Autarch/autarch_float.md

# AUTARCH Cloud Edition & Float Mode — Architecture Plan

**Run AUTARCH on a VPS, use it like it's on your local machine**

By darkHal Security Group & Setec Security Labs

---

## 1. What Is Float Mode?

Float Mode makes a remote AUTARCH instance feel local. The user signs into their AUTARCH account on a VPS and activates Float Mode. A lightweight client applet running on the user's PC creates a bridge that:

- **Forwards USB devices** (phones, ESP32, hardware) from the user's PC to the VPS
- **Exposes local network context** (LAN scanning sees the user's network, not the VPS's)
- **Bridges serial ports** (COM/ttyUSB devices) for hardware flashing
- **Provides clipboard sync** between local and remote
- **Tunnels mDNS/Bluetooth discovery** from the local machine

The VPS does all computation. The user's PC just provides I/O.

```
┌─────────────────────────────────────────────────────────┐
│                    USER'S BROWSER                        │
│  ┌───────────────────────────────────────────────────┐  │
│  │         AUTARCH Cloud Edition (Web UI)             │  │
│  │  Same UI as local AUTARCH — hardware, OSINT,       │  │
│  │  exploit tools, AI chat — everything works          │  │
│  └─────────────────────┬─────────────────────────────┘  │
│                        │ HTTPS                           │
└────────────────────────┼────────────────────────────────┘
                         │
                    ┌────▼────┐
                    │   VPS   │
                    │ AUTARCH │  ← All processing happens here
                    │   CE    │
                    └────┬────┘
                         │ WebSocket (wss://)
                         │ Float Bridge Protocol
                         │
┌────────────────────────┼────────────────────────────────┐
│                   USER'S PC                              │
│  ┌─────────────────────▼─────────────────────────────┐  │
│  │           Float Applet (native Go app)             │  │
│  │                                                     │  │
│  │  ┌──────────┐  ┌──────────┐  ┌─────────────────┐  │  │
│  │  │ USB Hub  │  │ Serial   │  │ Network Context │  │  │
│  │  │ Bridge   │  │ Bridge   │  │ (LAN, mDNS)     │  │  │
│  │  └────┬─────┘  └────┬─────┘  └────────┬────────┘  │  │
│  └───────┼──────────────┼─────────────────┼───────────┘  │
│          │              │                 │               │
│     ┌────▼────┐    ┌────▼────┐      ┌────▼────┐         │
│     │ Android │    │  ESP32  │      │  LAN    │         │
│     │ Phone   │    │  Board  │      │ Devices │         │
│     └─────────┘    └─────────┘      └─────────┘         │
└──────────────────────────────────────────────────────────┘
```

---

## 2. Why Write AUTARCH CE in Go?

The Python AUTARCH works great locally. But for cloud deployment at scale:

| Python AUTARCH | Go AUTARCH CE |
|----------------|---------------|
| 500MB+ with venv + dependencies | Single binary, ~30MB |
| Requires Python 3.10+, pip, venv | Zero runtime dependencies |
| Flask (single-threaded WSGI) | Native goroutine concurrency |
| llama-cpp-python (C++ bindings) | HTTP calls to LLM APIs only (no local models on VPS) |
| File-based config (INI) | Embedded config + SQLite |
| 72 modules loaded at startup | Modular, lazy-loaded handlers |
| subprocess for system tools | Native Go implementations where possible |

**Key insight:** The Cloud Edition doesn't need local LLM inference (no GPU on VPS), doesn't need ADB/Fastboot binaries (USB is on the user's PC), and doesn't need heavy Python dependencies. What it needs is a fast web server, WebSocket handling, and the ability to relay commands to the Float applet.

