Version and support limits
These docs cover the latest 0.3 development preview, checked on 2026-10-18. The latest download reports 0.3.0-dev, build ID 0.3.0-dev-20261018-5e1320d3. Historical versions may lack features described in current guides; see downloads. Your installed version / support output and packaged BUILDINFO / SUPPORT define the actual build identity and declarations.
Product form
A continuous Linux service with a Go host, Wasm protocol plugins, eBPF endpoint plaintext, local WAL, file/Dataway outputs, CLI/TUI, and systemd/Helm deployment. There is currently no central web console, public plugin marketplace, notification channels, maintenance silencing, manual acknowledgement, or cross-sensor correlation.
Evidence and remaining gaps
| Area | Current status |
|---|---|
| Linux arm64 / OrbStack Debian 13 | Build, functionality, systemd recovery, and capacity runtime records |
| Linux amd64 | Cross-compiled; no native runtime acceptance |
| OpenSSL / Go TLS | Real HTTP/database TLS chains tested; other libraries, compilers, and kernels need target-specific validation |
| HTTP/3 | Restricted quic-go versions, symbols/DWARF, and kernel requirements; see protocol support |
| Dataway | Local mock receiver ACK tested; no production authentication, indexing, or retrieval validation |
| Physical mirrored capture / 1 Gbps | Unverified; loopback is not equivalent |
| 24-hour / multi-kernel production matrix | Incomplete; no production acceptance claim |
Interpreting capacity
The latest optimization round passed a five-minute OrbStack Go-plugin fault/reload load at 500 request/response pairs per second, 1000 connections, 1 KiB bodies, and 20 rules, with both sinks reconciled. At 1000 pairs per second, the same fault workload dropped analyzer output before WAL submission and failed acceptance. This is a boundary for that input and environment, not a general throughput promise.
CPU, RSS, and tail latency depend on protocols, rules, connection distribution, draining generations, disk, and host load. Shared-host improvements do not establish production capacity. Measure your own traffic mix, loss, complete transactions, latency, and backlog recovery.
Data guarantees
At-least-once begins at successful WAL commit. Retries retain event_id; sinks acknowledge independently. Earlier capture gaps, buffer rejection, parser faults, or process failure can lose observations. Redaction is the default and credentials are never exported. Explicit auditing needs service/field selection, permissions, and retention controls.
Requesting support
Provide version/support, selected scope, incident time, sanitized reproduction, and a diagnostic archive. An archive alone does not prove completeness. Capacity or delivery issues also need sent counts, complete matches, drops, and destination event_id evidence.