Release history

vUnreleased

Unreleased

v1.0.30

2026-07-10

Added

• SQLite-backed runtime persistence: SOC cases, fleet agents + enrollment tokens, admin-console sessions, and forwarded events now persist in SQLite databases instead of loose JSON files. Each store keeps its public API and in-memory model; only load/persist switched backends, and any pre-existing JSON file is migrated in on first load (renamed .migrated as a backup). Writes are transactional; the session store remains signed and owner-only (0600).
• Agent-side HTTP client coverage: AgentClient (enrollment, heartbeats, event/log forwarding, policy and update polling) gains a mock-server test harness, raising its coverage from 5 to 18 tests and asserting auth-header propagation, status handling, and JSON decoding.

Fixed

• Real Windows process termination: ProcessEnforcer previously returned a fabricated success on non-Unix platforms; process kills now run a real taskkill /F /PID (honest failure for missing PIDs), and suspend/resume report no Windows backend rather than faking success.
• Test-server port-allocation race: spawn_test_server bound an ephemeral port, dropped the listener, then re-bound it — a TOCTOU window that intermittently failed CI. The bound socket is now handed straight to the server via TcpListener::from_std.
• Systemic CI failures: fixed a TypeScript SDK live test that ran during unit collection, restored the support/security emails required by the release-facts contract, added a missing {id} path parameter to the OpenAPI spec, silenced a Windows-only dead-code error, patched a transitive undici advisory, and read SQLite COUNT(*) as i64 for rusqlite ≥ 0.32.

Changed

• Dependencies: rusqlite 0.31 → 0.40, tower-http 0.6 → 0.7, plus log, chrono, zeroize, and ml-dsa; admin-console and TypeScript SDK dev dependencies; and GitHub Actions pins (actions/checkout v7, gitleaks-action v3).
• Container build uses the pinned toolchain: the release image now builds with the rust-toolchain.toml toolchain (required by newer transitive dependencies) rather than the MSRV base image.
• CI hygiene: cargo check --no-default-features is now an enforced gate, the inapplicable semver-check job was removed (Wardex is a binary, not a published library), and the managed release-acceptance Playwright run now retries transient browser flakes.

Documentation

• README, status, roadmap, release facts, website metadata, OpenAPI, Helm, OTLP, and SDK package metadata now point at the v1.0.30 release surface.

v1.0.29

2026-06-03 — Structural hardening and coverage baseline

Added

• Coverage baseline: docs/COVERAGE_BASELINE.md now records the first cargo llvm-cov workspace summary for Wardex, with 76.16% line coverage and generated LCOV output excluded from git.

Changed

• server.rs decomposition target met: src/server.rs is now 7,600 lines, down from 34,750 at the start of the sweep. Dynamic fallback API routing moved into src/server_dynamic_routes.rs, joining the dedicated server_* modules for runtime, helpers, operator, process, detection, workbench, assistant, support, and view responsibilities.
• API integration suite split: the former 8,577-line tests/api_integration.rs file is removed and replaced with domain-focused API integration files plus tests/common/mod.rs, keeping the API test inventory navigable.
• OpenAPI and enterprise sources trimmed: src/openapi.rs now delegates route registration into focused OpenAPI modules, and src/enterprise.rs delegates store implementation into src/enterprise_store.rs, keeping both files below their release targets.
• Dependency hygiene refreshed: Cargo and admin-console package locks carry the latest allowed patch/minor updates while major-only upgrades remain intentionally deferred.
• Safe Clippy pedantic cleanup: mechanical pedantic findings such as redundant closures, uninlined format args, literal readability, and clone/copy/default access issues were addressed without adopting readability-hostile or policy-heavy lints.

Documentation

• README, status, roadmap, Getting Started, release facts, website metadata, OpenAPI, Helm, OTLP, SDK package metadata, and generated changelog pages now point at the v1.0.29 release surface.

v1.0.28

2026-05-31

Changed

• server_control_plane module extracted: the backup-record scanning helpers, BackupStatusSnapshot, ControlPlaneClusterSnapshot/ReplicaSnapshot, ControlPlanePostureSnapshot + its gather/ha_mode_payload impl, the control_plane_* and failover_drill_* free functions, and the inherent impl block on crate::support::FailoverDrillRecord (not_run / evaluate) now live in src/server_control_plane.rs (~450 lines). AppState widens pub(crate) visibility for the three fields the new module reads (checkpoints, last_failover_drill, support_store).
• server_alerts module extracted: the AlertProcessPivot data shape and the alert↔process pivot helpers (normalized_process_token, host_matches_local, extract_alert_process_names, alert_process_matches_name, resolve_alert_process_pivots, the platform-conditional live_alert_process_catalog, remote_alert_process_catalog, assemble_alert_process_catalog, alert_process_resolution) now live in src/server_alerts.rs (~260 lines). No behaviour changes; the same 1799 lib + integration tests still pass.
• server_av module extracted: the local open-source AV signature loader — preset-directory + extension constants, local_av_signature_files, local_av_signature_presets_json, and load_local_open_source_av_signatures — moved out of server.rs into src/server_av.rs (~100 lines). Behaviour identical (operator-gated, no auto-download).
• server_evidence module extracted: the entire evidence-freshness and operational-snapshot persistence cluster now lives in src/server_evidence.rs (~470 lines, 17 helpers): the EVIDENCE_FRESHNESS_WINDOW_SECS window, evidence_freshness + with_evidence_freshness + payload_evidence_freshness + evidence_freshness_check, the snapshot persistence helpers (persist_operational_snapshot, list_operational_snapshots, verify_operational_snapshot, snapshot_entry_from_path, safe_snapshot_lookup_path, payload_with_snapshot), the policy and prune helpers (build_snapshot_policy_payload, prune_operational_snapshots), and the shared support helpers (operational_snapshot_kind, storage_root_path, short_digest, evidence_request_id, evidence_environment_id). server_secrets updated to import the snapshot helpers from the new location. AppState widens pub(crate) on the two fields the new module reads (config_path, local_host_info).
• server.rs decomposition progress: monolith size now ~33,130 lines, down from 34,330 at the start of this round (−1,200). Extracted submodule count is 16 (server_agents, server_alerts, server_auth, server_av, server_cluster, server_collectors, server_control_plane, server_evidence, server_feeds, server_fleet, server_metrics, server_ml, server_response, server_routing, server_secrets, server_static).

v1.0.27

2026-05-28 — Trust boundaries and release verification stabilization

Security

• Trust-boundary hardening: quarantine now rejects server-side path capture without uploaded content, tenant-bound route reads respect scoped identities, enrollment-token issuance and default TTL handling are stricter, signed-update trust verification stays explicit in test and runtime flows, audit checkpoints keep their signing guarantees, and EDR blocking rules now enforce exact allowlist intent instead of broader matches.

Added

• Deployment trust report: /api/release/deployment-trust-report now exports a structured customer artifact that bundles release acceptance, SBOM/provenance, backup and failover freshness, collector health, and smoke posture into one proof object. The Operator Launchpad and fleet/update surfaces now expose that report path in the console.
• Product identity gate: scripts/check_product_identity.py is now wired into CI and release workflows so product metadata, docs, and admin-console branding cannot drift silently.

Changed

• Release acceptance stabilization: scripts/release_acceptance.sh now treats ID-scoped hardening routes as route-wiring checks instead of unconditional success paths, and the live detection-quality smoke waits long enough for the authenticated connect transition under full release load.
• Deterministic update-signing tests: the server test harness seeds a local signing key and trusted signer for remote update flows, making publish/deploy/download verification stable under integration and smoke runs.

Documentation

• README, status, roadmap, release-acceptance, OpenAPI metadata, Helm, OTLP, SDK package metadata, website version surfaces, and generated changelog pages now point at the v1.0.27 release surface.

v1.0.26

2026-05-22 — Product hardening and release proof

Security

• Failed-auth request bucketing: authenticated, agent, and cluster API failures now record both the original IP-wide backoff bucket and a hashed presented-token bucket. Rotating bearer tokens still trip the IP-wide exponential lockout, while repeated attempts with one leaked token become visible without storing raw credentials.
• Lockout audit instrumentation: failed-auth lockout audit writes now use labeled tracked_lock callsites, so operators can see whether abuse-pressure audit paths contribute to global state contention.

Added

• Lock-label budget drop metric: /api/metrics now emits wardex_metrics_dropped_total{family="wardex_state_lock_labeled",reason="label_limit"} when the per-label lock registry is saturated, keeping observability cardinality bounded and auditable.
• Operator smoke target: make smoke now runs the core Rust checks plus admin-console lint and Vitest sweeps as one documented local release gate.
• Detection explain contract guard: contract parity now requires /api/detection/explain across runtime, OpenAPI/docs, and generated SDK endpoint inventories.

Changed

• Feature-flag registry concurrency: runtime feature flags now use RwLock<HashMap<...>>, allowing read-heavy request paths to evaluate flags concurrently while preserving existing write semantics for toggles, rollouts, and kill switches.
• Google Workspace collector form reuse: the admin console now drives Workspace collector save/validate state through the shared useCollectorForm hook, aligning it with the other cloud, identity, and SaaS collector lanes.
• Live Monitor continuity: the console remembers the last selected alert in session storage and restores the alert drawer when the route is clean, preserving analyst context across refreshes without requiring a query param.
• Failed-auth audit pivot: Settings adds a one-click Failed Auth audit filter so operators can jump directly to lockout evidence.

Documentation

• README, status, roadmap, website version badges, and generated changelog pages now point at the v1.0.26 release surface.

v1.0.25

2026-05-22

Added

• Label-aware lock metrics (wardex_state_lock_labeled_*): every per-request tracked_lock site now emits acquisitions_total, wait_ns_total, slow_waits_total, max_wait_ns, and mean_wait_ms keyed by a call-site label, so we can attribute contention to specific handlers instead of inferring it from one aggregate counter.
• Failed-auth observability series (wardex_failed_auth_*): seven new Prometheus series — failures_total, lockouts_triggered_total, lockout_breach_attempts_total, resets_total, exempt_skips_total, active_lockouts, tracked_entries — surface the post-v1.0.24 lockout tracker for dashboards and alerts.
• End-to-end failed-auth lockout test (tests/failed_auth_lockout.rs): drives the tracker through threshold, verifies an /api/metrics GET reflects the expected counters, then asserts the clear path bumps resets_total and zeroes active_lockouts. Backed by new #[doc(hidden)] pub test helpers in src/server_auth.rs.
• mockWebSocket Playwright helper (admin-console/e2e/support/mockApi.js): wraps page.routeWebSocket so future live-stream specs can script /ws/events traffic without a real backend.
• CONTRIBUTING.md — Testing Patterns section: documents the three idioms we now use for process-global atomics under cargo test's parallel runner (unique labels + label_snapshot() for exact equality, >= N for unlabeled deltas, per-binary integration tests for fresh-process equality) and the loopback-exempt gotcha for IP-keyed trackers.

Changed

• Hot-path locks migrated to tracked_lock: authenticate_request_bearer, authenticate_request_session, respond_api_audit, and is_feature_enabled now go through crate::state_lock::tracked_lock, so request-path contention shows up in the labeled metrics rather than the unlabeled fallback.
• server_metrics module extracted: Prometheus formatting helpers (prom_escape_label, render_labeled_lock_metrics, render_failed_auth_metrics) moved out of src/server.rs into a dedicated src/server_metrics.rs (~190 lines), with two focused unit tests. The orchestrator stays in server.rs to avoid widening AppState field visibility.
• useCollectorForm hook in admin-console: collapses the six near-identical save/validate state triplets (AWS CloudTrail, Azure Activity, GCP Audit, Okta, Microsoft Entra, Microsoft 365) on Settings.jsx into a single hook that owns the draft/saving/validationResult triplet and the save + validate control flow. ~150 LOC out of Settings.jsx with no behaviour change.

Repo hygiene

• .gitignore sweep for release-day CLI scratch dumps (runs*.json, jobs*.json, release_*.json, out.txt, etc.) so future release rehearsals do not leave stragglers in git status.

v1.0.24

2026-05-21

Security

• Failed-auth lockout with exponential backoff: handle_api now tracks failed authentications per source IP and serves an HTTP 429 with Retry-After once a threshold is crossed. The lockout window doubles on each subsequent breach (30s → 60s → … capped at 1h), the bookkeeping table is bounded to 1024 entries with a 60s sweep, and loopback addresses (127.x, ::1, empty, "unknown") are exempted so local tooling and cluster peers stay unaffected. Each lockout is recorded in the audit log as POST /api/_failed_auth. Successful auth from a previously-failing IP clears the counter.
• Constant-time agent token comparison: the inline byte-loop that compared the configured WARDEX_AGENT_TOKEN against the inbound header was replaced with the existing secure_token_eq helper so all three privileged token paths (agent / cluster / user) share one constant-time implementation. New unit test pins the contract.
• Post-quantum key zeroization: MlDsaKeyPair and LamportPrivateKey now implement Drop and zeroize their secret material on the way out (zeroize is a direct dependency rather than transitive). The ML-DSA seed and every Lamport (zero,one) pair are wiped before deallocation, so a stale heap page cannot leak signing keys after a key rotation.

Fixed

• Admin-console nav-race in Infrastructure.jsx and HelpDocs.jsx: both components had a useEffect that wrote search params without checking the current route. If the user navigated away while the effect was scheduled, the write resolved against the component's own pathname and clobbered the new URL. Added the location.pathname === '/<route>' guard that we shipped earlier for ThreatDetection.jsx.
• Flaky Settings.test.jsx ("saves SIEM, collector and secrets setup flows from the integrations tab"): cross-block element lookups (Save/Validate buttons and form inputs in the Integrations tab) were synchronous getByRole/getByLabelText calls that raced with the re-render triggered by the previous block's save/validate response. Converted the boundary lookups to findBy* so each block waits for the prior async response to settle. 5/5 deterministic locally.

