/ingest/batch` now require a credential and take the tenant from
it, where they previously read `X-Tenant-ID` and believed it — so anyone who
could reach the port could write alerts into any tenant. And CORE now needs
**8 GB of memory and 20 GB of free disk**, up from `~6.5 GB`, because the
threat-intelligence feed, its vector store and a local model moved into it.

Re-measured rather than restated: CORE is 16 long-running services plus a
one-shot model pull and `full` is 22; resident memory for the whole stack went
1.72 GiB → 4.84 GiB. A fresh `make up` now holds 1,723 real CISA KEV entries
within a minute of boot with no credentials, and runs triage against a bundled
3B model — which returned usable triage output **44 times in 50 before its reply
was constrained to a JSON object, and 50 of 50 after**, the remainder falling
back to the deterministic path and logging that they had. No hosted provider has
been exercised; there is still no funded key.

Full inventory under `[11.0.0]` in [`CHANGELOG.md`](CHANGELOG.md).

---

## v10.0 — Shipped (2026-09-25)

An audit of one shape: a control that exists, is tested, and sits on a path
nothing reaches. Row-level security covered 92 tables and filtered nothing,
because every service connected to Postgres as a superuser. Fifty-eight routes
across four services carried no authentication at all, and thirty more let the
caller name the tenant they were reading. UEBA reported healthy and could not
write a baseline or an anomaly. AI triage was wired to a gateway that both of
its resolvers had been deliberately written to ignore.

**A major because upgrading requires action.** Services now connect as a
DML-only `aisoc_app` role rather than as the schema owner, which is what makes
those 92 policies filter; an existing data volume or a managed database must be
migrated deliberately. Also breaking: the `/mssp/*` payloads dropped fields
that described fabricated data and now refuse a non-member, two executor-less
`ActionType` members were removed, `CostTracker.total_cost_usd` is gone, and
the published `aisoc-web:latest` image no longer carries demo mode — the demo
build moved to its own tag.

Two published figures were re-measured rather than restated: CORE is 11
services (the LLM gateway moved into it) and `full` is 21, not 30. The quick
start now ends by creating an administrator and printing a generated password
once, because the credential pair the documentation published was wrong in
three independent ways.

Full inventory under `[10.0.0]` in [`CHANGELOG.md`](CHANGELOG.md).

---

## v9.0 — Shipped (2026-09-23)

Ten waves of one audit question: what in this tree exists, is tested, and has
no caller? v8.0 named that shape and found it a dozen times; v9.0 went looking
for it deliberately and found it in the approval loop, the marketplace, the
mobile console, the detection engine and the benchmark scoreboard.

The one worth stating first inverts what the feature appeared to do:
**approving an action executed nothing.** `decide()` flipped a row and never
reached the execution service, so every tap of Approve recorded a decision and
ran nothing — while telling the operator the opposite. Nothing ever created an
approval either, so the queue had no producer and was structurally empty on
every deployment.

Also: UEBA consumed a topic nothing writes; a plugin could never be rejected
for a bad signature; there was no registry allow-list and no digest pinning,
both of which the notes claimed existed; the public scoreboard was frozen for
ten weeks with every check passing; neither published Go SDK was installable;
and the Helm chart did not render at all.

What is knowingly still open is listed under `### Known` in `[9.0.0]` —
eight `PARTIAL` matrix rows, the migration-on-existing-volume path, 133
unreachable detection rules, and the OCI install route held back rather than
shipped with eight unresolved high findings.

Full inventory under `[9.0.0]` in [`CHANGELOG.md`](CHANGELOG.md).

---

## Ideas Backlog (unscheduled)

- "Explain this alert" button using LLM with enrichment context
- Browser-extension recorder for analyst playbook capture
- Voice-driven incident commander (TTS / STT for hands-free triage)
- Automated retro/blameless post-mortem drafting from case timeline