---

## 3. What Gets Ported, What Gets Dropped

### Port to Go (core features that work in cloud context)

| Feature | Python Source | Go Approach |
|---------|-------------|-------------|
| Web dashboard + UI | `web/app.py`, templates, CSS, JS | Go HTTP server + embedded templates |
| Authentication | `web/auth.py` | bcrypt + JWT |
| Configuration | `core/config.py` | YAML config + SQLite |
| LLM Chat (API-only) | `core/llm.py` | HTTP client to Claude/OpenAI/HF APIs |
| Agent system | `core/agent.py` | Port agent loop + tool registry to Go |
| OSINT recon | `modules/recon.py` | HTTP client, site database, result parsing |
| Dossier management | `modules/dossier.py` | SQLite + file storage |
| GeoIP | `modules/geoip.py` | MaxMind DB reader (native Go) |
| Hash toolkit | part of `modules/analyze.py` | Go `crypto/*` packages |
| Reverse shell listener | `modules/revshell.py`, `core/revshell.py` | Go net.Listener |
| Port scanner | `web/routes/port_scanner.py` | Go `net.DialTimeout` |
| Network mapping | `modules/net_mapper.py` | Go ICMP/TCP scanner |
| Targets management | `web/routes/targets.py` | SQLite CRUD |
| Payload generation | `modules/simulate.py` | String templating |
| Report engine | `modules/report_engine.py` | Go templates → PDF |
| Threat intel | `modules/threat_intel.py` | HTTP client to threat feeds |
| Wireshark (tshark) | `modules/wireshark.py` | Exec wrapper (tshark on VPS) |
| DNS service | `services/dns-server/` | Already Go, integrate directly |

### Relay via Float Bridge (runs on user's PC, not VPS)

| Feature | Why Relay? | Bridge Protocol |
|---------|-----------|----------------|
| ADB commands | Phone is on user's USB | USB frame relay |
| Fastboot | Phone is on user's USB | USB frame relay |
| ESP32 flash | Board is on user's serial port | Serial frame relay |
| Serial monitor | Device is on user's ttyUSB | Serial stream relay |
| LAN scanning | User's network, not VPS | Network proxy relay |
| mDNS discovery | User's LAN | mDNS frame relay |
| Bluetooth | User's adapter | BT command relay |
| File push/pull to device | USB device files | Chunked transfer relay |

### Drop (not applicable in cloud context)

| Feature | Why Drop |
|---------|---------|
| Local LLM (llama.cpp) | No GPU on VPS; use API backends |
| Local transformers | Same — no GPU |
| System defender (hardening) | VPS is managed by Setec Manager |
| Windows defender | Cloud is Linux only |
| Defense monitor | Managed by Setec Manager |
| UPnP port mapping | VPS has static IP, no NAT |
| WireGuard management | Not needed in cloud (direct HTTPS) |
| Metasploit RPC | Can optionally exec, but low priority |
| RouterSploit | Same |
| Module encryption system | Go doesn't need this pattern |
| Setup wizard | Replaced by Setec Manager bootstrap |
| CLI menu system | Cloud is web-only |
| Print capture/debug console | Replace with structured logging |