Added

• scripts/check_nav_race_guard.py (wired into CI contract-parity job): scans every admin-console component for useEffect blocks that call setSearchParams without a location.pathname guard or an explicit // nav-race-ok allowlist marker. Fails the build with file:line pointers when a regression lands. Codifies the nav-race pattern so the audit holds.

v1.0.23

2026-05-20

Changed

• Real ML triage engine: replaces the placeholder ONNX heuristic with a genuine multiclass gradient-boosted classifier (GradientBoostedClassifier) trained at startup via real gradient boosting — regression trees fitted to softmax cross-entropy gradients with XGBoost-style split gain. GradientBoostEngine is the primary triage backend; the Random Forest runs as the shadow/fallback backend. Engine types renamed OnnxEngine→GradientBoostEngine and StubEngine→RandomForestEngine.
• Real post-quantum signatures: quantum.rs ML-DSA-65 now produces genuine FIPS 204 signatures via the pure-Rust ml-dsa crate, replacing the hash-based simulation. Verification uses only the public key, as a real signature scheme requires.
• TLS enabled by default: the tls Cargo feature is now part of default, so release binaries can make outbound HTTPS calls (threat feeds, AWS/Azure/GCP collectors, OIDC discovery, webhooks). Previously only the container build enabled it.
• Cluster peer-RPC encryption posture: new cluster.require_tls flag (default false for back-compat) upgrades bare host:port peer addresses to https:// and rejects explicit http:// peer URLs at config validation. When off, a one-shot startup warning surfaces every plaintext peer so the gap is visible on every boot. Production HA deployments should set cluster.require_tls = true.
• Incremental server.rs decomposition (-253 lines across three PRs): the route-dispatch chain now delegates ML, feed-ingestion, and cluster-RPC handlers to dedicated server_ml.rs, server_feeds.rs, and server_cluster.rs modules. Visibility opened up for AppState plus the fields needed by extracted handlers (pub(crate)), so subsequent domain extractions need no further plumbing.
• TypeScript migration — first slices: safeStorage.js → safeStorage.ts (typed utility) and api.js → api.ts (typed wrapper layer: generic request<T = unknown>, typed WardexRequestOptions/WardexApiError, ~220 endpoint parameter annotations, 11 endpoints typed end-to-end via @wardex/sdk SDK contracts).

Added

• POST /api/feeds/{id}/fetch — live HTTPS fetch + ingest for a configured feed source.
• /api/feeds/* family (7 routes) now in openapi.rs and docs/openapi.yaml; contract-parity reports 254 documented operations (was 247).

Fixed

• GCP collector authentication: the service-account JWT is now signed with real RS256 (via jsonwebtoken) instead of a placeholder signature, so Cloud Audit Log polling authenticates against Google.
• Threat-feed ingestion: added a live HTTP fetch path and a background poll loop; corrected the default feed URLs and added format-specific parsers for Abuse.ch MalwareBazaar (CSV), URLhaus (json_online), and Feodo Tracker (C2 IP blocklist). The bundled feeds now ingest real indicators out of the box.
• Accessibility / Lighthouse CI: the site-quality job installed tooling with npm install --ignore-scripts, which skipped puppeteer's browser download so pa11y could not launch a browser. Added an explicit npm rebuild puppeteer step.
• Flaky investigation-hunt.spec.js ("queue hunt pivot"): the loose getByRole('button', { name: 'Hunt' }) locator matched a navigation button whose description contains the word *hunt* and clicked it before the queue row's real Hunt button rendered. Fixed with exact: true.
• Flaky UEBADashboard.test.jsx ("prioritizes the current UEBA focus"): replaced synchronous getByText reads (which raced against the next React update) with findByText. Deterministic 10/10 locally.

Removed

• Dead auth.rs::AuthManager and its TokenResponse / url_encode_component helpers and the nine AuthManager-only tests. The struct was a legacy parallel auth implementation never referenced outside its own tests; the real OIDC flow runs through OidcProvider in oidc.rs.

Dependency bumps

• tower-http 0.6.10 → 0.6.11 (patch).
• sigstore/cosign-installer v4.1.1 → v4.1.2 (SHA-pinned).
• benchmark-action/github-action-benchmark v1.22.0 → v1.22.1 (SHA-pinned).
• Adds ml-dsa = "0.1" for FIPS 204 signatures (pure Rust, no native dependencies).

v1.0.22

2026-05-17 — CI repair and release cleanup

Changed

• CI stability repair: removes duplicate source-copy artifacts that were tripping both workspace hygiene and the frontend dead-code audit, and hardens the hygiene script to ignore tracked files that no longer exist in the workspace.
• Managed release smoke upkeep: refreshes Playwright selectors, route targeting, and long-running release-proof handling so the managed release acceptance suite matches the current console labels and flows.
• Panic-policy compliance: replaces the remaining production panic paths in attestation nonce generation, enrollment token generation, OIDC random material, and fallback response construction so the zero-panic baseline stays green.
• Release metadata alignment: bumps Rust, admin-console, Python SDK, TypeScript SDK, Helm, OTLP, OpenAPI, installation, reproducibility, website, and test fixtures to the v1.0.22 CI-repair baseline.

v1.0.21

2026-05-17 — workflow continuity and documentation refresh

Added

• Operator workflow depth: Search Palette now promotes route-aware actions, Dashboard adds alert-pressure forecasting, Threat Detection surfaces promotion confidence gates, and SOC Workbench adds case-journal plus related-case continuity.
• Integration and recovery posture: Operator Trust now surfaces Splunk HEC validation and ServiceNow destination posture, while Help & Docs exposes replication region, lag, and health evidence.
• Durable playbook approvals: playbook approval steps now pause in stored execution state and resume through /api/playbooks/resume, with matching OpenAPI, Python SDK, and TypeScript SDK coverage.

Changed

• Documentation and website refresh: updates the GitHub README, docs index, website resources page, API reference, and fresh documentation screenshots so the public release surface matches the shipped product.
• Release metadata alignment: bumps Rust, admin-console, Python SDK, TypeScript SDK, Helm, OTLP, OpenAPI, installation, reproducibility, website, and test fixtures to the v1.0.21 workflow-continuity baseline.

v1.0.20

2026-05-16 — priority lanes and API hardening

Added

• Workspace priority lanes: Dashboard, Fleet, Infrastructure, NDR, UEBA, and SOC surfaces now compute the most pressured queue, identify the lead finding, and route operators directly into the matching priority lane.
• Operator focus narratives: dashboard lead alerts, fleet drift/offline pressure, infrastructure remediation and asset exposure, network anomalies, and entity-risk escalations now surface concise context before operators pivot into detail.

Changed

• Release metadata alignment: bumps Rust, admin-console, Python SDK, TypeScript SDK, Helm, OTLP, OpenAPI, installation, reproducibility, website, and test fixtures to the v1.0.20 priority-lane baseline.
• Runtime and dependency hardening: carries the Node runtime and npm install hardening plus dependency-refresh cleanup into the release baseline.

Security

• Authenticated API default: backend API routes now default to authenticated access unless explicitly classified as public, agent, or cluster traffic, keeping public exposure on a narrow allowlist for health, metrics, OpenAPI, session bootstrap, and SSO handshakes.

v1.0.18

2026-05-13 — intelligence gates and release cleanup

Added

• Operator-safe triage intelligence: enriches managed ML triage results with calibrated confidence, quality gates, recommended operator journey, evidence mode, and human-approval requirements while keeping response execution approval-gated.
• Assistant answer quality gates: adds citation, confidence, and execution-boundary checks to analyst assistant responses and renders those checks in the assistant workspace.
• Notification outbox trail: adds deduplicated outbox records for notification dispatch attempts so alert delivery state can become operator-visible evidence.
• Canonical operator journeys: adds Launchpad golden-path coverage for critical alert response, collector-to-detection trust, release acceptance, and assistant-to-evidence workflows.

Changed

• Evidence-mode clarity: Launchpad now summarizes proof freshness by evidence mode so operators can distinguish live runtime proof from pending or persisted evidence.
• macOS memory indicators: replaces the basic vmmap placeholder with RWX and anonymous-executable region parsing for stronger local memory-forensics signals.
• Release metadata alignment: bumps Rust, admin-console, Python SDK, TypeScript SDK, Helm, OTLP, OpenAPI, website, and test fixtures to the v1.0.18 intelligence-gates baseline.

v1.0.17

2026-05-12 — operator continuity and evidence closure

Added

• Shift continuity workspace: adds exportable handoff notes that carry queue pressure, stale evidence, release blockers, fleet watch items, and generated operator tasks into the next shift.
• Incident timeline builder: assembles alert, process/thread, timeline replay, evidence, and report handoff signals into a Launchpad timeline draft with a downloadable artifact.
• Collector onboarding center and fleet risk heatmap: groups cloud, identity, SaaS, endpoint, and syslog telemetry lanes while surfacing offline, stale heartbeat, version drift, and active-detection fleet risk.
• Release acceptance and visual gate: adds a one-click release acceptance export plus a Playwright screenshot artifact gate for the Launchpad continuity board.
• Role home and safe assistant surfaces: adds role-specific Launchpad home cards and explicit retrieval-only/citation/execution boundaries for the Operator Assistant.

Changed

• Command palette continuity: adds direct pivots for handoff, timeline builder, collector onboarding, release acceptance, fleet heatmap, response playbook simulation, visual gate, and safe assistant cards.
• Release metadata alignment: bumps Rust, admin-console, Python SDK, TypeScript SDK, Helm, OTLP, OpenAPI, website, and test fixtures to the v1.0.17 operator-continuity baseline.

v1.0.16

2026-05-11 — operator execution board

Added

• Persistent Connect Agent drawer: gives the Fleet install-bundle and remote-enrollment workflow a stable command-palette route and URL hash so operators can jump directly into agent connection from Launchpad, Fleet, or search.
• Launchpad execution board: adds morning brief, guided incident path, fleet health drilldown, evidence freshness, operator task queue, response simulator, release gate automation, and demo-scenario rollups on top of existing live signals.
• Context-aware command palette: surfaces route-specific Launchpad, Fleet, SOC, release, and detection actions ahead of the broader command catalog.

Changed

• Fleet enrollment focus: adds a URL-backed Connect Agent update panel for one-use enrollment bundles, manual installs, and remote install workflows.
• Release metadata alignment: bumps Rust, admin-console, Python SDK, TypeScript SDK, Helm, OTLP, OpenAPI, website, and test fixtures to the v1.0.16 operator-execution baseline.

v1.0.15

2026-05-11 — operator onboarding and workflow depth

Added

• First-agent onboarding cockpit: adds a guided connection path that separates the admin API token from one-use agent enrollment tokens, generates OS-specific install commands, and keeps server readiness visible during setup.
• Operator command palette depth: adds connect-agent, SOC queue, process workbench, response-readiness, and deployment-confidence quick actions with stronger command grouping.
• SOC workflow polish: adds queue explainability and confidence context, response-readiness summaries with approval/rollback/verification state, process workbench render caps, and a compact SOC cockpit strip.

Changed

• Launchpad deployment confidence: adds a ship-readiness matrix across SDK/API contract, signing/provenance, container parity, backup/failover, data quality, scale gates, and install-plan coverage.
• Release metadata alignment: bumps Rust, admin-console, Python SDK, TypeScript SDK, Helm, OTLP, OpenAPI, website, and test fixtures to the v1.0.15 operator-workflow baseline.

v1.0.14

2026-05-11 — Claude workbench layout

Changed

• Claude design template integration: wires the root design/app workbench template into the live admin console shell with a compact rail, dense topbar, scoped chips, dark default surface, and tighter card/table treatment.
• SOC process workbench hardening: updates process findings, live-process, deep-chain, and timeline layouts to better match the Claude investigation template while keeping existing route and API behavior intact.
• Release metadata alignment: bumps Rust, admin-console, Python SDK, TypeScript SDK, Helm, OTLP, OpenAPI, website, and test fixtures to the v1.0.14 Claude workbench layout baseline.

v1.0.13

2026-05-11 — detection trust and false-positive control

Added

• Detection Trust layer: correlates analyst feedback, false-positive signals, suppressions, replay evidence, rule lifecycle, source reliability, enrichment quality, ATT&CK impact, alert-volume trend, and campaign context into per-rule trust scores.
• Draft-only tuning APIs: adds Detection Trust overview, rule detail, tuning draft queue, draft creation, impact preview, and approval-intent endpoints across REST/OpenAPI, Python SDK, TypeScript SDK, and release acceptance.
• Operator-visible trust UI: Threat Detection now shows noisy rules, trusted rules, stale suppressions, confidence drivers, and draft impact previews; Alert Drawer explains normalized feedback states and how feedback affects trust.

Changed

• Feedback normalization: detection and alert feedback normalize to valid, false_positive, benign_true_positive, needs_more_data, or duplicate before scoring.
• Detection Lab trust deltas: validation payloads now include expected confidence and false-positive impact from Detection Trust.
• Release metadata alignment: bumps Rust, admin-console, Python SDK, TypeScript SDK, Helm, OTLP, OpenAPI, installation, reproducibility, website, and test surfaces to the v1.0.13 detection-trust baseline.

Guardrail

• No automatic weakening: Wardex can draft suppressions, threshold reviews, weight adjustments, stale-suppression reviews, noisy-rule reviews, and promotion blockers, but production tuning remains operator-applied only.

v1.0.12

2026-05-11 — operator trust and usability

Added

• Operator trust workspaces: adds grouped navigation, role workspace anchors, Detection Lab, Response Safety, Integrations, Operations Health, and Malware transparency routes so every major trust workflow is reachable from the console and command palette.
• Additive trust APIs: publishes alert feedback summaries, evidence-chain retrieval, detection validation runs, response preview and verification, connector marketplace summaries, operations health snapshots, malware verdict explanations, and scan diff retrieval through REST/OpenAPI and both SDKs.
• Malware and response transparency: expands malware verdicts with signature-source, YARA/ClamAV/hash, rootkit, packing, skipped-check, confidence, and response guidance, while response actions now expose preview, blast-radius, approval, rollback, and verification evidence before execution.

Changed

• False-positive control: alert feedback now records outcome states and feeds visible tuning suggestions without automatically weakening detections.
• Deployment trust: operations and connector views summarize freshness, lag, health, sample events, permissions, impact, and support snapshots in operator-readable cards.
• Release metadata alignment: bumps Rust, admin-console, Python SDK, TypeScript SDK, Helm, OTLP, OpenAPI, installation, reproducibility, website, and test surfaces to the v1.0.12 release baseline.

v1.0.11

2026-05-11 — CI and release-trust hotfix

Fixed

• Release preflight gate: adds a release workflow preflight job so signed release packaging waits for Rust formatting, Clippy, admin-console linting, admin-console formatting, admin-console build, and release-doc validation.
• CI drift cleanup: fixes the Clippy unnecessary_lazy_evaluations failure in snapshot evidence rendering and applies the existing Prettier rules to the Operator Launchpad and process-thread drawer.
• Release metadata alignment: bumps Rust, admin-console, Python SDK, TypeScript SDK, Helm, OTLP, OpenAPI, installation, reproducibility, website, and test surfaces to the v1.0.11 hotfix baseline.

v1.0.10

2026-05-10 — detection response and signed-release polish

Added

• Malware, virus, trojan, and rootkit scanning workspace: adds dashboard and infrastructure surfaces for on-demand scans, whole-system/folder/file scan scopes, open-source signature presets, and operator-wired signature source combinations.
• Alarm response actions: expands alarm handling with approval-gated response choices for process, artifact, identity, network, malware, resource-abuse, and thread signals, including traffic containment and malware scan pivots.
• Thread analysis pullout: adds source-aware per-thread analysis with signal classification, selected-thread evidence, false-positive guidance, and response actions inside the process investigation drawer.

