yoloyolo/.planning/milestones/v1.0-REQUIREMENTS.md

# Requirements Archive: v1.0 MVP

**Archived:** 2026-03-26
**Status:** SHIPPED

For current requirements, see `.planning/REQUIREMENTS.md`.

---

# Requirements: NetSynth

**Defined:** 2026-03-24
**Core Value:** Network traffic patterns are instantly recognizable as distinct sounds — a ping sounds different from HTTPS noise, which sounds different from a port scan.

## v1 Requirements

Requirements for initial release. Each maps to roadmap phases.

### Packet Capture

- [x] **CAPT-01**: User can specify network interface via `-i` flag
- [x] **CAPT-02**: User can list available network interfaces via `--list-interfaces`
- [x] **CAPT-03**: Capture runs until user presses Ctrl+C, then gracefully flushes and saves MP3
- [x] **CAPT-04**: User sees a clear actionable error message when lacking capture privileges (sudo/CAP_NET_RAW hint)
- [x] **CAPT-05**: User can filter captured traffic using BPF syntax via `--filter` flag
- [x] **CAPT-06**: User can sonify a pcap file instead of live traffic via `--read` flag

### Traffic Classification

- [x] **CLAS-01**: Known protocols (ICMP, DNS, TCP/443, TCP/other, UDP, SSH) each produce a distinct recognizable sound
- [x] **CLAS-02**: Unrecognized traffic is auto-clustered and assigned unique tones automatically
- [x] **CLAS-03**: On exit, user sees a summary of packet counts and protocol breakdown (printed to stderr)
- [x] **CLAS-04**: User can enable per-window protocol activity log via `--verbose` flag

### Audio Synthesis

- [x] **SYNTH-01**: Each traffic class generates a distinct ambient/drone layer (layered sine/harmonic waves)
- [x] **SYNTH-02**: Drone layer amplitudes evolve over time windows based on traffic volume per class
- [x] **SYNTH-03**: Multiple drone layers are mixed into a single coherent audio stream without distortion

### Output

- [x] **OUT-01**: User can specify output file path via `-o` flag (defaults to `netsynth-<timestamp>.mp3`)
- [x] **OUT-02**: Output is encoded as a valid MP3 file
- [x] **OUT-03**: Empty captures (zero packets) produce a clear error instead of a corrupt file

## v2 Requirements

Deferred to future release. Tracked but not in current roadmap.

### Audio Tuning

- **TUNE-01**: User can configure time window duration via `--window` flag
- **TUNE-02**: User can configure output duration when reading pcap files via `--duration` flag
- **TUNE-03**: User can customize sound mappings via configuration file

### Distribution

- **DIST-01**: Single static binary with no runtime dependencies

## Out of Scope

| Feature | Reason |
|---------|--------|
| Real-time audio playback | Platform audio API complexity triples scope; users can pipe MP3 to mpv/afplay |
| GUI or web dashboard | Negates single-binary CLI value; doubles scope |
| Rhythmic/percussive output | Ambient/drone is the deliberate differentiator |
| Deep packet inspection | Massive complexity; header-level classification sufficient for audio fingerprint |
| Anomaly detection/alerting | Different user job; stick to audio fingerprint |
| Streaming MP3 output | MP3 VBR headers require finalization; buffer-then-encode is correct |

## Traceability

Which phases cover which requirements. Updated during roadmap creation.

| Requirement | Phase | Status |
|-------------|-------|--------|
| CAPT-01 | Phase 1 | Complete |
| CAPT-02 | Phase 1 | Complete |
| CAPT-03 | Phase 3 | Complete |
| CAPT-04 | Phase 1 | Complete |
| CAPT-05 | Phase 4 | Complete |
| CAPT-06 | Phase 4 | Complete |
| CLAS-01 | Phase 1 | Complete |
| CLAS-02 | Phase 3 | Complete |
| CLAS-03 | Phase 1 | Complete |
| CLAS-04 | Phase 1 | Complete |
| SYNTH-01 | Phase 2 | Complete |
| SYNTH-02 | Phase 2 | Complete |
| SYNTH-03 | Phase 2 | Complete |
| OUT-01 | Phase 2 | Complete |
| OUT-02 | Phase 2 | Complete |
| OUT-03 | Phase 2 | Complete |

**Coverage:**
- v1 requirements: 16 total
- Mapped to phases: 16
- Unmapped: 0

---
*Requirements defined: 2026-03-24*
*Last updated: 2026-03-24 after roadmap creation*