---

## 4. AUTARCH CE Directory Structure

```
/c/autarch_ce/                          # Development root
├── cmd/
│   └── autarch-ce/
│       └── main.go                     # Entry point
├── internal/
│   ├── server/
│   │   ├── server.go                   # HTTP server, router, middleware
│   │   ├── auth.go                     # JWT authentication
│   │   ├── sse.go                      # SSE streaming helpers
│   │   └── websocket.go               # WebSocket helpers
│   ├── handlers/
│   │   ├── dashboard.go                # Main dashboard
│   │   ├── chat.go                     # LLM chat + agent mode
│   │   ├── osint.go                    # OSINT reconnaissance
│   │   ├── scanner.go                  # Port scanner
│   │   ├── analyze.go                  # Hash toolkit, file analysis
│   │   ├── simulate.go                 # Payload generation, attack sim
│   │   ├── hardware.go                 # Hardware management (Float relay)
│   │   ├── targets.go                  # Target management CRUD
│   │   ├── exploit.go                  # Android/iPhone exploit routes
│   │   ├── revshell.go                 # Reverse shell listener
│   │   ├── network.go                  # Network tools (traceroute, ping, DNS)
│   │   ├── threat.go                   # Threat intel feeds
│   │   ├── reports.go                  # Report generation
│   │   ├── settings.go                 # Configuration management
│   │   └── wireshark.go               # Packet capture (tshark on VPS)
│   ├── llm/
│   │   ├── llm.go                      # Multi-backend LLM client interface
│   │   ├── claude.go                   # Anthropic Claude backend
│   │   ├── openai.go                   # OpenAI backend
│   │   ├── huggingface.go             # HuggingFace Inference backend
│   │   └── agent.go                    # Autonomous agent (THOUGHT/ACTION/PARAMS)
│   ├── osint/
│   │   ├── engine.go                   # Site checking engine (concurrent)
│   │   ├── sites.go                    # Site database loader (JSON)
│   │   ├── dossier.go                  # Dossier management
│   │   └── geoip.go                    # MaxMind GeoIP reader
│   ├── hardware/
│   │   ├── manager.go                  # Hardware manager (Float-aware)
│   │   ├── adb.go                      # ADB command builder/parser
│   │   ├── fastboot.go                 # Fastboot command builder/parser
│   │   ├── serial.go                   # Serial port management
│   │   └── bridge.go                   # Float bridge command relay
│   ├── float/
│   │   ├── protocol.go                 # Binary WebSocket frame protocol
│   │   ├── session.go                  # Session management
│   │   ├── usb.go                      # USB device relay logic
│   │   ├── serial.go                   # Serial port relay logic
│   │   └── network.go                  # Network context relay logic
│   ├── scanner/
│   │   ├── port.go                     # TCP/UDP port scanner
│   │   ├── service.go                  # Service fingerprinting
│   │   └── network.go                  # Network mapper (ICMP sweep)
│   ├── tools/
│   │   ├── registry.go                 # Agent tool registry
│   │   ├── hash.go                     # Hash computation + identification
│   │   ├── strings.go                  # String extraction from binaries
│   │   └── encode.go                   # Encoding/decoding utilities
│   ├── revshell/
│   │   ├── listener.go                 # TCP listener for reverse shells
│   │   ├── generator.go               # Shell payload generator
│   │   └── session.go                  # Active shell session management
│   ├── db/
│   │   ├── db.go                       # SQLite connection + migrations
│   │   ├── targets.go                  # Target CRUD
│   │   ├── dossiers.go                 # Dossier storage
│   │   ├── sessions.go                 # Float sessions
│   │   └── jobs.go                     # Background job tracking
│   └── config/
│       └── config.go                   # YAML config + defaults
├── web/
│   ├── templates/                      # HTML templates (embed.FS)
│   │   ├── base.html                   # Master layout (port from Python)
│   │   ├── login.html
│   │   ├── dashboard.html
│   │   ├── chat.html
│   │   ├── osint.html
│   │   ├── scanner.html
│   │   ├── hardware.html
│   │   ├── analyze.html
│   │   ├── simulate.html
│   │   ├── targets.html
│   │   ├── exploit.html
│   │   ├── revshell.html
│   │   ├── reports.html
│   │   ├── settings.html
│   │   └── ... (one per feature)
│   └── static/                         # CSS/JS/images (embed.FS)
│       ├── css/style.css               # Port from Python AUTARCH
│       ├── js/
│       │   ├── app.js                  # Main app logic (port from Python)
│       │   ├── float-client.js         # Float Mode browser-side logic
│       │   ├── hardware-direct.js      # WebUSB (for local mode fallback)
│       │   └── lib/
│       │       ├── adb-bundle.js       # ADB WebUSB client
│       │       ├── fastboot-bundle.js  # Fastboot WebUSB client
│       │       └── esptool-bundle.js   # ESP32 Web Serial client
│       └── img/
│           └── autarch.ico
├── data/
│   └── sites/                          # OSINT site databases (JSON)
│       ├── sherlock.json
│       ├── maigret.json
│       └── ...
├── build.sh
├── go.mod
└── config.yaml
```