Changed

• Detection intelligence hardening: strengthens alert analysis, source/IP context handling, malware/rootkit/trojan/virus verdicting, and false-positive reduction guidance across supported operating systems.
• Admin-console layout polish: reduces crowded nested boxes, fixes stretched/alignment-heavy panels, preserves Live Monitor scroll position during refresh, and replaces the thread popout table with readable stacked thread cards.
• Release metadata alignment: bumps Rust, admin-console, Python SDK, TypeScript SDK, Helm, OTLP, OpenAPI, installation, reproducibility, website, and test surfaces to the v1.0.10 release baseline.

v1.0.9

2026-05-10 — evidence freshness and signed-build readiness

Added

• Evidence freshness contract: adds wardex.evidence_freshness.v1 metadata to production assurance and release verification payloads, recording source, mode, environment ID, run/request IDs, collection and expiry timestamps, artifact digest, criticality, status, and stale/unknown reasons.
• Snapshot freshness persistence: operational snapshot envelopes now retain evidence freshness metadata beside the existing payload digest so support and release reviews can verify whether saved evidence was fresh, stale, or incomplete when captured.
• Operator Launchpad proof badges: /admin/launchpad now renders fresh/stale/unknown proof state for release verification signals, production assurance rows, and persisted snapshots.

Changed

• Release readiness gates: clean release cut and release verification center readiness now treat missing critical local proof, including checksum rows, SBOM, Gatekeeper evidence, provenance, container parity, observability, and synthetic-console evidence, as a blocker instead of a soft ready state.
• Release metadata alignment: bumps Rust, admin-console, Python SDK, TypeScript SDK, Helm, OTLP, OpenAPI, installation, reproducibility, and website surfaces to the v1.0.9 release baseline.

v1.0.8

2026-05-09 — release verification and deployment confidence

Added

• v1.0.8 release readiness tranche: adds clean release cut readiness, container release parity, release verification center, self-hosted deployment wizard, data-quality dashboard, performance/scale baseline, failover execution, secrets rotation operations, operator task automation, and detection validation pack endpoints with persisted operational snapshots.
• Executable release gates: deepens the verification payloads with artifact verification rows, install plans, data-quality SLOs, launchpad performance gates, failover drill execution targets, secrets-rotation dry-runs, task action blueprints, and executable validation-pack inventory checks.
• Launchpad release verification lane: surfaces the new readiness tranche in /admin/launchpad with clean-cut, container, deployment, data quality, scale, failover, secret rotation, task automation, and validation-pack signals.
• Contract and SDK parity: extends runtime OpenAPI, docs/openapi.yaml, RBAC, Python SDK, TypeScript SDK, contract-parity requirements, and release-acceptance live smoke coverage for the new endpoints.

v1.0.7

2026-05-08 — production assurance and signed-build readiness

Added

• Production assurance surfaces: adds release provenance/SBOM evidence, upgrade rehearsal, synthetic console monitoring, incident timeline replay, detection trust scoring, fleet drift compliance, operator work queues, retention forecasting, adversarial validation, and support bundle diffing as authenticated product endpoints with persisted operational snapshots.
• Operator Launchpad assurance lane: surfaces the new production assurance signals alongside release doctor, workflow preflight, stream readiness, SDK parity, operational snapshot evidence, and support bundle exports.
• SDK/release-gate parity: publishes the new assurance routes through runtime OpenAPI, docs/openapi.yaml, RBAC, Python SDK, TypeScript SDK, contract-parity checks, and release-acceptance endpoint smoke coverage.

Changed

• Release metadata alignment: bumps Rust, admin-console, Python SDK, TypeScript SDK, Helm, OTLP, OpenAPI, installation, reproducibility, and website surfaces to the v1.0.7 release baseline.

v1.0.6

2026-05-08 — resilience proof APIs and release observability gates

Added

• Release observability gates: adds /api/release/observability-gates, Prometheus stream queue/drop metrics, and release-doctor integration for metrics, stream readiness, snapshot verification, and contract parity checks.
• Workflow preflight proof: adds /api/workflows/preflight and /api/content/rules/{id}/preflight, with the admin console calling rule preflight before canary/active promotion actions.
• Cursor pagination contracts: adds cursor-page APIs for alerts, retained events, and audit logs while preserving existing offset-compatible endpoints.
• Tenant/thread/snapshot evidence: adds tenant isolation proof, runtime thread-baseline proof, and snapshot retention/redaction policy plus dry-run pruning controls.

Fixed

• Admin-console resilience: hardens GET retry/timeout behavior, structured error parsing, safe browser storage usage, and drawer focus/body-scroll restoration.
• Release documentation drift: refreshes README, status, roadmap, reproducibility, website, Helm, OpenAPI, SDK, OTLP, admin-console, and installation surfaces for the v1.0.6 release baseline and removes stale v0.56.2 install commands.

v1.0.5

2026-05-06 — macOS CI signing secret repair and release validation

Fixed

• macOS release CI signing secrets: adds a non-printing GitHub secret updater for the locally exported Developer ID .p12, supports path-based local .p12 signing material, imports root certificate-chain files as context, and fails fast when a public .cer is accidentally used as a signing identity.
• Developer ID export validation: verifies the exported Developer ID Application identity can sign a macOS binary without GUI keychain prompts, giving CI a known-good PKCS#12 source for signed and notarized macOS archives.
• License metadata drift: aligns SDK manifests, OpenAPI metadata, Linux package workflow metadata, and the pricing page with the AGPL-3.0-only plus commercial dual-license posture introduced in v1.0.0.
• Release documentation drift: refreshes README, status, roadmap, reproducibility, website, Helm, OpenAPI, SDK, OTLP, and admin-console version surfaces for the v1.0.5 release baseline.

v1.0.4

2026-05-06: macOS PKCS#12 signing import hardening

Fixed

• macOS release CI signing: imports the Developer ID .p12 as a full PKCS#12 identity with explicit codesign access, prints imported identities before signing, and keeps key-partition setup from hiding useful diagnostics when GitHub runner keychain ACLs behave differently across macOS images.

v1.0.3

2026-05-06: release CI and Live Monitor regression hardening

Fixed

• macOS release CI signing: preserves the runner keychain search list and resolves the imported Developer ID Application identity before codesign, hardening the notarized macOS artifact path for tagged GitHub releases.
• Live Monitor process analysis: adds a focused Chromium Playwright regression covering token login, process refresh scroll preservation, process-detail fallback, and alert-analysis failover after the process-analysis failures seen in v1.0.2 validation.

v1.0.2

2026-05-05: macOS Gatekeeper release trust

Fixed

• macOS Gatekeeper trust: tagged macOS release jobs now Developer ID sign and Apple-notarize the wardex binary before packaging, publish Gatekeeper verification evidence, and block unsigned macOS archives when signing credentials are missing.

v1.0.1

2026-05-05: CI hardening and patch fixes

Fixed

• cargo deny: added RUSTSEC-2023-0071 (rsa Marvin Attack via jsonwebtoken) to the advisory ignore list; no patched upstream exists yet.
• Windows clippy: refactored command_override_candidates in src/remediation.rs to use a single mut candidates binding with a #[cfg(windows)] extend block, eliminating the unreachable-code and out-of-scope-variable errors under -D warnings.
• Non-unix clippy: renamed path to _path in harden_private_file_permissions (src/server.rs) to suppress the unused-variable warning on Windows/non-unix targets.
• Integration test — auth session: auth_session_accepts_sso_session_token_and_logout_revokes_it now reads the server's seal key from disk and passes it to SessionStore::with_persistence_key, matching the HMAC signature the running server uses.
• Integration test — 404 vs 401: unknown_api_endpoint_returns_404 now sends an auth token; authenticated-only routes return 401 before 404 when no credentials are provided.
• Integration test — process candidates: alerts_endpoint_returns_enriched_process_fields_for_seeded_alerts assertions on process_candidates are now conditional on process_resolution, since live processes like python3 may genuinely be running on CI runners.
• knip dead exports: removed export from connectorStatus (src/components/command/helpers.js) and SETTINGS_TAB_IDS (src/components/settings/helpers.js); both are used locally within their modules.
• knip config: removed playwright from ignoreDependencies in knip.json; knip now correctly detects it as a direct Playwright dependency.

v1.0.0

GA: AGPL-3.0 Dual-License, Stable Modules, HA Runbook, API Stability Pledge

Changed

• License: Switched from BUSL-1.1 to AGPL-3.0-only with a commercial dual-license option (see LICENSE.COMMERCIAL). Prior "Change Date" conversion to Apache 2.0 is no longer applicable.
• Experimental feature flags removed: experimental-ml, experimental-llm, experimental-quantum, and experimental-proof Cargo features no longer exist. The corresponding modules (ml_engine, llm_analyst, quantum_key_rotation, zk_proof_engine) are now always compiled. See docs/UPGRADE_0_56_TO_1_0.md for migration instructions.

Added

• API stability pledge — a 12-month backward-compatibility guarantee for all v1.0 HTTP endpoints, CLI flags, config keys, and SDK public surface. Breaking changes require a major version bump. Documented in docs/RELEASE_ACCEPTANCE.md.
• HA failover runbook — active/passive HA with RPO ≤ 15 min / RTO ≤ 30 min targets. Step-by-step planned and unplanned failover procedures, Kubernetes guidance, and failback. See docs/runbooks/HA_FAILOVER.md.
• Upgrade guide (0.x → 1.0) — covers license review, Cargo.toml feature-flag removal, schema migration, ClickHouse config section, SDK version bump, Helm values review, and rollback. See docs/UPGRADE_0_56_TO_1_0.md.
• Compatibility matrix — MSRV 1.88.0, platform support tiers, browser support, SDK runtimes, and 12-month support window. See docs/COMPATIBILITY.md.
• Deprecation policy — minimum sunset windows (1 minor release) for HTTP endpoints, CLI flags, config keys, and SDK symbols. Removal only in next major version. See docs/DEPRECATION_POLICY.md.
• Compliance posture document — explicit FIPS 140-2/3, Common Criteria, SOC 2, ISO 27001, GDPR, and supply-chain posture statements for v1.0. See docs/COMPLIANCE.md.
• Helm NetworkPolicy template — deploy/helm/wardex/templates/networkpolicy.yaml, enabled by default, with configurable ingress/egress rules and optional ClickHouse egress toggle.
• [clickhouse] server config section — ClickHouse is now the recommended production event backend; configurable via clickhouse.url, clickhouse.database, and clickhouse.max_pool_size.
• LICENSE.COMMERCIAL — explicit commercial license terms for organisations requiring proprietary use without AGPL-3.0 copyleft.

Quality

• Clippy clean across all targets — collapsed redundant if let guards in the OIDC JWKS validator (validate_jwk_for_id_token) and the OIDC test harness token-body branch, removed a needless borrow in build_team_load_overview for incident slices, and re-ran cargo clippy --all-targets --no-deps -- -D warnings to keep the release lint-clean.
• Live e2e re-verification — admin-console Vitest unit suites (274 tests), full Rust library tests (1480 tests), cargo build --release, contract-parity, release-docs validators, and Playwright e2e on chromium and webkit (21 tests each) were re-run against the bumped release.
• Release metadata aligned on v0.56.2 — Rust, admin-console, Python SDK, TypeScript SDK, Helm, OTLP, OpenAPI, installation/reproducibility docs, and website release surfaces now point to the same release baseline.

v0.56.1

Route Auth & Signed Update Trust Hardening

Added

• Operational readiness drill timeline — Help & Docs Production Readiness now renders documented recovery targets (RTO/RPO), backup and checkpoint evidence, persisted failover-drill history, pass/fail artifact checks, and exportable timeline evidence for recovery reviews.
• SOC detection review reasoning — SOC Workbench detection-review rows now carry replay deltas plus the latest analyst verdict, note, and review timestamp so shift leads can understand review pressure before pivoting into Threat Detection.

Changed

• Shared review-history contract — Rule-level replay/analyst review history now feeds both Threat Detection and SOC Workbench from the same backend derivation path, reducing cross-surface drift.
• OIDC callback hardening — the federated sign-in flow now requires a validated id_token, enforces PKCE with S256, verifies JWT signatures against provider JWKS, checks issuer/audience/expiry/nbf claims, and rejects nonce or subject mismatches before creating a console session.
• OIDC JWKS rotation hardening — ID token validation now refreshes provider JWKS before selecting a signing key, replaces stale cached keys, rejects revoked cached keys, requires iat, checks multi-audience azp, and refuses JWKS keys not marked for signature verification.
• Persisted session integrity — file-backed console sessions now load from a signed envelope, reject tampered payloads on restart, keep backward compatibility for older unsigned session files, and seal runtime state with a persistent local session key or explicit WARDEX_SESSION_KEY.
• Default-deny API auth posture — API auth enforcement now classifies routes as public, agent-token, cluster-token, or authenticated and defaults every other /api/* route to authenticated, reducing drift from hand-maintained auth allowlists. The runtime endpoint listing now derives supplemental auth flags from the same classifier.
• OpenAPI route-auth source of truth — generated OpenAPI operations now derive security and x-wardex-auth from the runtime route classifier, the endpoint catalog reads the same classifier, and static contract parity fails when representative public, agent, or authenticated route metadata drifts.
• Signed agent update enforcement — release metadata now carries Ed25519 signatures, signer keys, payload hashes, and monotonic counters; update publish/deploy/check/download/agent install paths enforce trusted signers, unsigned grace policy, replay counters, downgrade policy, and binary tamper checks.

Backend

• SOC workbench strengthening slices — GET /api/workbench/overview now includes team load and ownership plus connector coverage impact signals, and GET /api/cases/{id}/handoff-packet returns structured case handoff packets for analyst turnover.
• Command Center review summary — GET /api/command/summary now carries a compact detection review calendar inside the rule_tuning lane, surfacing overdue reviews, due-this-week items, replay blockers, noisy owners, and direct pivots into detection promotion views.
• Auto-progress update trust gate — canary-to-ring rollout progression now verifies the signed release artifact before assigning the next ring, rejects untrusted signer keys, and carries verified signature metadata onto generated deployments.

