Expand TUI guidance and host detection coverage

docs/COMMAND_REFERENCE.md

@@ -403,10 +403,16 @@ daemon status, recent alert snapshots, incident index and timelines, posture
 findings, integrity/watchdog state, event-rule metadata, event tail, and
 read-only response-plan previews.
 
+Beginner-oriented prompts in each view explain what the data means and suggest a
+safe flow: check Status first, review grouped Incidents, read the Timeline,
+inspect Response Plans, then confirm Integrity. The TUI is read-only; it never
+executes response commands.
+
 Keys:
 
 - `1` / `2` / `3` / `4`: status, alerts, incidents, timelines.
 - `5` / `6` / `7` / `8` / `9`: posture, integrity, rules, events, response plans.
+- `n` / `b`: next/back through the beginner workflow.
 - `j` / `k` or arrows: scroll.
 - `r`: refresh.
 - `/`: filter the current view.
@@ -416,7 +422,8 @@ Keys:
 - `q`: quit.
 
 Command mode supports `status`, `alerts`, `incidents`, `timeline`, `posture`,
-`integrity`, `rules`, `events`, `response`, `help`, `refresh`,
+`integrity`, `rules`, `events`, `response`, `help`, `home`, `guide`, `next`,
+`back`, `refresh`,
 `filter <text>`, `clear`, and `quit`.
 
 ### `web`

docs/OPERATIONS.md

@@ -80,8 +80,10 @@ for quick remote review.
 For SSH/tmux operators, `enodia-sentinel tui` provides a terminal dashboard over
 the same local read-only management state: status, recent alerts, incidents,
 incident timelines, posture findings, integrity/watchdog state, event-rule
-metadata, event tail, and dry-run response-plan previews. Use `:` for command
-mode and `Tab` to complete TUI commands.
+metadata, event tail, and dry-run response-plan previews. Newer operators can
+follow the built-in workflow hints: Status -> Incidents -> Timeline -> Response
+Plans -> Integrity. Press `n`/`b` to step through that workflow, or use `:` for
+command mode and `Tab` to complete TUI commands.
 
 On desktop hosts the optional tray applet (`enodia-sentinel-tray`, `[tray]`
 extra) wraps the same workflow: it drives the same `systemctl` units operators

docs/ROADMAP.md

@@ -44,7 +44,8 @@ work that is bigger than single alerts.
   raw ICMP/special-protocol rootcheck detection.
 - ✅ Add process-hiding and memory-obfuscation coverage: `/proc` vs `ps`
   cross-view checks plus memory-map scans for hide libraries, RWX memory, and
-  executable anonymous/memfd/deleted mappings.
+  executable anonymous/memfd/deleted mappings, plus writable-path executable
+  library mappings that suggest userland process injection.
 - ✅ Add event-driven memory telemetry for short-lived `mprotect`/`mmap` RWX,
   `memfd_create`, `ptrace`, seccomp, cross-process memory access, and memory
   locking syscalls.
@@ -131,8 +132,11 @@ Purpose: reduce blind spots and connect related signals.
 - ✅ Add the first typed host-event rule family beside exec/syscall rules:
   `rules test` accepts `tcp_connect` event JSON and ships SID `100067` for
   interpreter egress to unusual public ports, with a replayable fixture.
+- ✅ Add a second typed host-event rule family for `listen` events: SID `100068`
+  flags interpreters opening listeners on unusual local ports, with local-port
+  match conditions and a replayable fixture.
 - Continue generalizing the rule engine across more typed host events:
-  `bind`, `listen`, `accept`, `file_write`, `chmod/chown`, `setuid/setgid`,
+  `bind`, `accept`, `file_write`, `chmod/chown`, `setuid/setgid`,
   `capset`, and module-load events.
 - Keep rules declarative and Snort-like:
   `sid`, `msg`, `severity`, `classtype`, `event`, and match fields such as

docs/RULES.md

@@ -223,3 +223,22 @@ Expected false positives:
 - Developer tooling using interpreters for custom APIs on high ports.
 
 Drill or fixture: Use `rules test` with a `tcp_connect` event whose `comm` is an interpreter and whose public `peer_port` is not a common service port.
+
+## SID 100068: Interpreter opened a listener on an unusual local port
+
+- Event: `listen`
+- Signature: `host_rule.suspicious-listener`
+- Classtype: `suspicious-listener`
+- Severity: `HIGH`
+- Origin: `builtin`
+
+Match fields:
+- `events`: `listen`
+- `comm`: `ash`, `bash`, `curl`, `dash`, `fetch`, `ksh`, `lua`, `nc`, `ncat`, `netcat`, `node`, `nodejs`, `perl`, `php`, `python`, `python2`, `python3`, `ruby`, `sh`, `socat`, `wget`, `zsh`
+- `local_port_exclude`: `22`, `53`, `80`, `123`, `443`, `853`
+
+Expected false positives:
+- Developer HTTP servers, netcat listeners, or local test harnesses intentionally opened from an interpreter.
+- Administrative troubleshooting that temporarily listens on a high port.
+
+Drill or fixture: Use `rules test` with a `listen` event whose `comm` is an interpreter and whose `local_port` is not a common service port.

docs/RUNBOOKS.md

@@ -243,14 +243,18 @@ modules you intentionally trust.
 
 ---
 
-## Runbook 5 — Memory obfuscation or process-hiding library
+## Runbook 5 — Memory obfuscation, process hiding, or injection library
 
-**Triggers:** `memory_obfuscation` (100039), `process_hiding_library` (100048)
+**Triggers:** `memory_obfuscation` (100039), `process_hiding_library` (100048),
+`process_injection_library` (100049)
 
 These alerts come from `/proc/<pid>/maps`. They do not read process memory; they
 flag map shapes associated with encrypted/packed payloads or userland hiding:
 RWX pages, executable anonymous memory, executable `memfd`/deleted mappings, or
-libraries with process-hiding names such as `libhide`.
+libraries with process-hiding names such as `libhide`. They also flag executable
+shared-library mappings from writable/runtime paths such as `/tmp`, `/dev/shm`,
+`/var/tmp`, and `/run/user`, which are common places for injected userland hooks
+or staged `.so` payloads.
 
 **Confirm**
 
@@ -259,6 +263,9 @@ libraries with process-hiding names such as `libhide`.
 - For `process_hiding_library`, check whether the mapped library is package-owned
   and whether it is loaded into tools like `ps`, `pgrep`, `ss`, shells, or admin
   utilities.
+- For `process_injection_library`, preserve the mapped `.so`, check its owner,
+  hash, parent process, and whether it was deliberately loaded by a known
+  profiler, debugger, or local instrumentation tool.
 - For `memory_obfuscation`, distinguish expected JIT runtimes from unknown
   implants. Tune known runtimes with `memory_obfuscation_allow_comms`; use
   `memory_obfuscation_allow_paths` only for well-understood local runtimes or