Skip to content

ROADMAP.md

Latest commit

 

History

History
106 lines (82 loc) · 5.81 KB

ROADMAP.md

File metadata and controls

106 lines (82 loc) · 5.81 KB
Raw

Roadmap

This document outlines the planned direction for ProjectAchilles. Features are organized by quarter with status indicators.

Status key: ✓ Shipped · ○ In progress · ∅ Planned

Want to influence the roadmap? Open a GitHub Discussion or upvote existing feature requests.

Completed (Jan–Mar 2026)

These features shipped since the v1.0.0 release:

  • ✓ Custom Go Agent — Enrollment, heartbeat, task execution, self-updating
  • ✓ Build From Source — Go cross-compilation for Windows/Linux (amd64/arm64)
  • ✓ Code Signing — Windows Authenticode via osslsigncode with multi-cert management
  • ✓ Task Scheduling — Recurring execution with randomized timing
  • ✓ 30+ Analytics Endpoints — Defense scores, heatmaps, treemaps, trends, coverage
  • ✓ Docker Compose Deployment — Multi-service with optional local Elasticsearch
  • ✓ Setup Wizard — Interactive TUI for first-time configuration
  • ✓ Git-Synced Test Library — Automatic repository sync with GitHub
  • ✓ Multi-Index Management — Per-task ES index targeting (manual index creation later superseded by write-index rollover)
  • ✓ Favorites & Recent Views — Browser module localStorage persistence
  • ✓ ngrok Tunnel Support — Configurable domains for remote agent communication
  • ✓ LimaCharlie Removal — Replaced with custom agent system
  • ✓ macOS Agent Support — darwin/amd64 + darwin/arm64 with launchd and rcodesign
  • ✓ Microsoft Defender Integration — Secure Score, alerts, control profiles, cross-correlation
  • ✓ Trend Alerting — Slack + email notifications with threshold configuration
  • ✓ Notification Bell — In-app alert dropdown in top bar
  • ✓ MITRE ATT&CK Coverage Matrix — Visual technique heatmap on browse page
  • ✓ Visual Themes — Neobrutalism + Hacker Terminal with phosphor variants
  • ✓ Browse Overview Dashboard — 3-tab layout with category metrics
  • ✓ Remote Agent Uninstall — Two-phase cleanup from admin UI
  • ✓ Risk Acceptance — Accept risk on individual security controls
  • ✓ 5 Deployment Targets — Docker Compose, Railway, Render, Fly.io, Vercel
  • ✓ Execution Drawer — Run tests directly from browse page
  • ✓ Bundle Results Fan-out — Per-control ES documents for cyber-hygiene and intel-driven tests

Completed (Apr–Jul 2026)

  • ✓ CLI (achilles) + AI Chat Agent — 18 command modules, Clerk device-flow login, conversational agent mode
  • ✓ API Keys v1 — pa_ bearer tokens with scoped permissions for programmatic access
  • ✓ Defender Tab Redesign — Alert drill-down drawer, correlation timeline, per-execution detection rate with MITRE roll-up, control ↔ alert linking
  • ✓ Defender Auto-Resolve — Programmatic resolution of Achilles-correlated alerts with dry-run mode and receipts
  • ✓ Public + On-Prem Server Targets — Single-server installs behind Caddy with four TLS modes (now 7 deployment targets)
  • ✓ DigitalOcean Tenant Deployer — Phased, resumable droplet provisioning (scripts/deploy-do/)
  • ✓ achilles deploy TUI — Unified guided deployment across targets, interactive or headless
  • ✓ Write-Index Rollover — Dated achilles-results-<date> write indices with daily/monthly/static rollover
  • ✓ Per-Machine Schedule Randomization — Independent randomized next-run per agent
  • ✓ Azure/Entra Certificate Auth — JWT client assertion as an alternative to client secrets for Defender/Azure integrations
  • ✓ Rate-Limiter Recalibration — Budgets re-keyed from IP to principal (agent ID / Clerk user)
  • ✓ Blog — Next.js + MDX blog at blog.projectachilles.io with Spanish/English auto-translation
  • ✓ Chart Color Governance — Semantic chart tokens with WCAG AA contrast enforcement and drift-guard tests
  • ✓ Honest Task Status — Completed-but-failed tasks surfaced truthfully across all task tables

Near-Term (Q3 2026)

Agent Enhancements

  • ∅ Agent groups with bulk command execution
  • ∅ Agent health alerting (offline threshold notifications)
  • ∅ Agent configuration profiles (poll interval, update policy per group)

Analytics & Reporting

  • ∅ Custom analytics dashboards with saved queries
  • ∅ CSV/JSON export for all visualizations
  • ∅ Blue team response metrics (Time to Detect, Time to Respond)
  • ∅ Scheduled report delivery (email/webhook)

Test Management

  • ∅ Test campaigns — grouped multi-test execution with aggregate results
  • ∅ Test result comparison across time periods
  • ∅ Test tagging and custom metadata

Medium-Term (Q3 2026)

Platform

  • ∅ Multi-tenancy with role-based access control (RBAC)
  • ○ Public API — API keys v1 shipped (pa_ tokens, scoped permissions); OpenAPI specification pending
  • ∅ Kubernetes deployment (Helm charts)
  • ∅ Executive PDF report generation

Integrations

  • ∅ SIEM connectors (Splunk, Microsoft Sentinel)
  • ∅ Microsoft Teams webhook notifications
  • ∅ Ticketing system integration (Jira, ServiceNow)

Long-Term (Q4 2026+)

  • ∅ Test SDK — author security tests in Go or Python with a standard interface
  • ∅ Plugin/extension system for custom modules
  • ∅ Threat intelligence feed integration (STIX/TAXII)
  • ∅ AI-powered test recommendations based on coverage gaps
  • ∅ Red team collaboration features (shared campaigns, findings)

This roadmap is a living document and will be updated as priorities evolve. Dates are aspirational, not commitments.