---

## 5. Float Bridge Protocol

### 5.1 Frame Format

All communication over WebSocket using binary frames:

```
┌──────┬──────┬──────┬────────┬─────────────────────┐
│ VER  │ TYPE │ SEQ  │ LENGTH │ PAYLOAD             │
│ 1B   │ 1B   │ 4B   │ 4B     │ variable            │
└──────┴──────┴──────┴────────┴─────────────────────┘

VER:     Protocol version (0x01)
TYPE:    Frame type (see below)
SEQ:     Sequence number (for request/response matching)
LENGTH:  Payload length in bytes (big-endian uint32)
PAYLOAD: Type-specific data (JSON or binary)
```

### 5.2 Frame Types

```
── Control ──────────────────────────────────
0x00  PING                  Keepalive
0x01  PONG                  Keepalive response
0x02  HELLO                 Client registration (capabilities, platform)
0x03  AUTH                  Session authentication
0x04  ERROR                 Error response
0x05  DISCONNECT            Graceful disconnect

── USB ──────────────────────────────────────
0x10  USB_ENUMERATE         List connected USB devices
0x11  USB_ENUMERATE_RESULT  Device list response
0x12  USB_OPEN              Open device by vid:pid or serial
0x13  USB_OPEN_RESULT       Open result (handle ID)
0x14  USB_CLOSE             Close device handle
0x15  USB_TRANSFER          Bulk/interrupt transfer
0x16  USB_TRANSFER_RESULT   Transfer response data
0x17  USB_HOTPLUG           Device connected/disconnected event

── ADB (high-level, built on USB) ──────────
0x20  ADB_DEVICES           List ADB devices
0x21  ADB_DEVICES_RESULT    Device list with state/model
0x22  ADB_SHELL             Execute shell command
0x23  ADB_SHELL_RESULT      Command output
0x24  ADB_PUSH              Push file to device
0x25  ADB_PUSH_DATA         File data chunk
0x26  ADB_PUSH_RESULT       Push completion
0x27  ADB_PULL              Pull file from device
0x28  ADB_PULL_DATA         File data chunk
0x29  ADB_PULL_RESULT       Pull completion
0x2A  ADB_INSTALL           Install APK
0x2B  ADB_INSTALL_RESULT    Install result
0x2C  ADB_LOGCAT            Start logcat stream
0x2D  ADB_LOGCAT_LINE       Logcat line
0x2E  ADB_REBOOT            Reboot device

── Fastboot ─────────────────────────────────
0x30  FB_DEVICES             List fastboot devices
0x31  FB_DEVICES_RESULT      Device list
0x32  FB_GETVAR              Get variable
0x33  FB_GETVAR_RESULT       Variable value
0x34  FB_FLASH               Flash partition (streamed)
0x35  FB_FLASH_DATA          Firmware data chunk
0x36  FB_FLASH_PROGRESS      Flash progress update
0x37  FB_FLASH_RESULT        Flash completion
0x38  FB_REBOOT              Reboot
0x39  FB_OEM_UNLOCK          OEM unlock

── Serial ───────────────────────────────────
0x40  SERIAL_LIST            List serial ports
0x41  SERIAL_LIST_RESULT     Port list
0x42  SERIAL_OPEN            Open port (baud, settings)
0x43  SERIAL_OPEN_RESULT     Open result
0x44  SERIAL_CLOSE           Close port
0x45  SERIAL_WRITE           Send data to port
0x46  SERIAL_READ            Data received from port
0x47  SERIAL_DETECT_CHIP     ESP32 chip detection
0x48  SERIAL_DETECT_RESULT   Chip info

── Network Context ──────────────────────────
0x50  NET_INTERFACES         List network interfaces
0x51  NET_INTERFACES_RESULT  Interface list (IPs, MACs)
0x52  NET_SCAN               Scan local network (ARP/ping)
0x53  NET_SCAN_RESULT        Host list
0x54  NET_RESOLVE            DNS resolve on client network
0x55  NET_RESOLVE_RESULT     Resolution result
0x56  NET_CONNECT            TCP connect through client
0x57  NET_CONNECT_RESULT     Connection result
0x58  NET_MDNS_DISCOVER      mDNS service discovery
0x59  NET_MDNS_RESULT        Discovered services

── System Context ───────────────────────────
0x60  SYS_INFO               Client system info
0x61  SYS_INFO_RESULT        OS, arch, hostname, user
0x62  SYS_CLIPBOARD_GET      Get clipboard contents
0x63  SYS_CLIPBOARD_DATA     Clipboard data
0x64  SYS_CLIPBOARD_SET      Set clipboard contents
```