Frontend

• Threat Detection ownership review calendar — the detection workspace now shows overdue reviews, due-this-week rules, replay blockers, noisy owners, rule-level next-review timing, and promotion blockers derived from lifecycle and replay state.
• Command Center detection review pressure — the Detection Quality Dashboard now exposes compact review-calendar signals directly in /command, giving shift leads a fast path into the exact noisy or overdue rule.
• SOC Workbench operations expansion — the workbench now includes case handoff packets, team load and ownership, and connector coverage impact surfaces for analyst handoff and queue balancing.

Quality and verification

• 0.56.0 quality cleanup — frontend race/test failures were fixed, Rust doctest SIGKILL noise was removed by disabling no-op doctests for the monolithic lib target, persisted auth sessions now enforce owner-only permissions on Unix, and RBAC token persistence/listing now uses hashed/redacted token values.
• OIDC rotation regressions — focused Rust unit coverage now exercises rotated JWKS acceptance, revoked cached-key rejection, missing iat rejection, multi-audience azp enforcement, and non-signature JWKS key rejection.
• Update trust regressions — focused Rust coverage now exercises signed update verification, wrong-key rejection, malformed signature rejection, tampered metadata/binary rejection, unsigned strict/grace behavior, replay-counter rejection, downgrade policy, and trusted installer history metadata.
• Auto-progress trust regressions — server coverage now exercises next-ring signature metadata propagation and wrong-signer rejection during automatic rollout progression.
• CI stability — command, SOC, detection, lint, build, and integration checks were refreshed so the current 0.56.1 hardening slices land green across the local acceptance gates.

v0.56.0

Control-Plane Posture Evidence & Recovery Readiness

Backend

• Derived control-plane posture contracts — GET /api/support/readiness-evidence, GET /api/system/health/dependencies, and GET /api/backup/status now expose backup schedule, observed backups, latest backup timestamp, checkpoint counts, latest checkpoint timestamp, restore readiness, and active/passive reference status from live runtime state rather than a hard-coded HA summary.

Frontend

• Production readiness posture summary — Help & Docs now renders a structured control-plane posture section that shows durable storage, restore artifacts, and failover model checks alongside the existing readiness blockers.

Documentation and release metadata

• Control-plane tranche formalized — backlog, roadmap, status, deployment/disaster-recovery docs, OpenAPI, Helm, OTLP, SDK metadata, README, and website status/changelog surfaces are aligned on the first control-plane posture slice and the 0.56.0 release baseline.

Verification

• cd admin-console && npm exec vitest run src/__tests__/HelpDocs.test.jsx
• cargo test --test api_integration enterprise_governance_and_support_endpoints_enforce_roles -- --exact
• cd sdk/typescript && npm exec vitest run src/index.test.ts -t 'readinessEvidence|systemDeps|backupStatus'

v0.55.1

Release Guardrails, A11y Strictness & Node Baseline

Release engineering

• Checksummed release assets — The GitHub release workflow now creates and verifies a SHA256SUMS asset for every published binary/package artifact.
• Debian package smoke — Release publishing now depends on a Linux package install smoke that installs the generated .deb, verifies wardex is on PATH, and checks the help command produces output.
• Release notes by tag — Release-body extraction now selects the changelog section matching the pushed tag, so the published notes are not taken from an empty Unreleased block.

Tooling and documentation

• Node baseline aligned — .nvmrc, admin-console metadata, TypeScript SDK metadata, contributor docs, and site-quality CI now converge on Node 22 / Node >=20.19.0 to match current Vite/jsdom/undici requirements.
• Admin dependency audit clean — The admin-console lockfile now resolves PostCSS to a patched release for the moderate CSS stringify advisory.
• Release metadata refresh — Rust, admin-console, Python SDK, TypeScript SDK, Helm, OTLP, OpenAPI, runbooks, reproducibility docs, website status data, and browser fixtures now point to 0.55.1.

Backend

• Request-ID hardening — Structured request ID generation now returns a typed clock error, includes timestamp/randomness tests, and the HTTP response boundary falls back safely if the system clock is invalid.
• Request-ID consolidation — API responses now use the shared structured logging request ID helper instead of carrying a second formatting path.

Frontend

• Strict a11y smoke expansion — Playwright axe checks now treat the welcome and onboarding screens as strict by default, add Settings workspace coverage, and keep additional strict labels configurable via WARDEX_A11Y_STRICT.
• Console warning cleanup — Fleet recovery watchlists now de-duplicate stale/offline agents, and workspace tab accessibility tests use async render/wait flows that avoid React act(...) noise.
• Settings split — The Settings configuration tab is extracted into a focused component while preserving JSON, form, diff, reload, and reset-to-default workflows.

Verification

• cargo fmt --check
• cargo test --all
• npm test --prefix admin-console -- --run --coverage
• npm run build --prefix admin-console
• npm audit --prefix admin-console --audit-level=moderate
• npx playwright test e2e/a11y.spec.js --project=chromium
• scripts/validate_release_docs.py
• scripts/check_contract_parity.py
• bash scripts/validate_container_build_contract.sh

v0.55.0

Per-Lane Command APIs, Drawer Deep-Links & CI Hygiene

Backend

• Per-lane Command Center endpoint — New GET /api/command/lanes/{lane} returns a focused slice of the existing summary so drawers and dashboards can refresh a single lane without re-fetching the entire aggregate. Supported lanes: incidents, remediation, connectors, rule_tuning, release, evidence. Returns 404 for unknown lanes.
• OpenAPI + endpoint catalog — The new lane route is published in both the runtime endpoint catalog (/api/endpoints) and the static docs/openapi.yaml and Rust openapi.rs builders.

Frontend

• Drawer deep-links — Command Center drawers now sync to the URL via ?drawer=<lane> so SOC analysts can share or bookmark a specific drawer state. The drawer state survives reloads and back/forward navigation. Item-specific context (e.g. a connector or rule selected from a row) is preserved through the local component while the lane lives in the URL.
• Wider analyst entrypoints — Same /command default destination, but every action button and drawer entry now produces a copyable URL.

Continuous integration

• Workflow lint job — New .github/workflows/actionlint.yml runs actionlint (pinned via SHA-256 of the official rhysd/actionlint 1.7.12 release tarball) against every workflow change, catching action-spec regressions like the Node 20 deprecation we shipped a hotfix for in v0.54.0.
• Local validation — Confirmed clean against all existing workflows with actionlint -shellcheck= (shellcheck reports are intentionally suppressed for the workflow-spec linter).

Developer experience

• npm run e2e — New script in admin-console/package.json aliases playwright test, plus npm run e2e:ui for the interactive runner.
• iCloud-sync workaround — CONTRIBUTING.md now documents the TMPDIR=/tmp/sentinel-edge-build workaround for workspaces under ~/Library/Mobile Documents/com~apple~CloudDocs/.
• Changelog reset helper — New scripts/changelog_reset_unreleased.py converts ## [Unreleased] into a versioned section after a tag, ready for the next cycle.

Verification

• cargo test --test api_integration command_lane_endpoint_returns_per_lane_slice -- --exact
• cargo test --test api_integration command_summary_returns_lane_health -- --exact
• cargo test --test api_integration planned_connector_config_and_validation_persist -- --exact
• npm run lint --prefix admin-console
• npm test --prefix admin-console -- --run src/__tests__/App.test.jsx
• npm run build --prefix admin-console
• actionlint -shellcheck= .github/workflows/*.yml

v0.54.0

Product Command Center, Action Drawers & Connector Onboarding

Command Center

• Analyst default workspace — /command is now the analyst primary destination, bringing incidents, active cases, connector gaps, remediation approvals, noisy rules, release readiness, and compliance evidence into one routed operator surface.
• Inline action drawers — Command Center metric cards now open focused connector validation, remediation approval, rule replay, release readiness, and evidence-pack drawers so operators can act without losing the command context.
• Backend summary contract — New GET /api/command/summary aggregates lane health across incidents, cases, remediation reviews, collector readiness, rule quality, release metadata, report templates, compliance posture, and fleet gaps.

Connector and tuning workflows

• Planned connector onboarding — GitHub Audit Log, CrowdStrike Falcon, and Generic Syslog now have setup, validation, public summary, sample-event preview, collector status, OpenAPI, and console API coverage.
• Rule tuning checklist — The command surface now shows replay, suppression, and promotion readiness checks for noisy/stale rules before analysts move into the full detection workspace.

Documentation and validation

• Command Center runbook — A new operator runbook covers shift-start triage, connector validation, remediation approvals, rule tuning, release readiness, evidence packs, and escalation handoffs.
• Routed browser smoke — Playwright now covers desktop action drawers and the mobile Command Center layout across Chromium, Firefox, and WebKit.
• Release metadata aligned on v0.54.0 — Rust, admin-console, Python SDK, TypeScript SDK, Helm, OTLP, OpenAPI, install docs, reproducibility notes, and website release surfaces point to the same release baseline.

Verification

• cargo test --test api_integration command_summary_returns_lane_health -- --exact
• cargo test --test api_integration planned_connector_config_and_validation_persist -- --exact
• npm run lint --prefix admin-console
• npm test --prefix admin-console -- --run src/__tests__/App.test.jsx
• npm run build --prefix admin-console
• npx playwright test e2e/command-center.spec.js

v0.53.9

Quality Ratchets, Cross-Browser CI & Live Rollback Hardening

Quality gates

• Panic baseline 6 → 0 — Eliminated the remaining production unwrap/expect calls in analyst.rs, incident.rs, benchmark.rs, main.rs, spool.rs, and wasm_engine.rs. The scripts/panic-baseline.txt floor is now 0, blocking any new non-test panic-bearing API from landing.
• Coverage gate 56.5 → 60 — cargo tarpaulin --fail-under raised to 60.0 in CI to lock in the additional coverage gained from defensive-error rewrites.
• Cargo-mutants nightly matrix — New .github/workflows/mutation-testing.yml runs cargo mutants twice weekly across detector / policy / velocity / entropy / correlation modules with continue-on-error so escaped mutants surface without blocking releases.
• Cross-browser nightly matrix — New .github/workflows/cross-browser.yml exercises the full Playwright suite against Firefox and WebKit nightly with artifact upload on failure, complementing the per-PR Chromium runs.

Live rollback hardening

• remediation.allow_live_rollback gate — New config flag (default false). Live (dry_run = false) rollback requests are rejected with 403 and an audit-warn log unless the operator opts in.
• Typed-host confirmation — When live rollback is enabled, requests must include confirm_hostname matching the change-review's asset_id (case-insensitive); mismatches are rejected with 400. The Infrastructure console adds a "Live Rollback…" danger button that prompts the operator to type the hostname before submitting.
• remediation.execute_live_rollback_commands gate — Second config flag (default false). Accepted live rollback requests continue to record proof and command plans by default; setting this flag enables local matching-platform command execution and returns per-command execution results in the rollback proof payload.

Verification

• python3 scripts/check_panic_policy.py (reports 0)
• cargo clippy --lib -- -D warnings
• cargo test --lib (1413 passing)
• cargo test --test api_integration (212 passing, including new live_rollback_is_blocked_when_allow_live_rollback_is_disabled)
• npm run lint --prefix admin-console
• npm test --prefix admin-console -- --run (210 passing)

v0.53.8

Session Hardening, Collector Lifecycle & Release Readiness

Security and session handling

• HttpOnly console sessions — The admin console now exchanges pasted admin tokens for server-side wardex_session cookies via POST /api/auth/session, sends API requests with credentials, removes legacy wardex_token localStorage persistence, and keeps bearer-token auth available for SDKs, automation, and tests.
• Cookie-aware SDK and console clients — The TypeScript SDK now supports credentials, session inspection/exchange helpers, collector lifecycle status, and remediation change-review APIs so downstream consumers can follow the same session-safe path as the console.

Collector and remediation workflow depth

• Persisted collector lifecycle analytics — Cloud, SaaS, and identity collector status now retains validation lifecycle history, last-success/error checkpoints, retry/backoff state, freshness, failure streaks, and 24h ingestion counts directly in the shared collector contract and Settings lane cards.
• Remediation change-review ledger — Infrastructure workflows now expose a persisted change-review and recovery queue for malware verdicts and remediation candidates, including approval status, recovery status, risk, evidence, and focused review creation from the malware verdict workspace.

Demo, docs, and release confidence

• Production demo lab — Help & Docs adds a Demo Lab action backed by /api/demo/lab, reusing the first-run proof path to seed telemetry, case context, response dry-run approval, reports, and evidence metadata for realistic evaluation.
• Release-document drift guard — Release-doc validation now checks that historical implementation plans are clearly marked as archives and point to current status documents, reducing stale roadmap/product-claim drift.
• Website and release metadata refresh — README, status, roadmap, SDK guide, reproducibility notes, OpenAPI metadata, Helm/OTLP values, package versions, and website release surfaces are aligned on the v0.53.8 baseline.

Verification

• cargo check
• npm run lint --prefix admin-console
• python3 scripts/validate_release_docs.py
• npm run test:file --prefix admin-console -- src/__tests__/api.test.js src/__tests__/hooks.test.jsx src/__tests__/App.test.jsx src/__tests__/HelpDocs.test.jsx
• cargo test collector
• cargo test auth_session
• cargo test auth_session_exchange_sets_cookie_and_accepts_cookie_session
• cargo test remediation_change_reviews_can_be_recorded_and_listed

v0.53.7

Lint, Coverage & Panic-Policy Tightening

Quality gates

• Zero-warnings ESLint gate — All 11 long-standing react-hooks/exhaustive-deps and react-hooks/set-state-in-effect warnings (NDR Dashboard derived arrays, Onboarding wizard checklist, App.jsx redundant location-key reset effect, AlertDrawer / SSO error mirroring) have been resolved or surgically annotated. The admin-console lint script now runs with --max-warnings=0, blocking new warnings from landing.
• Vitest coverage gate — A v8-backed coverage report runs in CI with global thresholds (statements ≥ 60, branches ≥ 55, functions ≥ 55, lines ≥ 60) so coverage cannot silently regress. Local npm test -- --coverage reproduces the gate.
• Knip dead-code gate — knip is now installed, configured (admin-console/knip.json), and wired into CI as npm run knip so unused exports, files, and dependencies fail the build instead of accreting between releases. Removed useDraftAutosave and demoted LOCAL_AGENT test fixture to module-private.

Panic policy

• Baseline lowered 19 → 6 — Eliminated 13 production unwrap/expect calls in event_forward.rs, incident.rs, lateral.rs, feed_ingestion.rs, oidc.rs, and benchmark.rs by switching to let-else/match patterns and .ok_or_else(...)?. The scripts/panic-baseline.txt floor moves to 6, ratcheting future regressions tighter.

