Add host correlation and assurance coverage

docs/ROADMAP.md

@@ -135,9 +135,11 @@ Purpose: reduce blind spots and connect related signals.
 - ✅ Add a second typed host-event rule family for `listen` events: SID `100068`
   flags interpreters opening listeners on unusual local ports, with local-port
   match conditions and a replayable fixture.
-- Continue generalizing the rule engine across more typed host events:
-  `bind`, `accept`, `file_write`, `chmod/chown`, `setuid/setgid`,
-  `capset`, and module-load events.
+- ✅ Continue generalizing the rule engine across more typed host events:
+  `file_write`, `chmod/chown`, and `setuid/setgid` now have built-in rules,
+  typed event parsing, fixtures, and rule-operation tests.
+- Continue extending typed host-event coverage to:
+  `bind`, `accept`, `capset`, and module-load events.
 - Keep rules declarative and Snort-like:
   `sid`, `msg`, `severity`, `classtype`, `event`, and match fields such as
   process name, parent process, argv regex, path prefix, peer IP/port, UID/GID,
@@ -146,7 +148,11 @@ Purpose: reduce blind spots and connect related signals.
   `tcp_connect`, `bind`, `accept`, module load, privilege transitions, and
   writes to watched persistence paths.
 - Build process lineage across polling and event sources.
-- Correlate multi-stage behavior:
+- ✅ Start correlating multi-stage behavior with a read-only incident
+  correlation engine: `exec_rule.web-rce` plus suspicious egress or an unusual
+  listener in a 10-minute incident window raises SID `100080`
+  `correlation.multi_stage_intrusion` while preserving the raw alerts.
+- Continue expanding multi-stage behavior:
   web service spawns shell, shell downloads payload, payload adds persistence,
   listener appears, and FIM changes.
 - Add configurable correlation windows and severity escalation rules, including:
@@ -162,9 +168,12 @@ Purpose: reduce blind spots and connect related signals.
   `curl|wget | sh`, Python/perl/bash reverse-shell argv variants,
   `systemctl enable` from unusual ancestry, `chmod +s` outside package
   transactions, and execution from writable directories.
-- Add first-seen and rarity tracking for local network behavior:
-  first public destination per process name, first listening port per binary,
-  interpreter connections to non-standard ports, and long-lived low-byte
+- ✅ Add first-seen and rarity tracking for local network behavior:
+  first public destination per process name and first listening port per
+  process name are locally baselined in `first-seen.json` and alert after the
+  initial silent pass.
+- Continue rarity coverage for:
+  interpreter connections to non-standard ports and long-lived low-byte
   connections when socket sampling can support it.
 - Keep polling as the oracle and fallback.
 
@@ -208,6 +217,9 @@ Exit criteria:
 Purpose: support several personal or small-business Linux hosts without turning
 the agent into a heavy enterprise platform.
 
+- ✅ Add a fleet collector design note covering optional collector boundaries,
+  per-host enrollment, signed JSON payloads, HTTPS/tailnet transport, and
+  standalone-agent failure semantics ([FLEET_DESIGN.md](FLEET_DESIGN.md)).
 - Add an optional collector service.
 - Agents push signed JSON events and heartbeats over HTTPS or a tailnet.
 - Collector stores host status, alerts, incidents, and package/integrity state.
@@ -230,7 +242,8 @@ Purpose: make tampering harder to hide from an attacker with high privileges.
 
 - External baseline anchor:
   mirror FIM and package DB fingerprints off-box with append-only semantics.
-- Hash-chain `events.log` and snapshots.
+- ✅ Hash-chain `events.log` and snapshots locally with append-only
+  `enodia.hash_chain.v1` JSONL records, exposed through the integrity report.
 - Optional snapshot signing with a host key.
 - Investigate Linux IMA/EVM and TPM-backed attestation for supported machines.
 - Replace bcc with a libbpf + CO-RE agent if the event layer becomes core to