### 5.3 Payload Formats

**HELLO payload (JSON):**
```json
{
  "version": "1.0.0",
  "platform": "windows",
  "arch": "amd64",
  "hostname": "user-desktop",
  "capabilities": ["usb", "serial", "network", "clipboard"],
  "usb_devices": 3,
  "serial_ports": 1
}
```

**USB_ENUMERATE_RESULT payload (JSON):**
```json
{
  "devices": [
    {
      "vid": "18d1",
      "pid": "4ee7",
      "serial": "ABCDEF123456",
      "manufacturer": "Google",
      "product": "Pixel 8",
      "bus": 1,
      "address": 4,
      "class": "adb"
    }
  ]
}
```

**ADB_SHELL payload (JSON):**
```json
{
  "serial": "ABCDEF123456",
  "command": "pm list packages -3"
}
```

**USB_TRANSFER payload (binary):**
```
┌──────────┬──────────┬──────┬──────────┐
│ HANDLE   │ ENDPOINT │ FLAGS│ DATA     │
│ 4B       │ 1B       │ 1B   │ variable │
└──────────┴──────────┴──────┴──────────┘
```

---

## 6. Float Applet (Client-Side)

### 6.1 Options for the Applet

| Option | Pros | Cons |
|--------|------|------|
| **Go native app** (recommended) | Single binary, cross-platform, full USB access via libusb/gousb | Requires download + run |
| **Electron app** | Web technologies, WebUSB built-in | Heavy (~150MB), Chromium overhead |
| **Tauri app** | Lighter than Electron (~10MB), Rust backend | More complex build, newer ecosystem |
| **Browser extension + Web Serial/USB** | No install needed | Limited USB access, Chrome only, no raw USB |
| **Java Web Start / JNLP** | Auto-launch from browser | Dead technology, security warnings |

**Recommendation: Go native app** (5-10MB binary)

The user downloads a small executable. On launch it:
1. Shows a system tray icon with status
2. Connects via WebSocket to the VPS
3. Enumerates local USB, serial, and network
4. Relays commands from the VPS to local hardware
5. Stays running in background until closed

### 6.2 Float Applet Structure

```
float-applet/
├── cmd/
│   └── float/
│       └── main.go                 # Entry point, tray icon
├── internal/
│   ├── bridge/
│   │   ├── client.go               # WebSocket client + reconnect
│   │   ├── protocol.go             # Frame parser/builder (shared with server)
│   │   └── handler.go              # Dispatch incoming frames to subsystems
│   ├── usb/
│   │   ├── enumerate.go            # List USB devices (gousb/libusb)
│   │   ├── device.go               # Open/close/transfer
│   │   └── hotplug.go              # Device connect/disconnect events
│   ├── adb/
│   │   ├── client.go               # ADB protocol implementation
│   │   ├── shell.go                # Shell command execution
│   │   ├── sync.go                 # File push/pull (ADB sync protocol)
│   │   └── logcat.go               # Logcat streaming
│   ├── fastboot/
│   │   ├── client.go               # Fastboot protocol
│   │   ├── flash.go                # Partition flashing
│   │   └── getvar.go               # Variable queries
│   ├── serial/
│   │   ├── enumerate.go            # List serial ports
│   │   ├── port.go                 # Open/read/write serial
│   │   └── esp.go                  # ESP32 chip detection
│   ├── network/
│   │   ├── interfaces.go           # List local interfaces
│   │   ├── scan.go                 # ARP/ping sweep
│   │   ├── proxy.go                # TCP proxy for remote connections
│   │   └── mdns.go                 # mDNS discovery relay
│   └── system/
│       ├── info.go                 # OS, arch, hostname
│       └── clipboard.go            # Clipboard read/write
├── build.sh                        # Cross-compile: Windows, Linux, macOS
└── go.mod
```