Operator experience

• Empty-state migration continues — AssistantWorkspace (5 sites), FleetAgents (1 site), and ThreatDetection rule-list / detail (2 sites) now use WorkspaceEmptyState for proper role="status" semantics and consistent layout, extending the v0.53.6 a11y story.

Verification

• 208/208 vitest with coverage clean.
• 1409/1409 cargo lib tests pass.
• cargo check clean; panic-policy guard at new baseline 6.

v0.53.6

Admin-Console Quality Sweep & Panic-Policy Guard

Operator-experience hardening

• Shared API error formatting — Admin-console error rendering is now centralized in formatApiError, replacing the ad-hoc message-derivation that was duplicated across Settings, Email Security, and other workspaces. Error toasts and inline failure states now read consistently and surface the backend X-Request-Id so support handoffs can be matched to server logs without log archeology.
• Workspace empty/error primitives — A reusable WorkspaceEmptyState / WorkspaceErrorState pair now backs operator workspaces, with role="status" / role="alert" semantics, optional retry handlers, and a uniform layout. Email Security has migrated its policies empty state onto the shared primitive as the first adopter.
• Tablist semantics across workspaces — Settings, Infrastructure, Reports & Exports, Email Security, and NDR Dashboard tab strips now expose proper role="tablist" / role="tab" / aria-selected semantics, restoring keyboard and assistive-technology navigation parity with Live Monitor.

Code structure

• Settings module split — The 5,000-line Settings.jsx has been broken up: 35 pure helpers and constants extracted into components/settings/helpers.js, and 8 reusable widgets (ToggleSwitch, NumberInput, TextInput, SelectInput, TextAreaInput, ValidationIssues, CollectorTimelineList, CollectorLaneCard) extracted into components/settings/components.jsx. The main file is now ~14% smaller with no behavior change.
• Dead-code sweep — A knip audit identified three unused admin-console files (__tests__/test-utils.js, components/RuleEditor.jsx, types.ts) and two over-exported helpers; all have been removed without test or build regressions.

Release confidence

• Panic-policy CI guard — A new panic-policy job in .github/workflows/ci.yml runs scripts/check_panic_policy.py on every PR and refuses regressions in non-test unwrap/expect density (baseline: 19). The policy and verification command are documented in CONTRIBUTING.md.
• Focused regression depth — 30 new admin-console tests cover Email Security, Investigation Timeline, NDR Dashboard, the shared error formatter, the API client's X-Request-Id capture path, the workspace state primitives, and tablist semantics, taking the admin-console suite to 208/208 passing.
• Release-document accuracy — README, status, roadmap, reproducibility, installation, OpenAPI, helm, otlp, SDK, and website surfaces are aligned on the v0.53.6 baseline.

Verification

• 208/208 admin-console vitest tests passing.
• cargo check clean, panic-policy guard at baseline.

v0.53.5

Replay Drift, Collector Timelines & Release-Gate Expansion

Detection validation depth

• Replay drift breakdowns — The replay-corpus acceptance gate now exposes platform and signal-type deltas for built-in fixtures, retained-event samples, and custom validation packs so promotion decisions can see where drift is concentrated instead of only reading aggregate precision and recall.
• Detection workspace runner depth — Threat Detection now renders those replay deltas directly in the operator workspace and preserves the routed rule/workspace drilldown model introduced in the previous release.

Integration health visibility

• Collector ingestion timelines — Shared collector status now carries lane labels, route targets, and staged timeline checkpoints for cloud, identity, and SaaS collectors so Settings can show credential coverage, scope, validation, and downstream routing in one routed workspace.

Release confidence

• Broader live routed smoke coverage — The release-acceptance browser suite now covers routed response, collector-health, fleet-rollout, and infrastructure remediation workflows in addition to the earlier detection and admin paths.
• Documentation and release sync — Status, roadmap, reproducibility, installation, and README surfaces now align on the v0.53.5 baseline and the release bundle instructions use the real --version entry point.

Verification

• Focused backend regression coverage — API and server tests cover replay delta breakdowns, retained-event/custom replay packs, campaign clustering, and enriched collector status metadata.
• Focused admin-console regression coverage — Admin-console tests cover replay drift rendering, collector timeline cards, routed rollout/recovery flows, and verdict/remediation workspaces.
• Release-gate listing validation — The expanded routed Playwright smoke spec still resolves cleanly through the checked-in Playwright CLI and release-acceptance wrapper.

v0.53.4

Detection Quality, Campaign Intelligence & Operator Closure

Enterprise controls and integration readiness

• Federated sign-in readiness center — Settings now includes a dedicated SSO readiness surface with callback URI guidance, ready-vs-review provider state, SCIM mapping visibility, and one-click live SSO launch validation against the real backend login/callback routes.
• Login-shell SSO closure — The unauthenticated admin-console shell now explains when federated sign-in is ready, shows SCIM lifecycle state, and makes the callback handoff visible alongside the existing provider sign-in buttons.
• Collector routing dashboard — Settings now summarizes cloud and identity collector readiness in operator language, separating identity telemetry and cloud audit lanes and linking them back into SOC, UEBA, infrastructure, and graph workflows.
• SaaS collector closure — Settings now adds first-class Microsoft 365 and Google Workspace collector setup, validation, and readiness workflows, plus a dedicated SaaS activity lane alongside the existing cloud and identity routing views.

Detection workflow closure

• Route-backed detection drilldowns — Threat Detection now preserves workspace focus for efficacy, ATT&CK gap, suppression-noise, and content-pack rollout drilldowns directly in the route so analysts can reopen or share exact detection engineering context.
• Rule detail panel handoffs — Selected rules now expose URL-backed summary, efficacy, promotion, and hunts/investigations panels, making long detection workspaces feel case-driven instead of forcing analysts to scroll back through the entire page.
• Entity-centric explainability depth — Detection explainability now enriches host, agent, action, identity, and network-destination scores with peer-group context, score components, sequence signals, graph pivots, and analyst-readable next pivots in the alert drawer.
• Campaign correlation bridge — The Attack Graph now consumes a real /api/correlation/campaigns backend that clusters stored events into campaigns, graph edges, sequence summaries, and campaign-ready pivots.
• Replay corpus acceptance gate — Detection Engineering now exposes /api/detection/replay-corpus and a console gate for benign admin, developer tooling, identity abuse, ransomware, beaconing, and lateral-movement fixtures with precision, recall, and false-positive targets.
• Custom replay validation packs — Operators can now POST /api/detection/replay-corpus with labeled telemetry samples to run retained-event or customer-supplied validation packs through the same promotion gate.
• Retained-event replay sampling — The replay-corpus API can now sample recent stored events through source: "retained_events" with limit and threshold controls, giving teams a no-upload path to validate detector drift against live retained telemetry.
• Replay validation runner — Threat Detection now includes an operator runner for retained-event replay checks and pasted custom JSON packs, so detector promotion validation no longer requires leaving the console.

Fleet rollout closure

• Route-backed rollout workspace — Fleet & Agents Updates now preserves rollout-history, recovery, and deployment-health focus in the route, turning the release tab into a shareable operator workspace instead of a raw config dump.
• Recovery watchlists and actions — Operators can now move from rollout issues into offline-agent recovery scopes directly from the updates workspace, with recent rollout and policy activity kept visible beside those actions.

Remediation workflow closure

• UEBA response playbooks — Selected entities now include a route-aware response playbook with peer drift context, suggested ownership, assistant/report pivots, and a concrete next-step narrative for the current anomaly pressure.
• NDR response playbooks — Each NDR tab now carries a network response playbook that explains the active signal lane, the primary focus address, and the recommended closure path into SOC, infrastructure, and evidence export.
• Infrastructure remediation briefs — Asset explorer, exposure, and integrity views now surface guided remediation and recovery narratives so operators can move from posture review into action without translating raw subsystem data by hand.
• Malware verdict workspace — Infrastructure integrity now provides URL-backed malware verdict panels for summary, provenance, recommended actions, and static/behavior profiles, with direct pivots into cases, hunts, reports, and assistant workflows.

Reporting handoff consistency

• Dashboard report pivots — The global dashboard now carries source=dashboard, the lead priority-alert target, and a delivery-first tab choice into /reports, so the last generic report-center entry point no longer drops operator context.

Verification

• Detection workspace regression coverage — Added focused admin-console coverage for route-aware detection drilldown restoration and rule-panel handoff behavior.
• Entity scoring regression coverage — Added backend and admin-console coverage for enriched entity scores, sequence/graph context, and drawer rendering in detection explainability.
• Campaign graph regression coverage — Added backend and admin-console coverage for stored-event campaign clustering and Attack Graph campaign intelligence rendering.
• Replay corpus regression coverage — Added backend and admin-console coverage for the replay-corpus acceptance gate and Detection workspace rendering.
• Custom replay-pack regression coverage — Added API coverage for custom labeled replay-corpus packs.
• Retained-event replay regression coverage — Added API coverage for retained-event replay sampling through the replay-corpus promotion gate.
• Replay runner regression coverage — Extended Detection workspace coverage to verify the console can launch retained-event replay validation from the Replay Corpus Gate.
• Fleet rollout regression coverage — Added focused admin-console coverage for route-aware rollout-history restoration and recovery-to-agents handoff behavior.
• Dashboard workflow-pivot coverage — Added focused admin-console coverage for the dashboard-to-report handoff to keep reporting context aligned across overview, SOC, NDR, UEBA, detection, attack-graph, and infrastructure pivots.
• UEBA/NDR/Infrastructure workflow coverage — Added focused admin-console regression coverage for the new entity, network, and infrastructure remediation playbooks.
• SSO and collector workflow coverage — Added focused admin-console coverage for the new federated sign-in readiness surfaces and the collector routing/health summaries in the integrations workspace.
• SaaS collector regression coverage — Added backend and admin-console coverage for Microsoft 365 and Google Workspace collector save/validate flows and for their presence in the shared collector status summary.
• Malware verdict regression coverage — Extended infrastructure malware-scan coverage to verify the verdict workspace, action handoffs, and static/behavior profile panels.

v0.53.3

Scoped Artifact Persistence & Response-Aware Reporting

Reporting workflow closure

• Persisted export artifacts — Compliance JSON/markdown exports, evidence bundles, audit CSV exports, privacy snapshots, and backend-native alert exports can now be saved into report run history with active case_id, incident_id, investigation_id, and source context attached.
• Original-payload artifact downloads — Stored run-history artifacts now reopen with their original payload and content type when possible instead of always falling back to generic JSON downloads.
• Response approval snapshots — Reports & Exports now captures pending approvals, response requests, and response audit evidence into a dedicated scoped artifact, including target-specific filtering and response-target metadata.

Investigation handoff consistency

• Target-aware report pivots — SOC Workbench, NDR, UEBA, Threat Detection, Attack Graph, and Infrastructure now pass source and target context into /reports so evidence and delivery workflows reopen with the exact operational slice that launched them.
• Response-aware deep links — Report links back into SOC, assistant, and investigation views now preserve response target scope so analysts can move between approval review and evidence packaging without losing context.

Verification and release sync

• Focused admin-console coverage — Added regression coverage for persisted compliance markdown artifacts, backend-native alert export artifacts, and target-scoped response approval snapshot persistence.
• Release-document refresh — README, status, roadmap, SDK guide, reproducibility notes, and OpenAPI metadata now reflect the scoped artifact persistence and response-aware reporting closure delivered in v0.53.3.

v0.53.2

Explainable Detection, Incident-First Workflows & Scoped Reporting

Detection trust and analyst confidence

• Model-registry controls — Added model status, shadow-mode inference visibility, rollback support, and a safer heuristic fallback posture so experimental ML paths can be introduced without breaking triage.
• Analyst feedback capture — New detection-feedback APIs persist analyst judgments and feed explainability views with concrete investigation context instead of ephemeral UI-only notes.
• Explainable detections — Detection detail surfaces now expose API-backed rationale, evidence summaries, and "why this fired" style context to improve analyst trust in alert scoring.

Onboarding and operator readiness

• Server-driven readiness checks — Added onboarding-readiness APIs that validate token state, first-agent presence, telemetry flow, first-alert visibility, threat-intel health, malware scan readiness, and response approval dry-run coverage.
• Readiness-first onboarding UX — The admin-console onboarding wizard now consumes those readiness checks directly so operators can distinguish missing data from degraded setup instead of stepping through a static checklist.
• Manager morning brief — Dashboard surfaces now include a manager-oriented queue digest for queue health, stale investigations, suppression drift, and operational watch items.

Incident-first SOC workflow depth

• Focused case workspace — SOC Workbench now centers cases as investigation workspaces with narrative context, evidence, case notes, linked incidents/events, ATT&CK context, and direct pivots into assistant, reports, investigations, and response.
• URL-backed investigation state — Alert, case, incident, queue-filter, and drawer state is now preserved in route/query parameters across SOC, Assistant, and Reports so analysts can share or reopen exact triage context.
• Assistant handoff context — Assistant queries now retain case / incident / investigation scope and can pivot directly back into matching SOC drawers and investigation routes.

Threat-intel and malware analysis depth

• Threat-intel v2 library — Added normalized indicator metadata, TTL/source weighting/decay visibility, and sightings APIs so threat enrichment includes provenance and recency instead of flat indicator matches.
• Deep malware scan v2 — Added richer malware static and behavior profiles, preserving hash/YARA fast paths while exposing deeper analyst-facing scan context through the API and console.
• Provenance-first triage UI — Threat Intel operations now surface indicator metadata and recent sightings directly in the workspace, making enrichment quality easier to inspect during triage.

Reporting and workflow closure

• Execution-context-aware reporting — Report runs, schedules, stored reports, templates, and report previews can now persist case_id, incident_id, investigation_id, and source context across backend storage and UI workflows.
• Scoped artifact library — Reports & Exports now supports scoped and unscoped artifact filtering, republishing older reports into scoped artifacts, and backend-native filtering for reports, runs, schedules, and templates.
• Reusable scoped templates — Analysts can save scoped report templates tied to the active case/incident/investigation workflow and reopen only the relevant preset library later.

