Skip to content

Roadmap

Jump to bottom
Mohhudib edited this page May 29, 2026 · 8 revisions

Roadmap

Open / In Progress

Frontend CRA → Vite Migration

The main dashboard still uses react-scripts (Create React App), which has 26 unresolvable npm security alerts in its build toolchain. Migrating to Vite would fix all of them. The landing page already uses Vite as a reference. Requires a careful, standalone PR — a previous attempt (PR #29) was rejected for conflicting with already-merged work.

Integration Tests

tests/integration/ exists but is empty. The unit test suite covers isolated behavior well (71 tests, 89% coverage). End-to-end tests that spin up the full stack (agent → backend → Celery → WebSocket → alert) are still needed.

Major Dependency Bumps

Seven Dependabot PRs are open and waiting on testing:

  • React 18 → 19
  • react-dom 18 → 19
  • date-fns 3 → 4
  • watchdog 4 → 6
  • websockets 12 → 16
  • uvicorn 0.30 → 0.48
  • lucide-react 0.395 → 1.16

Planned Features

Graph View (React Flow)

Replace the current FileSystemTree component with an interactive graph view:

  • Nodes represent files, processes, and alerts
  • Edges show relationships (which process touched which file)
  • Live nodes light up on detection events
  • Canary nodes flash red on hit

Exception Management UI

A settings page to manage the whitelist without editing code:

  • Add/remove whitelisted processes
  • Add/remove whitelisted paths
  • Toggle exceptions on/off per rule

Alembic Database Migrations

Currently using create_all on startup. Proper Alembic migrations for schema versioning, safe production upgrades, and rollback support.

Completed

  • ✅ Full detection pipeline (canary → entropy → extension detection → lineage → Markov → containment)
  • ✅ Tree-aware auto-containment (entire process tree, two-sweep enumeration, 48 files evidence)
  • ✅ dpkg hash verification in lineage scorer (416 K hashes, SHA-256 LRU cache)
  • ✅ Ransomware extension detection (.enc, .locked, .wcry, etc.)
  • ✅ Multi-provider AI fallback chain (Cerebras → NVIDIA/Groq key 1 → key 2)
  • ✅ Live WebSocket dashboard with 3 Redis channels
  • ✅ AI PENDING state + ai_analysis_update WebSocket message
  • ✅ AI results cached in Redis (24h) for forensic export
  • ✅ PDF forensic export with host-aware sections and SHA-256 integrity footer
  • ✅ Auto-containment pipeline (SIGSTOP → evidence → iptables → SIGKILL)
  • ✅ Auto-acknowledgment (containment complete + AI benign classification)
  • ✅ Markov chain adaptive canary repositioning with _is_safe_target() guard
  • ✅ Canary git corruption prevention (.gitignore, _validate_watch_path(), _is_safe_target())
  • ✅ Exception/whitelist system with smart /tmp filter
  • ✅ Unit test suite (71 tests, 89% coverage — entropy, lineage, adaptive, severity)
  • ✅ GitHub Actions CI (backend lint + Docker build + landing page deploy)
  • ✅ 3D cinematic landing page deployed at https://mohhudib.github.io/hybrid-rsentry/
  • ✅ start.sh one-command startup + test_event.sh pipeline test
  • ✅ Full documentation (README, Wiki, CHANGELOG, CONTRIBUTING, CLAUDE.md)

Clone this wiki locally