### 6.3 Float Applet User Experience

```
1. User visits AUTARCH CE web dashboard
2. Clicks "Float Mode" button
3. If first time:
   a. Page shows download links for their platform (auto-detected)
   b. User downloads float-applet binary (~8MB)
   c. Runs it — system tray icon appears
4. Applet auto-connects to VPS via WebSocket
5. Dashboard detects connection:
   a. Hardware page now shows LOCAL USB devices
   b. LAN scanner sees LOCAL network
   c. Serial ports show LOCAL COM/ttyUSB ports
6. User works normally — everything feels local
7. Close applet → hardware reverts to VPS context
```

---

## 7. AUTARCH CE Feature Map

### Tier 1: Core (implement first)

| Feature | Source Reference | Go Package |
|---------|----------------|------------|
| Web server + routing | `web/app.py` (183 lines) | `internal/server/` |
| Authentication | `web/auth.py` (73 lines) | `internal/server/auth.go` |
| Dashboard | `web/routes/dashboard.py` | `internal/handlers/dashboard.go` |
| Configuration | `core/config.py` (587 lines) | `internal/config/` |
| Settings UI | `web/routes/settings.py` | `internal/handlers/settings.go` |
| Base template + CSS | `web/templates/base.html`, `style.css` | `web/templates/`, `web/static/` |

### Tier 2: Intelligence (implement second)

| Feature | Source Reference | Go Package |
|---------|----------------|------------|
| LLM chat (API backends) | `core/llm.py` (1400 lines) | `internal/llm/` |
| Agent system | `core/agent.py` (439 lines) | `internal/llm/agent.go` |
| Tool registry | `core/tools.py` | `internal/tools/registry.go` |
| Chat UI | `web/routes/chat.py`, `web/templates/chat.html` | `internal/handlers/chat.go` |
| OSINT engine | `modules/recon.py` | `internal/osint/engine.go` |
| Site databases | `data/sites/*.json` (7,287 sites) | `data/sites/` (embedded) |
| Dossier management | `modules/dossier.py` | `internal/osint/dossier.go` |
| GeoIP | `modules/geoip.py` | `internal/osint/geoip.go` |

### Tier 3: Scanning & Analysis

| Feature | Source Reference | Go Package |
|---------|----------------|------------|
| Port scanner | `web/routes/port_scanner.py` | `internal/scanner/port.go` |
| Network mapper | `modules/net_mapper.py` | `internal/scanner/network.go` |
| Hash toolkit | `modules/analyze.py` (hash section) | `internal/tools/hash.go` |
| Target management | `web/routes/targets.py` | `internal/handlers/targets.go` |
| Threat intel | `modules/threat_intel.py` | `internal/handlers/threat.go` |
| Report engine | `modules/report_engine.py` | `internal/handlers/reports.go` |

### Tier 4: Float Mode + Hardware

| Feature | Source Reference | Go Package |
|---------|----------------|------------|
| Float bridge (server) | NEW | `internal/float/` |
| Hardware manager | `core/hardware.py` (641 lines) | `internal/hardware/` |
| Hardware UI | `web/routes/hardware.py` (417 lines) | `internal/handlers/hardware.go` |
| ADB relay | `core/hardware.py` ADB methods | `internal/hardware/adb.go` |
| Fastboot relay | `core/hardware.py` FB methods | `internal/hardware/fastboot.go` |
| Serial relay | `core/hardware.py` serial methods | `internal/hardware/serial.go` |

### Tier 5: Exploitation & Advanced

| Feature | Source Reference | Go Package |
|---------|----------------|------------|
| Reverse shell | `core/revshell.py`, `modules/revshell.py` | `internal/revshell/` |
| Payload generator | `modules/simulate.py` | `internal/handlers/simulate.go` |
| Android exploit | `core/android_exploit.py` | `internal/handlers/exploit.go` |
| Wireshark (tshark) | `modules/wireshark.py` | `internal/handlers/wireshark.go` |

