From 21d6ed2db94ce17bdcc8a134d788be79009dba5d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Przemys=C5=82aw=20K=C5=82ys?= Date: Mon, 5 Oct 2026 00:06:55 +0200 Subject: [PATCH 1/2] =?UTF-8?q?docs(roadmap):=20=F0=9F=93=9D=20Remove=20se?= =?UTF-8?q?ttled=20assessment=20work=20from=20the=20backlog?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- Docs/Legacy-Issue-Triage.md | 6 ++--- ROADMAP.md | 47 ++++++++++++++----------------------- 2 files changed, 21 insertions(+), 32 deletions(-) diff --git a/Docs/Legacy-Issue-Triage.md b/Docs/Legacy-Issue-Triage.md index f37676b7..9faf0c3d 100644 --- a/Docs/Legacy-Issue-Triage.md +++ b/Docs/Legacy-Issue-Triage.md @@ -35,9 +35,9 @@ permissions, retained input and current result. | [#17](https://github.com/EvotecIT/EventViewerX/issues/17), table success/failure detail | Current reports expose source coverage, failure diagnostics, scan bounds and completion evidence; readiness distinguishes unavailable proof. | Demonstrate complete, empty, failed-source and capped examples. An empty table alone is not proof of successful exhaustive collection. | The package checks validate installed module/tool behavior independently of -development imports. The history, streaming and evidence-export changes in the -active roadmap carry additional completion and occurrence guarantees; their -source candidates and published delivery state must be assessed separately. +development imports. History, streaming and evidence exports preserve completion +and occurrence guarantees. Assess the installed package separately from current +source when reproducing a legacy report. Use [the roadmap](../ROADMAP.md) for central storage, branding and extension decisions. Use a current retained fixture and focused regression proof for a diff --git a/ROADMAP.md b/ROADMAP.md index dce65207..b454364b 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -9,11 +9,12 @@ belong in the repository's releases, pull requests and capability guides. | Capability | Owner | User path | | --- | --- | --- | -| Local, remote, WEC and saved-EVTX queries; typed definitions and normalization | EventViewerX core | C#, `Get-EVXEvent`, `evx query` | +| Local, remote, WEC and saved-EVTX queries; streaming, typed definitions and normalization | EventViewerX core | C#, `Get-EVXEvent`, `evx query` | | Native packs, Sigma compilation, bounded correlation and finding provenance | Core and EventViewerX.Detection | `Invoke-EVXDetection`, CLI detection, shared plans | | Aggregation, occurrence grouping, timelines and Group Policy context | Core contracts | `Measure-EVXEvent`, report pipelines and context stores | | Durable SQLite history, findings, checkpoints and retention | EventViewerX.Storage over DbaClientX | `Show-EVXEvent -StorePath`, store query and integrity commands | | HTML, Excel, CSV and compact email | EventViewerX.Reporting over HtmlForgeX and OfficeIMO | `Show-EVXEvent`, reusable snapshots and renderers | +| Export privacy profiles and verifiable evidence bundles | EventViewerX core reporting contracts | Detached exports, pseudonyms and bundle manifests | | PowerShell and CLI hosting | Thin PSEventViewer and EventViewerX.Cli adapters | Consistent bounded queries and operational evidence | | Build, packages, release qualification and performance orchestration | PowerForge/PSPublishModule | Build configurations, artifact checks and benchmark gates | | Portable saved-EVTX parsing | EventViewerX.Evtx | Explicit portable file mode; live Windows channels retain native APIs | @@ -26,39 +27,21 @@ grouping and normalization add views without silently deleting observations. ## Active improvement backlog -The 2026-10-04 assessment produced the following reviewable changes. Open PRs -represent source candidates; they do not establish a published package or an -installed runtime. Merge and release gates apply separately. - -- [ ] Settle historical replay, occurrence multiplicity and completion evidence - ([#131](https://github.com/EvotecIT/EventViewerX/pull/131)). -- [ ] Settle source-query streaming and read-mode parity - ([#132](https://github.com/EvotecIT/EventViewerX/pull/132), depends on #131). -- [ ] Settle checkpoint lookup allocation - ([#134](https://github.com/EvotecIT/EventViewerX/pull/134)). -- [ ] Settle archive resource handling, cancellation and atomic publication - ([#135](https://github.com/EvotecIT/EventViewerX/pull/135)). -- [ ] Settle distinct-value correlation state and its comparable performance - proof ([#136](https://github.com/EvotecIT/EventViewerX/pull/136)). -- [ ] Settle portable EVTX fidelity and allocation - ([#137](https://github.com/EvotecIT/EventViewerX/pull/137)). -- [ ] Settle export privacy policies and verifiable evidence bundles - ([#138](https://github.com/EvotecIT/EventViewerX/pull/138), depends on #132). -- [ ] Settle packed CLI and PowerShell ZIP qualification in ordinary CI - ([#139](https://github.com/EvotecIT/EventViewerX/pull/139)). -- [ ] Qualify compact email presentation work and full-report column analysis - against comparable workloads and rendered output. -- [ ] Qualify standalone CLI archives on their declared platform and architecture - matrix before publication. Normal tool-install proof covers Windows/Linux; - it does not replace ARM64 or macOS runtime qualification. +Current source includes historical replay and occurrence guarantees, visible +completion evidence, streaming and read modes, indexed checkpoints, bounded +distinct correlation, portable EVTX allocation improvements, export privacy and +evidence bundles, packed-artifact CI, and responsive compact email. The remaining +work concerns release delivery, further full-report measurement and legacy +conversations. + +- [ ] Profile full-detail HTML reports on representative large investigations. + Preserve snapshot behavior and measure rendering allocation separately from + bounded email digests. - [ ] Publish approved artifacts only after signing, package identity, installation and runtime checks pass and publication is authorized. - [ ] Reconcile [legacy issue dispositions](Docs/Legacy-Issue-Triage.md) with current reports before closing or transferring conversations. -Remove settled PR items after their behavior is integrated. Keep current user -paths in guides and contracts, rather than retaining completed milestone lists. - ## Quality and performance gates A successful empty result is useful only when its selected input was complete. @@ -77,6 +60,12 @@ Keep allocation and scale evidence separate from noisy workstation timing. [Performance gates](Docs/Performance-Gates.md) describe the controlled suites; timing-sensitive gates do not belong in an uncontrolled CI smoke test. +Qualify each standalone CLI archive on its declared operating system and +architecture before publication. A successful build or a tool installation on +another architecture does not establish native archive runtime behavior. +Keep archive hashes and source identity with the query, ingestion, reload and +integrity evidence for the release candidate. + Interactive full-detail reports retain their selected rows. Use explicit collection limits, aggregation and bounded snapshots for large investigations; a compact email should format only its allocated digest rows. Streaming queries From d4e49f941cbcbec66bc746f461ce34cb04f5833d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Przemys=C5=82aw=20K=C5=82ys?= Date: Mon, 5 Oct 2026 00:19:45 +0200 Subject: [PATCH 2/2] =?UTF-8?q?docs(performance):=20=F0=9F=93=9D=20Record?= =?UTF-8?q?=20the=20current=20mobile=20email=20allocation=20baseline?