API, SDK, and verification

• New operator APIs — Added detection feedback, explainability, model status, onboarding readiness, manager queue digest, threat-intel sightings, deep malware scan v2, and scoped report/report-template filtering endpoints.
• SDK surface expansion — The TypeScript SDK now includes the new explainability, onboarding, reporting, threat-intel, and malware-analysis endpoints used by the admin console.
• Focused regression coverage — Added Rust and admin-console coverage for onboarding readiness, explainability feedback, deep malware scan profiles, threat-intel sightings, and execution-context persistence/filtering across reports, runs, schedules, and templates.

v0.53.1

Hunt Maturity, SOC UX Throughput, and Case Automation

Release confidence

• Release acceptance gate — Added scripts/release_acceptance.sh and make release-acceptance to build the shipped admin console and Rust binary, validate published site links, and run the live routed Playwright suite (live_release_smoke, advanced_console_workflows, enterprise_console_smoke, and mobile_topbar_smoke) against a real Wardex instance before sign-off.
• API contract alignment — Normalized the admin-console to the canonical backend payloads for response audit entries (audit_log), fleet dashboard summaries (fleet.total_agents and fleet.status_counts), and SOC queue items (queue), and updated the affected Playwright mocks to match the shipped server contract.

Threat hunting workflow upgrades

• Hypothesis-first hunts — Saved hunts now persist hypothesis and expected_outcome (confirm, refute, explore) and expose them in the Threat Detection hunt workflow.
• Retrohunt windows — Saved-hunt execution now accepts time_from and time_to windows to scope historical runs to incident timelines.
• Cron scheduling support — Hunts now support optional cron expressions in addition to interval scheduling.
• Escalate-to-case from hunt results — New POST /api/hunts/{id}/escalate creates a case from a selected hunt run and links the resulting case id back to the run.
• Hunt scorecard telemetry — Hunt run records now include yield metadata (yield_rate, suppression context, linked case id).

ATT&CK coverage and detection surfaces

• Coverage gap visibility — Threat Detection and Attack Graph now surface ATT&CK gap heatmap summaries from coverage gap APIs.
• Detection domain visibility — Threat Detection now includes dedicated domain summary cards for malware scanning, feed ingestion, quarantine store, and asset inventory APIs.

SOC and fleet operator efficiency

• Inline case title edits — Case titles can now be edited inline in SOC Workbench and saved through the existing case update API.
• Saved queue filters — SOC queue now supports bookmarkable/saved filter presets for recurring analyst query workflows.
• Bulk case operations — Case table now supports multi-select with bulk status update actions.
• Safer destructive actions — Fleet agent deletes now provide a 5-second undo window before execution.
• Keyboard table navigation — Fleet agent table now supports j/k row navigation, Enter to open, and Esc to clear detail selection.
• Fleet column customization — Fleet table columns are now show/hide toggleable and persisted in local storage.

Automation depth

• Dedup incident auto-create path — New POST /api/alerts/dedup/auto-create creates incidents from high-cardinality dedup groups (3+ related alerts in a 5-minute window).

API additions

• POST /api/hunts/{id}/escalate
• POST /api/alerts/dedup/auto-create

v0.53.0

Rules Marketplace, Tiered Pricing & wardex doctor

Marketing Site

• Rules marketplace — New site/rules.html renders all 302 built-in detections (92 YARA + 210 Sigma) with filter-by-kind, filter-by-severity, free-text search, and MITRE ATT&CK chip links. Index regenerated at deploy time from rules/yara/*.json and rules/sigma/*.yml via scripts/build_rules_index.py.
• Tiered pricing — Rewritten site/pricing.html introduces a five-tier plan grid: Community (free, ≤10 endpoints), Starter (€49/mo, up to 25 endpoints), Team (€3/endpoint/mo), Business (€6/endpoint/mo), and Enterprise (custom). Includes monthly/annual toggle, feature comparison table, and 8-item FAQ.
• Checkout landing — New site/checkout.html Stripe-ready intake form for the Starter tier with order summary and EU VAT support.
• Project status page — New site/status.html reports release cadence, open CVEs, supply-chain incidents, SBOM availability, and signing-key verification instructions with live release feed from the GitHub API.
• Integrations registry — New site/integrations.html catalogs 20+ built-in and planned connectors (Slack, Teams, PagerDuty, ServiceNow, Jira, Splunk HEC, Elastic, syslog, OpenTelemetry, MISP, VirusTotal, OIDC, …).
• API reference — New site/api.html renders docs/openapi.yaml via Redoc.
• Competitive comparison — New site/comparison.html with feature matrix vs. CrowdStrike, SentinelOne, Defender, Elastic, and Wazuh.
• SEO & social — Sitemap, robots.txt, branded 404 page, OG/Twitter Card meta on every page, 1200×630 OG cover SVG.
• One-line installer — New site/install.sh with platform autodetection.
• Accessibility — WCAG 2.1 AA-clean across all pages (pa11y-ci gate).

CLI

• wardex doctor — New preflight subcommand that reports build version, runtime target, config parse status, data/site/rules directory health, and crash-log detection. Exit code 1 on any failed check. Suitable for support-ticket paste-in.

Admin Console

• Accessible confirm dialog — New <ConfirmDialog> component with useConfirm() hook replaces window.confirm() across process kill/isolate and settings actions. Focus trap, ESC handling, tone variants (default/warning/danger).
• Empty-state component — New <EmptyState> for contextual "no results" screens with primary/secondary CTAs.
• Copy-to-clipboard — Reusable button behavior on code snippets and rule names with 1.5s visual feedback.

Detection Engineering & SOC Operations

• Identity-routed automation targets — Auth sessions now expose user_id, role, groups, and source, and session-backed operators are checked against hunt and content-pack target_group assignments before saving or executing targeted automation.
• Content pack bundle editor — Threat Detection can create and edit content bundles directly from rule context, including saved-search templates, recommended workflow routes, target groups, and rollout notes.
• Persisted program analytics — Enterprise state now records playbook execution analytics and rollout history so automation and deployment activity survive restarts and feed the SOC workbench overview.
• Expanded workbench overview — SOC Workbench now surfaces identity readiness, rollout history, content bundle adoption, automation history, operational analytics, and a recommendation queue with direct pivots into detection, settings, and infrastructure views.

Fixed

• Playbook execution API contract — /api/playbooks/executions continues returning live PlaybookExecution records even when persisted analytics history exists, avoiding stale or shape-shifted execution responses.
• Saved hunt reopen flow — Reopening an existing saved hunt now preserves the original hunt id and update semantics instead of clearing the id and creating duplicates on save.
• Focused regression coverage — Added backend coverage for the playbook execution response shape and frontend coverage for saved-hunt reopen/save behavior in the workspace shell suite.

Packaging & Distribution

• Rule index in Pages — Pages deploy workflow regenerates site/rules-index.json from the on-disk rule packs so the marketplace always reflects the released rule content.

v0.52.5

Release Distribution Dispatch Authorization Fix

Packaging & Distribution

• Dispatch-capable release fan-out — The tagged release workflow now validates RELEASE_WORKFLOW_TOKEN and uses it when dispatching GitHub Pages publication and Homebrew tap synchronization, avoiding the GITHUB_TOKEN workflow-dispatch permission failure.

v0.52.4

Release Asset Publication Fix

Packaging & Distribution

• Release asset filtering — GitHub release publication now downloads only wardex* artifacts, excluding the Buildx .dockerbuild record artifact that broke release asset extraction.

v0.52.3

Release Workflow Completion Fixes

Packaging & Distribution

• Lowercase GHCR image naming — The release workflow now normalizes the GitHub Container Registry image name to lowercase before pushing and signing container images.
• Post-release dispatch fix — The release workflow now passes explicit repository context when dispatching GitHub Pages publication and Homebrew tap synchronization, so release-time workflow fan-out works without requiring a checkout.

v0.52.2

Release Automation & Container Build Fixes

Packaging & Distribution

• Release fan-out automation — The tagged release workflow now dispatches GitHub Pages publication and Homebrew tap synchronization after the GitHub release is published, so APT and Homebrew distribution stay aligned with the released tag.
• Tag-aware Pages republish — Manual Pages runs can now target a specific release tag, allowing deterministic APT repository rebuilds from the exact published release assets.
• Container build toolchain alignment — The Docker builder image now uses Rust 1.88 so the container-scan lane matches the dependency floor required by the current crate graph.
• Container runtime command fix — The container image now starts Wardex with the current positional serve arguments and explicitly serves the bundled site assets from /app/site.

v0.52.1

Signed APT Delivery & Packaging Fixes

Packaging & Distribution

• Signed APT repository publishing — GitHub Pages now rebuilds a Debian APT repository from the latest published .deb asset and signs Release, Release.gpg, and InRelease metadata when the repository signing secrets are configured.
• APT installation path — Debian and Ubuntu installs now use a repository keyring plus apt-get install wardex instead of a manual dpkg -i fallback as the primary path.
• Linux package service fix — The packaged systemd unit now points at /usr/bin/wardex, passes the correct positional serve arguments, sets WARDEX_CONFIG_PATH=/etc/wardex/wardex.toml, and can find the packaged static site assets.
• Linux package provisioning — Debian packages now create the wardex service account, data/log directories, and a default config file during post-install.
• APT validation CI — New Ubuntu workflow coverage builds a .deb, renders a signed local APT repository, installs from it with apt-get, and verifies the installed package layout.

v0.52.0

Hunt Workflows, NDR Depth & Release Polish

Detection & Investigation UX

• Run-hunt intent wiring — The detection workspace now consumes /detection?intent=run-hunt, opens a dedicated hunt drawer, prefills query/name state from route parameters, and keeps drawer URL state consistent across tune, suppress, and hunt pivots.
• Inline hunt operations — Analysts can run a live hunt, save a hunt definition, reopen related saved hunts, and inspect latest hunt results without leaving the selected rule context.
• Workflow suggestions in context — Threat Detection now requests builtin workflow suggestions from the selected rule metadata and can start investigations directly from the detection detail pane.
• SOC planner handoff — SOCWorkbench can build investigation plans from incident or queue-alert context and pivot the same context into the hunt drawer with prefilled hunt queries.

Detection Quality

• False-positive advisor UX — Rule-specific false-positive patterns now score against selected rule metadata, prefill suppressions, and suggest safer weight reductions.
• Default intel feed seeding — The feed engine now ships with common default sources for MalwareBazaar, CISA KEV/STIX, and URLhaus.
• Email sender heuristics — Sender-domain scoring now considers suspicious TLDs, punycode, homoglyphs, IP-literal senders, and Message-ID domain mismatches.
• Persistence-aware LOLBin scoring — Process scoring now flags scheduled-task, cron, launch agent, service-enablement, and startup-path persistence patterns.
• Hunt aggregation validation — Invalid pipe aggregations now fail fast with structured errors instead of silently degrading into empty or misleading results.

NDR & APIs

• Beaconing anomaly detection — NDR now detects low-jitter outbound beaconing cadence and exposes the results in the report model and admin console.
• Dedicated NDR anomaly endpoints — TLS, DPI, entropy, self-signed certificate, top-talker, beaconing, and protocol-distribution endpoints are all individually exposed and documented.
• Search index rebuild contract — Event-backed search index generation now preserves the alert event class contract while rebuilding from retained events.

Docs, Packaging & Quality

• Searchable docs site — The website resources section now supports client-side search and empty-state handling for operator references.
• Release-facing docs refresh — README, status, deployment, SDK, and getting-started material now reflect current package formats, sizing guidance, and release verification expectations.
• SDK drift CI — CI now regenerates SDKs and fails if committed artifacts drift from the OpenAPI contract.
• Focused Playwright smoke coverage — Deterministic browser smoke tests validate run-hunt routing, investigation planner start, and queue-to-hunt pivots.

v0.51.0

ClickHouse, EDR Blocking, WASM Tutorial & Platform Polish

Storage

• ClickHouse dual-write — Event ingestion now optionally writes to ClickHouse in parallel with the built-in store; configurable via [clickhouse] in wardex.toml.
• ClickHouse status — /api/storage/stats reports ClickHouse connection status, buffer length, and total inserted rows.

Detection & Analytics

• Search DSL aggregations — Hunt queries now support pipe operators (|) with 7 aggregation types: count, count by <field>, count_distinct <field>, top N <field>, min, max, values.
• EDR behavioral blocking engine — New edr_blocking module with real-time process scoring, memory corruption detection (ROP chains, heap spray, shellcode), exploit mitigation heuristics, allowlisting, and 9 tests.

Admin Console

• Native WebSocket push — useWebSocket hook now connects via native WebSocket (/ws/events) with automatic fallback to polling; exponential backoff reconnect, 3s timeout for WS upgrade.
• Response progress bars — SOCWorkbench response requests table now shows per-step progress bars, step counts, ETA, failure detail, and rollback indicators for running playbooks.
• Accessibility focus traps — SideDrawer, ConfirmDialog, and SearchPalette now implement focus trapping (Tab/Shift-Tab cycling), role="dialog", aria-modal="true", and auto-focus on open.

Documentation

• WASM extension tutorial — Step-by-step guide for building detector and response plugins as Wasm modules, with complete Rust examples, deployment instructions, and troubleshooting table.
• Expanded site resources — Documentation site now links to WASM tutorial, SDK guide, and threat model.

Packaging & Distribution

• Homebrew formula — Updated to v0.51.0.
• Debian packaging — Added [package.metadata.deb] config to Cargo.toml for cargo-deb builds with systemd service, rules, and binary assets.

Infrastructure

• OpenAPI spec 0.51.0 — Version bumped.
• Helm chart 0.51.0 — Chart and app version bumped.
• TypeScript SDK 0.51.0 — Version bumped.
• Python SDK 0.51.0 — Version bumped.

v0.50.0

Advanced Detection, UEBA Dashboard & SDK Expansion

Detection

• JA3/JA4 TLS fingerprinting — NDR engine now extracts and matches JA3/JA4 hashes against known-bad C2 fingerprint database; rare fingerprints flagged automatically.
• Deep Packet Inspection anomalies — Port/protocol mismatch detection (e.g. non-HTTP traffic on port 80, non-DNS on port 53) via new detect_dpi_anomalies() method.
• Entropy-based exfiltration detection — High-entropy payload analysis for DNS/HTTP/TLS tunneling with configurable threshold (default 7.5).
• Self-signed certificate detection — Automatic flagging of TLS connections using self-signed certificates with issuer/subject/SNI metadata.
• 5 new NDR tests — known_bad_ja3_detected, rare_ja3_flagged, dpi_mismatch_detected, high_entropy_detected, self_signed_cert_detected.

Admin console

• UEBA Dashboard — New page with risky entity scoring, anomaly feed (impossible travel, unusual login time, anomalous access), peer group baselines, entity detail with timeline spark bars.
• NDR Dashboard — Network detection visualization with 5 tabs (overview, TLS, DPI, entropy, certs), top talkers, protocol distribution, JA3/JA4 anomaly tables.
• Email Security — Quarantine management with release/delete actions, email header analysis tool, phishing score badges, policy configuration viewer.
• Attack Graph — Canvas-based force-directed graph for lateral movement and kill-chain visualization with node type coloring, risk rings, edge type annotations, and click-to-inspect detail panel.
• 4 new routes — /ueba, /ndr, /email-security, /attack-graph with role-gated access (analyst+).
• Keyboard shortcuts — u (UEBA), n (NDR), e (Email Security), a (Attack Graph).