---

## 8. Estimated Scope

```
AUTARCH Cloud Edition (Go rewrite of web-facing features):
├── Core server + auth + config + dashboard    ~2,500 lines
├── LLM client + agent system                  ~2,000 lines
├── OSINT engine + site DB + dossiers          ~2,500 lines
├── Scanner + network tools                    ~1,500 lines
├── Float bridge protocol + server side        ~2,000 lines
├── Hardware manager (Float relay)             ~1,500 lines
├── Handlers (all web routes)                  ~3,000 lines
├── Database layer                             ~1,000 lines
├── Web templates (HTML)                       ~3,000 lines
├── CSS + JavaScript                           ~2,500 lines
└── Total                                      ~21,500 lines

Float Applet (client-side):
├── WebSocket client + reconnect               ~500 lines
├── Protocol + frame handling                  ~800 lines
├── USB enumeration + transfer                 ~1,000 lines
├── ADB protocol client                        ~1,500 lines
├── Fastboot protocol client                   ~800 lines
├── Serial port management                     ~600 lines
├── Network context (scan, proxy, mDNS)        ~1,000 lines
├── System (clipboard, info)                   ~300 lines
├── Tray icon + UI                             ~400 lines
└── Total                                      ~6,900 lines

Combined total: ~28,400 lines of Go
```

---

## 9. Build Phases

### Phase 1: Foundation
- Go HTTP server with chi router
- JWT authentication
- Dashboard with system stats
- Configuration management (YAML + UI)
- Base HTML template + CSS (port from Python AUTARCH)
- SQLite database
- **Deliverable:** Working web dashboard you can log into

### Phase 2: Intelligence
- LLM client (Claude, OpenAI, HuggingFace API backends)
- Agent system (THOUGHT/ACTION/PARAMS loop)
- Tool registry
- Chat UI with SSE streaming
- OSINT engine with concurrent site checking
- GeoIP lookups
- Dossier CRUD
- **Deliverable:** AI chat + OSINT fully working

### Phase 3: Tools
- Port scanner with SSE progress
- Network mapper
- Hash toolkit (identify, compute, mutate)
- Target management
- Threat intelligence feed integration
- Report generation
- Reverse shell listener
- **Deliverable:** Full scanning + analysis suite

### Phase 4: Float Mode
- Float bridge protocol implementation (server)
- WebSocket session management
- USB device relay (enumerate, open, transfer)
- ADB command relay
- Fastboot command relay
- Serial port relay
- Hardware UI integration
- **Deliverable:** Connect local hardware to cloud AUTARCH

### Phase 5: Float Applet
- Go native client application
- WebSocket client with auto-reconnect
- USB enumeration via gousb/libusb
- ADB protocol (shell, sync, install)
- Fastboot protocol (flash, getvar)
- Serial port access
- Network context (interfaces, ARP scan, mDNS)
- System tray icon
- Cross-platform build (Windows, Linux, macOS)
- **Deliverable:** Complete Float Mode end-to-end

### Phase 6: Polish
- Exploit modules (Android, iPhone)
- Wireshark integration
- Payload generator
- UI refinement
- Documentation
- Automated tests
- **Deliverable:** Production-ready AUTARCH CE

---

## 10. Key Design Decisions

1. **No local LLM** — VPS won't have GPU. All LLM via API (Claude preferred).
2. **Embedded assets** — Templates, CSS, JS, site databases baked into binary via `embed.FS`.
3. **SQLite not files** — All persistent state in SQLite (not JSON files on disk).
4. **Float is optional** — AUTARCH CE works without Float. Hardware features just show "Connect Float applet" when no bridge is active.
5. **Same UI** — Port the exact HTML/CSS from Python AUTARCH. Users shouldn't notice the difference.
6. **Protocol versioned** — Float bridge protocol has version byte for backward compatibility.
7. **Chunked transfers** — Large files (firmware, APKs) sent in 64KB chunks over the bridge.
8. **Reconnect resilient** — Float applet auto-reconnects. Operations in progress resume or report failure.
9. **Security first** — All bridge communication over WSS (TLS). Session tokens expire. USB transfers validated.
10. **DNS server integrated** — The existing Go DNS server can be imported as a Go package directly.