DanielMR-dev/PcapRaven

phase-validation

Use before completing any PcapRaven phase or change to verify roadmap scope, required artifacts, canonical-document consistency, paths, validation evidence, and absence of premature functionality.

reporting

Deterministic multi-format reporting architecture, serialization schemas, sanitization, and safe output writing in PcapRaven.

cli-contract

Use for PcapRaven command-line interface design, argument validation, streaming orchestration, stdout/stderr boundaries, and exit status contracts.

security-supply-chain

Audit and harden PcapRaven dependency, license, provenance, build-script, GitHub Actions, and fuzz-toolchain boundaries without expanding product scope.

developer

Senior Rust developer for PcapRaven. Implements bounded phase-scoped changes across crates, tests, tooling, and documentation while preserving safe Rust, hostile-input boundaries, deterministic behavior, crate ownership, and verified quality gates.

orchestrator

Primary PcapRaven software architect and multi-agent orchestrator. Inspects the repository and roadmap, defines bounded implementation plans, protects crate boundaries and security invariants, delegates implementation to the Developer, coordinates independent…

reviewer

Independent read-only PcapRaven code and security reviewer. Audits phase scope, Rust correctness, hostile-input safety, parser progress and bounds, crate ownership, deterministic flows and findings, detection evidence, reporting and CLI contracts, tests, CI,…

dns-detection

Use for PcapRaven explainable DNS anomaly and possible tunneling detection over normalized DNS observations.

fixture-golden-testing

Synthetic PCAP fixture corpus, schema freeze verification, golden reports matrix, and end-to-end regression testing in PcapRaven.

fuzz-robustness

Use for PcapRaven bounded cargo-fuzz harnesses, curated corpora, smoke and acceptance campaigns, invariant assertions, and crash or hang triage.

performance-analysis

Use for PcapRaven worst-case complexity review, bounded benchmark design, integer timing summaries, scalability analysis, and performance regression triage.

connection-behavior-detection

Explainable repeated low-volume flow behavior detection in PcapRaven.

detection-engine

Use for PcapRaven detection engine architecture, detector registration, configuration, evaluation, and deterministic finding generation.

finding-correlation

Explainable cross-detector finding correlation in PcapRaven.

finding-filtering

Use for PcapRaven explainable finding filtering by severity, confidence, detector identifier, and MITRE ATT&CK technique.

mitre-attack-mapping

Use for PcapRaven MITRE ATT&CK Enterprise Matrix v19.2 mapping provenance, validation, and explainability.

periodic-beaconing

Use for PcapRaven explainable periodic beaconing detection over exact flow temporal metrics.

observation-evidence-model

Use for PcapRaven unified protocol observation and structured evidence design, implementation, and review.

tls-protocol-analysis

Use for PcapRaven bounded TLS protocol analysis design, implementation, and review involving TLS 1.2 and TLS 1.3 handshake metadata, candidate classification, selected extension retention, privacy non-retention, framing metadata, and terminal-safe rendering.

secure-parser-review

Use for PcapRaven capture or protocol parser design and changes involving untrusted binary/text input, malformed records, bounds, resource limits, recovery, property tests, or fuzzing.

dns-protocol-analysis

Use for PcapRaven bounded DNS protocol analysis design, implementation, and review involving DNS wire format, candidate classification, backward pointer compression, EDNS(0) metadata, and terminal-safe rendering.

http-protocol-analysis

Use for PcapRaven bounded HTTP/1.x protocol analysis design, implementation, and review involving HTTP/1.0 and HTTP/1.1 message headers, candidate classification, selected header retention, sensitive header masking, framing metadata, and terminal-safe…

flow-reconstruction

Use for PcapRaven bidirectional flow reconstruction design, implementation, and review involving flow keys, directions, lifecycle boundaries, timeouts, SYN/RST/FIN semantics, and state limits.

flow-statistics

Use for PcapRaven directional flow traffic statistics and exact temporal metric design, implementation, and review.

rust-quality

Use for Rust source, Cargo workspace, dependency, lint, test, documentation, or unsafe-code changes in PcapRaven; do not run it as a Rust gate during documentation-only Phase 0.