API

• 18 new API client functions — UEBA (risky entities, anomalies, peer groups, entity, timeline), NDR (TLS/DPI/entropy anomalies, self-signed certs, top talkers, protocol distribution), Email Security (quarantine CRUD, stats, policies, analyze).
• OpenAPI spec 0.50.0 — Version bumped.

SDKs

• TypeScript SDK — 30+ new methods: UEBA, NDR, email security, incidents, fleet, policy, assets, vulnerability, container, response actions, telemetry, threat intel, campaigns. Coverage ~60% of API.
• Python SDK — 18 new methods: UEBA (risky entities, anomalies, peer groups, entity, timeline), NDR (TLS/DPI/entropy anomalies, self-signed certs, top talkers, protocol distribution), email security (analyze, quarantine, stats, policies), campaigns.

Deployment

• Helm chart 0.50.0 — appVersion and image tag updated.
• SDK version sync — Python SDK, TypeScript SDK, and Helm chart aligned to 0.50.0.

v0.49.0

Resilience, Observability & Build Hardening

Security

• Fix email attachment .unwrap() panic — dots.last().unwrap() in attachment double-extension detection replaced with if let Some(...) guard, preventing panic on dotless filenames.
• Mutex lock-poisoning resilience — All .lock().unwrap() calls in rbac.rs (8) and response.rs (10) replaced with .lock().unwrap_or_else(|e| e.into_inner()), preventing cascading panics after a thread panic.
• Content Security Policy — Added CSP <meta> tag to admin console restricting script/style/connect/font/object sources; object-src 'none', base-uri 'self'.
• GraphQL pagination caps — Alerts, events, and hunts GraphQL resolvers now enforce .min(1000) upper bound, preventing denial-of-service via unbounded page sizes.

API

• AbortController in useApi hook — React useApi hook now creates an AbortController per request, aborting in-flight fetches on re-call and unmount to prevent state updates on stale responses.
• OpenAPI spec 0.49.0 — Spec version bumped from 0.47.0 to 0.49.0.

Observability

• Audit logging for response & playbook actions — response_request, response_approve, and playbook_execute handlers now emit structured [AUDIT] log lines with request ID, actor, and target.
• Vault cache lock warning — Poisoned Vault secret cache lock now logs [WARN] instead of silently bypassing cache.

Admin console

• 20 new component tests — ErrorBoundary (3), Tooltip (4), Skeleton (4), DashboardWidget (5), SearchPalette (4). Total: 53 vitest tests.

Code quality

• 3 new Rust tests — Dotless attachment no-panic, double-extension detection, poisoned-mutex resilience. Total: 1323.

Deployment

• .dockerignore — Excludes target/, .git/, node_modules/, docs/, fuzz/, sdk/, and build artifacts from Docker context.
• Dockerfile layer caching — Dependency-only build layer caches cargo build --release before copying source, reducing rebuild times.
• SBOM generation — CI binary-attestation job now produces CycloneDX SBOM (bom.json) alongside SHA-256 checksums.
• SDK version sync — Python SDK and TypeScript SDK aligned to 0.49.0.
• Helm chart 0.49.0 — appVersion updated to 0.49.0.

v0.48.0

Security, Quality & Developer Experience

Security

• Constant-time enrollment token comparison — ct_eq() XOR-based comparison prevents timing side-channel attacks on enrollment tokens.
• Remove production .unwrap() in Sigma parser — Replaced two split_once(':').unwrap() calls with let Some(...) else { continue } guards, preventing panics on malformed Sigma rules.
• Session persistence across restarts — SessionStore now supports file-backed persistence with atomic .tmp + rename writes; sessions survive server restarts.

API

• Standardized pagination — /api/events, /api/cases, and /api/agents now accept limit/offset query parameters and return {"items":[], "total":N, "limit":N, "offset":N} envelope responses (default limit 100, cap 1000; agents default 200).

Admin console

• Code splitting / lazy routes — All 10 page components loaded via React.lazy() with per-route <Suspense> fallbacks; Vite manualChunks splits vendor (react, react-dom, react-router-dom) and charts (recharts) bundles.
• Route-level error boundaries — Each route wrapped with <ErrorBoundary> + <Suspense> for graceful failure isolation.
• 7 new frontend tests — Connect button state, auth error display, skip-to-content a11y link, theme toggle, unknown route redirect, welcome message (33 total).
• CI format check — Added npm run format:check step to frontend CI pipeline.

Code quality

• Extract hardcoded constants — DEFAULT_SESSION_TIMEOUT_SECS (1800) in live_response.rs; PENDING_STATE_TTL_SECS (600) and DEFAULT_TOKEN_EXPIRY_SECS (3600) in oidc.rs.
• 11 new Rust tests — ct_eq correctness (5), session persistence round-trip + error resilience (3), Sigma malformed-YAML handling (1), OIDC constants (1), live-response default timeout (1). Total: 1320.

Deployment

• SDK version sync — Python SDK and TypeScript SDK both aligned to 0.48.0.
• Helm chart 0.48.0 — appVersion 0.47.0; K8s deployment and values.yaml image tags updated to 0.47.0.
• Network policy egress — Added HTTPS (port 443) for threat intel feeds/webhooks and syslog/SIEM forwarding (ports 514, 6514).
• Roadmap baseline — Updated stale roadmap baseline from v0.42.0 to v0.47.0.

v0.47.0

Production Readiness & Hardening

Security

• Path-traversal hardening — CaseStore, IncidentStore, and ReportStore canonicalize parent directories, blocking ../ escape attempts.
• Response-builder panic safety — Replaced 12+ .unwrap() calls on Response::builder().body() with a safe_body() helper that falls back to HTTP 500.
• Request-ID header-parse safety — Graceful if let Ok instead of .unwrap() when inserting the X-Request-Id response header.
• Spool key separation warning — Prints startup warning when WARDEX_SPOOL_KEY environment variable is not set.

API

• Structured error codes — error_json() now returns {"error":"…","code":"…"} with machine-readable codes: VALIDATION_ERROR, AUTH_REQUIRED, FORBIDDEN, NOT_FOUND, CONFLICT, PAYLOAD_TOO_LARGE, RATE_LIMITED, INTERNAL_ERROR, SERVICE_UNAVAILABLE.
• OpenAPI spec sync — Version bumped to 0.47.0; added code field to Error schema, /api/fleet/health and /api/feature-flags endpoints.

Performance

• Chunked ingest processing — handle_analyze processes samples in 200-item chunks, releasing the lock between chunks to reduce contention.

Validation

• DecayConfig f64 validation — validate() method checks half_life_days (>0, finite) and min_confidence (0.0–1.0, finite); apply_decay() short-circuits on invalid config.

Deployment

• K8s container hardening — readOnlyRootFilesystem: true, allowPrivilegeEscalation: false, capabilities.drop: [ALL], tmpfs /tmp volume. Image tag updated to 0.46.0.
• Helm NOTES.txt — Post-install instructions: URL, status, logs, health verification.
• Helm test — test-connection.yaml pod that verifies /api/health reachability.

Admin console

• Draft autosave — useDraftAutosave(key, initialValue) hook with 500 ms debounced localStorage persistence.
• TypeScript types — Shared type definitions (types.ts) for AlertRecord, AgentIdentity, Case, Incident, FeatureFlag, FleetHealth, ApiError, Toast, DraftState.

Testing

• 17 new tests — 7 in ioc_decay (validation boundary values), 7 in server (error codes, safe_body fallback, path-traversal, store canonicalization), 3 in server (error code mapping).

v0.46.0

Hardening, Distribution & Observability

Security

• OIDC state cleanup — Automatic purging of expired pending states (>600 s) and sessions in the OIDC provider.
• Security headers — Added Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, X-DNS-Prefetch-Control, and X-Permitted-Cross-Domain-Policies response headers.
• CSV injection fix — Strip CRLF characters from CSV output before formula-prefix check.

Architecture

• AppState sub-structs — Defined AuthSystems, DetectionSystems, FleetSystems, SocSystems, ComplianceSystems, ObservabilitySystems grouping structs for future decomposition.
• Feature-gated experimental modules — experimental-ml, experimental-llm, experimental-quantum, experimental-proof compile-time features; all enabled by default.

Detection content

• 44 community YARA rules — Covers Emotet, CobaltStrike, Mimikatz, WannaCry, Ryuk, LockBit, ALPHV, Meterpreter, Sliver, PowerShell abuse, LOLBINs, process injection, web shells, Log4Shell, container escapes, and more (rules/yara/community.json).

Testing

• 21 new tests — 8 in llm_analyst, 7 in ml_engine, 6 in oidc covering boundary values, serialization, session lifecycle, and config validation.

Admin console

• TypeScript readiness — Added tsconfig.json for gradual TS adoption (allowJs, strict).
• ErrorBoundary — React error-boundary component with retry and role="alert" a11y.
• Accessibility — aria-current="page" on active nav items, aria-hidden="true" on icon spans.

CI/CD

• cargo-deny — Supply-chain audit job checking licenses and advisories.
• Feature-flag CI — Builds with --no-default-features and --all-features.
• Playwright E2E — Added browser install and Playwright test run to frontend CI job.
• Binary attestation — SHA-256 manifest generation and artifact upload on main pushes.

Observability

• OTLP export config — Full deploy/otlp.yaml with gRPC/HTTP, TLS, 10 % trace sampling, 12 metric instruments, and log export.
• Prometheus rules — Recording rules (request rate, error rate, latency percentiles, fleet health) and 5 alerting rules (deploy/prometheus-rules.yml).

Performance

• LRU agent-log eviction — Replaced random eviction with timestamp-based LRU to keep the most active agents in memory.
• Bulk fleet health endpoint — GET /api/fleet/health returns total/online agent counts and fleet status.

Distribution

• Version sync — Homebrew formula, Helm chart, and SDK packages updated to 0.46.0.
• Installation guide — docs/runbooks/installation.md covering Homebrew, deb, rpm, Docker, Helm, and source.

Disaster recovery

• Automated backup script — deploy/scripts/backup.sh with encryption (age), SHA-256 checksums, and configurable retention.
• Restore script — deploy/scripts/restore.sh with pre-restore snapshot, optional decryption, and health-check verification.
• Systemd timer — wardex-backup.timer + service unit for daily 02:00 UTC backups.

Documentation

• Feature flags guide — docs/FEATURE_FLAGS.md covering compile-time and runtime flags.
• SDK guide — docs/SDK_GUIDE.md with Python and TypeScript quick-start examples.
• Installation runbook — Cross-platform installation and verification steps.

v0.45.0

Enterprise Integration & Intelligence

Added — Authentication & Secrets

• OIDC/SAML SSO — Federated authentication with OpenID Connect discovery, authorization code flow, token exchange, automatic Wardex role mapping, and session management (src/oidc.rs).
• Secrets management — Centralised SecretsResolver supporting env-var expansion (${VAR}), file-based secrets (file://), and HashiCorp Vault KV v2 (vault://) with namespace support and in-memory caching (src/secrets.rs).

Added — Intelligence & Analytics

• LLM-assisted analyst — RAG-powered analyst with /api/ask endpoint. Supports OpenAI, Azure OpenAI, Anthropic, and Ollama backends. Includes conversation history, citation generation, and confidence scoring (src/llm_analyst.rs).
• ONNX ML inference — Real model inference via ONNX Runtime for anomaly detection, replacing the stub engine. Supports loading .onnx models for triage classification (src/ml_engine.rs).
• SigmaHQ rule import — YAML-based Sigma rule ingestion from the SigmaHQ community repository with field mapping and condition parsing (src/sigma.rs).

Added — Cloud & Data

• AWS CloudTrail live polling — Real CloudTrail API integration with SigV4 request signing (src/collector_aws.rs).
• Azure Activity Log polling — OAuth2 client-credentials flow with Azure AD, Management REST API querying (src/collector_azure.rs).
• GCP Cloud Audit Logs — JWT-based service-account authentication and Logging v2 REST API polling (src/collector_gcp.rs).
• Persistent event store — Tantivy full-text search index for event persistence and retrieval (src/search.rs).

Added — Compliance

• HIPAA compliance module — Automated evaluation of healthcare security controls including access controls, audit logging, encryption, and breach notification (src/compliance_hipaa.rs).
• GDPR compliance module — Data-protection control evaluation covering consent management, data subject rights, breach reporting, and cross-border transfer safeguards (src/compliance_hipaa.rs).

Added — Quality & Performance

• Criterion benchmarks — Pipeline throughput micro-benchmarks for regression detection (benches/pipeline.rs).
• Expanded fuzz targets — Three new libFuzzer targets: search_query, secrets_expand, sigma_import (fuzz/fuzz_targets/).
• Module organisation — Refactored lib.rs with grouped module declarations for better navigability.

Stats

• 135+ Rust source modules · 1462+ tests (1272 unit + 190 integration) · 174 API paths

v0.44.0

20 Detection & UX Enhancements

Added — Detection Engine

• ML triage wiring — AnomalySignal now carries an optional TriageResult from the ML engine (StubEngine), enabling future model-based alert classification.
• Alert signature dedup — Content-hash-based deduplication (AlertDedupCache) with SHA256(device_id|level|sorted_reasons), 15-minute suppression window, and occurrence counting.
• Ransomware canary files — CanaryMonitor deploys bait files per directory, detects modification/deletion/access, plus entropy-spike-rate analysis (7.5 threshold, 0.7 ratio).
• FP feedback loop — record_fp_feedback() / noisy_rules() on AnomalyDetector with auto-suppression once a rule exceeds threshold.
• Insider threat detection — assess_insider_risk() on UebaEngine computes composite score from peer-deviation, volume anomaly, temporal anomaly, and off-hours ratio.
• DoH/DoT bypass detection — 19 known DoH resolver domains + 15 resolver IPs; detect_doh_bypass() flags encrypted DNS evasion in DnsThreatReport.
• Fleet credential spray — detect_credential_spray() correlates AuthFailureEvents across agents with sliding-window grouping by username.
• LOLBIN chain scoring — LolbinChainTracker detects chains of 3+ LOLBINs per host within 5-minute windows with exponential score multiplier.