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- Benchmarks/EventReportRendering/README.md | 23 ++++++++ .../EventReportRendering/after-mobile.json | 53 +++++++++++++++++++ 2 files changed, 76 insertions(+) create mode 100644 Benchmarks/EventReportRendering/after-mobile.json diff --git a/Benchmarks/EventReportRendering/README.md b/Benchmarks/EventReportRendering/README.md index 31264c80..6dc1f263 100644 --- a/Benchmarks/EventReportRendering/README.md +++ b/Benchmarks/EventReportRendering/README.md @@ -22,3 +22,26 @@ The email change limits projection to the rows actually displayed. Its allocatio The HTML renderer still projects and renders every event. Its allocation improvement is small, and the 10,000-event output is about 16.6 MB. These measurements do not establish an HTML throughput improvement or a bound on large interactive reports. Timing results are observations from a potentially busy development host, not release performance guarantees. The before snapshot uses the unchanged renderer at commit `7793aa5997bf016b0f56c33e8ae01abd68846ccd`. The after snapshot includes bounded email projection, single-pass constant-column classification, and HtmlForgeX 1.1.0 for descriptive dashboard captions. The email dependency remains HtmlForgeX.Email 1.6.0 in both measurements. + +## Current mobile email baseline + +`after-mobile.json` records the same fixture with published HtmlForgeX.Email +2.0.0 and mobile stacked records at commit +`2c4904dff24deb130c4da5fa1fa3e5fc4f79ca67`. All twelve measured samples pass. +The runner uses one warmup, three measured iterations and rotated case order, +with processor affinity `0xFFFF` and BelowNormal priority requested. + +| Case | Mean renderer allocated bytes | Output bytes | +| --- | ---: | ---: | +| Email, 1,000 events | 11,899,384 | 215,215 | +| Email, 10,000 events | 11,899,581 | 215,219 | +| HTML, 1,000 events | 147,577,709 | 2,961,045 | +| HTML, 10,000 events | 1,156,132,952 | 16,569,102 | + +Email allocation stays approximately constant as the input grows because the +digest still displays 25 records. The newer dependency and stacked presentation +produce more markup and allocate more than the historical 1.6 fixture above. +Use this baseline when measuring the current presentation; the two dependency +versions and output layouts do not form a comparison of projection changes alone. +Full-detail HTML still renders every retained record and needs explicit input +bounds for large investigations. diff --git a/Benchmarks/EventReportRendering/after-mobile.json b/Benchmarks/EventReportRendering/after-mobile.json new file mode 100644 index 00000000..3a6c7e7b --- /dev/null +++ b/Benchmarks/EventReportRendering/after-mobile.json @@ -0,0 +1,53 @@ +{ + "Contract": "Deterministic generic rows; fixture generation excluded; HTML retains all rows; email displays the first 25.", + "Phase": "Published Email 2.0.0 with mobile stacked layout", + "SourceRevision": "2c4904dff24deb130c4da5fa1fa3e5fc4f79ca67", + "SourceWorktreeClean": true, + "HtmlForgeXVersion": "1.1.0", + "HtmlForgeXEmailVersion": "2.0.0", + "ConfiguredSdkVersion": "10.0.112", + "Runtime": ".NET 10.0.12", + "OSArchitecture": "X64", + "ProcessArchitecture": "X64", + "ProcessorAffinityRequested": "0xFFFF", + "PriorityRequested": "BelowNormal", + "WarmupCount": 1, + "IterationCount": 3, + "RunOrder": "Rotated", + "SampleCount": 12, + "FailureCount": 0, + "Metrics": [ + { + "Scenario": "Email-1000", + "Metrics": { + "RenderMs": 11.871733333333333, + "RendererAllocatedBytes": 11899384.0, + "OutputBytes": 215215.0 + } + }, + { + "Scenario": "Email-10000", + "Metrics": { + "RenderMs": 25.666633333333333, + "RendererAllocatedBytes": 11899581.333333334, + "OutputBytes": 215219.0 + } + }, + { + "Scenario": "Html-1000", + "Metrics": { + "RenderMs": 84.9825, + "RendererAllocatedBytes": 147577709.33333334, + "OutputBytes": 2961045.0 + } + }, + { + "Scenario": "Html-10000", + "Metrics": { + "RenderMs": 540.5117333333334, + "RendererAllocatedBytes": 1156132952.0, + "OutputBytes": 16569102.0 + } + } + ] +}