wiki: sync to v2.2.0 — fix rapid-exit score, cgroup v2 containment, roadmap completed sections
docs(roadmap): fix #51 — tests/integration/ has 7 live test files, not empty
Issue #51 incorrectly stated the integration folder was empty. It now
contains 7 end-to-end test files covering canary detection, containment,
Akira/LockBit pipelines, silent encryption, and autonomous agent runs.
3xcv
committed
Jun 13, 2026
docs(wiki): bump to v2.2.0; update all pages for speed gap fix, UI changes, and sim results
- Home: version v2.1.0 → v2.2.0; add v2.1.1 and v2.2.0 to version history table
- Detection-Engine: update behavioral scoring to 6 signals (Signal 6); update
entropy verification description (score >= 70 bypass); expand simulation table
to all 6 families with actual v2.2.0 test results
- Installation-and-Setup: Terminal 4 now shows eBPF vs inotify variants; Terminal 5
Vite ready message corrected; log message corrected
- Roadmap: v2.2.0 completed section added; v2.3.0 is now the next milestone
- Known-Issues-and-Fixes: add LockBit/Qilin speed gap root cause + fix; add
Celery update_host_risk race fix; add Docker port 3000 conflict fix
- Project-Overview: eBPF description updated to mention Signal 6 and speed gap
wiki: v2.1.0 refresh — eBPF Phase 3, setup, roadmap, architecture, detection engine
- Home.md: update to v2.1.0; add version history table; add project board and release links
- Roadmap.md: restructure by milestone (v2.1.0/v2.2.0); add CI/eBPF Phase 3 completed items; separate Dependabot breaking PRs warning
- Installation-and-Setup.md: add linux-headers to BCC install; add kernel version verification step; add eBPF Mode section; add troubleshooting table
- Detection-Engine.md: add Attack Simulations section with usage commands and LockBit 5.0 4-metric validation table
- Architecture.md: expand eBPF sensor capabilities to include proc_profile map details, family profiling, IGNORE_COMMS, Markov disabled note
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
docs(wiki): update all pages for eBPF sensor, SIEM redesign, D3 graph
- Architecture: React 19, eBPF+inotify dual-sensor diagram, new SIEM
frontend components (TopBar, StatusBar, FacetRail, MetricsStrip,
AlertsHistogram, AlertsTable, DetailFlyout, EventDetailModal,
FileSystemGraph); added design system table; simulations table
- Detection-Engine: add Layer 6 eBPF section (TRACEPOINT_PROBE, velocity
burst, family profiling, BCC 0.35 requirements, SENSOR_BACKEND)
- Configuration: add SENSOR_BACKEND and DRY_RUN optional variables;
update .env example with commented eBPF/dry-run lines
- Installation-and-Setup: add BCC install step; Node.js 22 prerequisite;
renumber steps; add inotify fallback note
- Known-Issues-and-Fixes: add problems 10-13 (CORS relative URL fix,
duplicate processes after git pull, eBPF BCC not installed, npm ENOTEMPTY)
- Roadmap: move Graph View to Completed (D3 done); add eBPF sensor,
SIEM redesign, attack simulations, LockBit test suite to Completed;
update dependency bump table; refresh Open items
- Project-Overview: add eBPF sensor + SIEM dashboard to capabilities;
update tech stack (D3 v7, BCC, Node.js 22, IBM Plex fonts)
- Home: update tagline to mention eBPF and SIEM dashboard
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
docs(wiki): move CRA→Vite to Completed (PR #33 open)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
docs(wiki): bring all 11 pages up to date with current project state
- Home: added landing page link, updated page descriptions
- Project-Overview: updated AI stack (Cerebras/NVIDIA/Groq), added extension detection
- Installation-and-Setup: added setup.sh, fixed all startup commands
- Configuration: fixed env var names (AI_API_KEY -> NVIDIA_API_KEY), added Cerebras, removed 3 fake vars
- Detection-Engine: added Layer 4 extension detection, dpkg verification, entropy memory cap
- Auto-Containment: added tree-aware detail (two-sweep, 48 files, UID-based iptables)
- AI-Threat-Analyst: added multi-provider chain, PENDING state, 24h Redis cache
- Roadmap: moved CI+Tests+Reports to Completed, updated In Progress to real open items
- Known-Issues-and-Fixes: updated canary fix (3-layer prevention), added AI WebSocket fix, added auto-ack ID fix
- Architecture: added FilesystemPage+ReportsPage, updated ai_analyst description, updated data flow
- API-Reference: added new event types, date filters, with-events endpoint, ai_analysis_update message
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
docs: add full project wiki — overview, architecture, detection engine, setup, API, issues, roadmap