Added — Admin Console

• RBAC management UI — Team tab in Settings for creating/deleting users with role assignment (admin/analyst/viewer/service-account).
• Playbook visual editor — New PlaybookEditor component with 6 step types (CheckThreshold, MatchPattern, RunAction, Notify, Escalate, Wait), drag-to-reorder, and run button.
• Case comments — Inline comment form in SOC Workbench incident detail with author/timestamp display.
• Saved searches — SearchPalette now persists searches to localStorage with save/delete/recall when query is empty.
• NOC wall display — Fullscreen mode on Dashboard with dark background, large metrics, 30-second auto-rotate, and ESC exit.
• Investigation checklists — 5 built-in templates (ransomware, credential_storm, lateral_movement, c2_beacon, container_escape) with progress bar in incident detail.
• Per-rule threshold tuning — Inline slider (0.1–1.0) per Sigma rule in Threat Detection with "tuned" badge and API persistence.
• Alert correlation graph — CampaignGraph SVG component with severity-colored nodes, shared-technique edges, and circular layout.

Added — UX Polish

• Contextual tooltips — Tooltip component with hover-reveal explanations on key metrics (events/sec, detection profile, DGA suspects).
• Skeleton loading — CSS shimmer animation + SkeletonCard/SkeletonRow components replace blank loading states.
• Keyboard shortcuts — Global handler: D/M/T/F/S/G for navigation, ? for shortcut help modal, ⌘K for search.
• Mobile responsive — Media queries at 768px (tablet) and 480px (phone): bottom nav, stacked cards, scrollable tables.

Fixed

• Borrow checker error in detector.rs record_fp_feedback() — split get_or_insert_with into separate is_none() check + assignment.
• Duplicate rbacUsers export in api.js — removed redundant declaration that caused Vite build failure.
• Type mismatch in UEBA test — data_bytes field corrected from f64 to u64 literals.

Stats

• 1419 tests (1229 lib + 190 integration + 26 vitest), all passing
• 128+ source modules, 13 new API functions, 3 new React components
• Zero clippy errors, zero build errors

v0.43.1

Admin Console Quality & Platform Polish

Fixed

• Malware tab severity badges — Replaced nonexistent CSS classes badge-danger/badge-warning with the correct badge-err/badge-warn classes in the Infrastructure malware detections table.
• Traces tab status badges — Replaced nonexistent CSS classes badge-danger/badge-success with the correct badge-err/badge-ok classes in the Infrastructure trace spans table.
• SIEM export blob URL memory leak — The SIEM export download now revokes the temporary blob URL after click, preventing unbounded memory growth in long-running browser sessions.
• Unused config-drift API fetch — Removed a stale useApi(api.configDriftBaselines) call in Infrastructure that triggered a wasted GET /api/config-drift/baselines request on every component mount.
• Dashboard widget collapse/restore — Fixed widget state management so collapse and restore operations work reliably without race conditions under rapid interaction.
• Alert severity filter — Corrected the severity badge class mappings in the live alert stream so filters render with proper visual indicators.
• Toast notification lifecycle — Fixed auto-dismiss timer cleanup to prevent stale timers from firing after manual dismissal.
• Search palette keyboard handling — Corrected event propagation so the search palette closes cleanly on Escape without interfering with other keyboard shortcuts.
• Fleet agents table rendering — Fixed agent status badge classes and heartbeat freshness display in the Fleet & Agents view.
• SOC Workbench case detail — Corrected storyline timeline rendering and related-events display in the structured incident detail view.
• Settings edit mode — Fixed configuration edit form submission and cancel button state management.

Improved

• Admin console test suite — 83 automated tests: 26 Vitest unit tests covering API client, hooks, and rendering + 57 Playwright end-to-end tests covering authentication, navigation, all page views, responsive layout, onboarding wizard, and zero-JS-crash verification across all routes.
• Source module count — Updated from 116 to 128 Rust source modules reflecting the accurate src/ inventory.
• Total test count — 1428 automated tests (1345 Rust + 83 admin-console) providing comprehensive coverage across the full platform.

v0.43.0

Malware Detection, Threat Hunting & Platform Hardening

Added

• Malware hash database (malware_signatures.rs) — In-memory threat intel DB with ~48 built-in SHA256/MD5 hashes across ransomware, trojan, spyware, rootkit, worm, adware, and cryptominer families. Supports import from JSON/CSV. API: GET /api/malware/stats, GET /api/malware/recent, POST /api/malware/signatures/import.
• Malware scanner (malware_scanner.rs) — Orchestrates hash DB + YARA engine for file scanning with verdict classification (malicious/suspicious/clean). API: POST /api/scan/buffer, POST /api/scan/hash.
• Community YARA rules (rules/yara/malware.json) — 30 YARA-format detection rules for malware families (Emotet, Cobalt Strike, Mimikatz, WannaCry, etc.).
• Threat hunting DSL — KQL-like query language with recursive descent parser, field aliases (process, src, dst, cmd), wildcard matching, AND/OR/NOT operators. API: POST /api/hunt.
• SIEM export engine — Multi-format alert export: CEF, LEEF, Syslog RFC 5424, Microsoft Sentinel, Google UDM, Elastic ECS, QRadar, JSON. API: GET /api/export/alerts?format=.
• Compliance report generator — Full-framework evaluation for CIS v8, PCI-DSS v4, SOC 2 Type II, and NIST CSF 2.0 with Markdown rendering, status icons, and remediation actions. API: GET /api/compliance/report, GET /api/compliance/summary.
• Playbook execution engine — Full step dispatch for 11 step types (RunAction, Notify, Enrich, Conditional, Parallel, Wait, Escalate, CreateCase, Approval, CollectEvidence, Contain) with on_failure jump and template variable substitution. API: POST /api/playbooks/run.
• Alert deduplication — Time-window incident merging with configurable cross-device and max-merge settings. API: GET /api/alerts/dedup.
• API usage analytics (api_analytics.rs) — Per-endpoint request tracking with count, error rate, latency percentiles (p95), and top-endpoint summary. API: GET /api/analytics.
• OpenTelemetry-compatible tracing — OtelSpan with trace/span IDs, parent chaining, OTLP JSON export, and TraceCollector with ring buffer and stats. API: GET /api/traces.
• Backup encryption — AES-256-GCM encryption/decryption for backup data with passphrase-derived keys. API: POST /api/backup/encrypt, POST /api/backup/decrypt.
• Detection rules CRUD — List and add custom YARA rules via API. API: GET /api/detection/rules, POST /api/detection/rules.
• TypeScript SDK (sdk/typescript/) — Full typed client with 20+ methods covering all API endpoints, AbortController timeout support, and TypeScript interfaces for all response types.
• Homebrew formula (deploy/homebrew/wardex.rb) — Multi-platform (macOS ARM/Intel, Linux x86_64) installation with service integration.
• Admin console — 5 new tabs: Hunt (KQL-like threat hunting + SIEM export download), Compliance (framework scores + executive summary), Analytics (API request metrics + top endpoints), Traces (OpenTelemetry span viewer), Rules (detection rule inventory).

Improved

• Systemd hardening — 20+ additional security directives: SystemCallFilter allowlist, CapabilityBoundingSet, IP address filtering, memory/CPU limits, WatchdogSec, ProtectProc, UMask 0077.
• Python SDK — 14 new methods: hunt, export_alerts, compliance_report/summary, run_playbook, dedup_alerts, api_analytics, traces, backup_encrypt/decrypt, detection_rules, add_detection_rule.
• Admin console API client — 14 new endpoint functions for all v0.43.0 features.
• Server auth gates — 12 new authenticated endpoint entries protecting all new API routes.
• Fuzz testing — 3 fuzz targets (csv_parse, jsonl_parse, yara_load) with weekly CI job using cargo-fuzz.
• Admin console test suite — 26 Vitest unit tests covering API client, auth/theme/toast hooks, and App rendering.
• Admin console linting — ESLint 9 flat config with React plugins and Prettier integration.
• Frontend CI — Automated lint and test job for admin-console in GitHub Actions.
• Coverage threshold — cargo-tarpaulin --fail-under 70 enforced in CI.
• Semver compliance — cargo-semver-checks job in CI with graceful baseline fallback.
• Container scanning — Trivy image scanning (CRITICAL/HIGH) in release pipeline.
• OpenAPI enrichment — Rate-limit headers (429), concrete response examples on 8 endpoints.
• Module-level rustdoc — Added //! documentation to 11 previously undocumented source modules.
• Production unwrap removal — Replaced production unwrap() calls in analyst.rs and multi_tenant.rs with safe alternatives.

v0.42.0

Detection Expansion, Unified Asset Inventory & SOC Workflow Overhaul

Added

• Vulnerability scanner (vulnerability.rs) — CVE correlation engine with 10 built-in advisories, semantic version comparison, fleet-wide scanning, and risk-scored vulnerability summaries. API: GET /api/vulnerability/scan, GET /api/vulnerability/summary.
• Network Detection & Response (ndr.rs) — Netflow ingestion with top-talker analysis, unusual destination detection, protocol anomaly scoring, and encrypted-traffic statistics. API: POST /api/ndr/netflow, GET /api/ndr/report.
• Container runtime detection (container.rs) — 13 event kinds and 8 alert types covering container escape, privileged execution, exec-into-container, untrusted images, sensitive mounts, dangerous capabilities, and Kubernetes API abuse. API: POST /api/container/event, GET /api/container/alerts, GET /api/container/stats.
• TLS certificate monitor (cert_monitor.rs) — Tracks certificate expiry (30-day warning, 7-day critical), detects self-signed and weak-key certificates. API: POST /api/certs/register, GET /api/certs/summary, GET /api/certs/alerts.
• Configuration drift detection (config_drift.rs) — Baseline compliance engine for SSH, kernel, and Docker configurations with MITRE ATT&CK mapping. API: POST /api/config-drift/check, GET /api/config-drift/baselines.
• Unified asset inventory (cloud_inventory.rs) — 9 asset types (server, workstation, container, cloud VM, network device, IoT, mobile, virtual, serverless) with upsert, risk scoring, and full-text search. API: GET /api/assets, GET /api/assets/summary, POST /api/assets/upsert, GET /api/assets/search.
• Detection efficacy tracker (detection_efficacy.rs) — Per-rule true-positive/false-positive rate tracking, trend analysis, and summary metrics. API: POST /api/efficacy/triage, GET /api/efficacy/summary, GET /api/efficacy/rule/{id}.
• Guided investigation workflows (investigation.rs) — 5 built-in playbooks (credential-storm, ransomware-triage, lateral-movement, c2-beacon, container-escape) with step-by-step guidance, auto-queries, and analyst progress tracking. API: GET /api/investigations/workflows, GET /api/investigations/workflows/{id}, POST /api/investigations/start, GET /api/investigations/active, POST /api/investigations/suggest.
• Cloud-native Sigma rules — 8 new detection rules (wardex-cloud-007 through 014): IAM role assumption by unusual principal, OAuth high-privilege consent, S3 cross-account policy change, cloud logging disabled, GCP service account key creation, Lambda admin deployment, impossible travel login, and database snapshot shared externally.
• Admin console — Infrastructure tabs — 5 new tabs: Vulnerabilities (scan + summary), NDR (netflow report), Containers (alerts + stats), Certificates (summary + alerts), Assets (inventory + search).
• Admin console — SOC Workbench tabs — 2 new tabs: Investigations (workflow browser, start/track investigations), Efficacy (per-rule TP/FP metrics and trends).

Improved

• ML triage engine — Replaced stub heuristic with a 5-tree Random Forest ensemble (alert_triage_rf_v1) trained on anomaly_score, confidence, suspicious_axes, hour_of_day, day_of_week, alert_frequency, and device_risk_score.
• Notification context enrichment — Slack and Teams alert notifications now include MITRE ATT&CK techniques, kill-chain phase, recommended action, affected hosts, and investigation deep-link.
• Python SDK — 24 new typed methods covering all new API endpoints (vulnerability, NDR, container, certificate, config drift, asset inventory, efficacy, and investigation workflows).
• API surface — 30+ new authenticated endpoints wired with bearer-token auth gates.
• Sigma detection rules — Expanded from 202 to 210 rules across 22 categories (added cloud-native category).

v0.41.5

Structured Operator Details & Investigation Resilience

Fixed

• Raw JSON leakage in operator flows — Live Monitor alert detail, alert analysis, Settings, process inspection, and other operator-facing detail panels now render structured nested views instead of dumping raw payload JSON by default.
• Stale process investigation failures — Investigating a short-lived process no longer collapses to a generic load error; Wardex now shows the last visible snapshot from the live process table when the PID exits before the full inspection completes.
• Technical/detail surface consistency — Raw JSON is now reserved for explicit documentation and export surfaces such as Help & Docs OpenAPI metadata, keeping the embedded console readable for day-to-day operations.

v0.41.4

React Console Consolidation, Process Investigation & Release Refresh

Fixed

• Process false positives — The live process analyzer no longer flags OneDrive Sync Service as netcat, no longer self-detects Wardex when launched from ./..., and treats relative-path launches as an investigation signal instead of an automatic critical hit.
• Embedded admin console drift — The shipped binary now embeds the React admin-console build instead of the retired single-file HTML console, eliminating the split between the latest UI source and the embedded release.
• Operator UI cleanup — Dashboard, Live Monitor, Threat Detection, Settings, and Reports now default to structured operator views instead of raw JSON-heavy panels, and alert investigation opens in a side drawer rather than a bottom popout.

Added

• Process investigation drawer — Operators can click a live process to inspect execution context, network activity, code-signing metadata, behavioural findings, and analyst recommendations, then queue kill or isolate actions from the same surface.
• Admin export surfaces — Live alert/process exports and dedicated Reports & Exports download actions now provide first-class export paths directly from the embedded console.

v0.41.3

Dashboard Layout Polish & Release Copy Sync

Fixed

• Alert Severity Distribution layout — The embedded admin console now keeps the severity chart fully visible inside the dashboard grid, uses a responsive chart shell, and places the legend beneath the doughnut so the card stays aligned across desktop, tablet, and mobile widths.
• Website release labeling — The public site now renders the current version directly alongside the BSL 1.1 licensing copy and footer release badge so operators can identify the exact release at a glance.

v0.41.2

Release Consistency, Live Monitor Guidance & Verification

Fixed

• Live monitor empty state — The embedded admin console no longer tells operators to start monitoring with cargo run -- serve; the initial live-monitor row now renders a neutral loading state until real alert data arrives.
• Release-document drift — README.md, docs/STATUS.md, docs/GETTING_STARTED.md, and the static website now reflect the current release version, current module/API/test counts, and the correct default startup path (cargo run).
• Warning cleanup — Removed fresh-build warning noise in server.rs, pipeline.rs, license.rs, backup.rs, and storage_clickhouse.rs so release builds and test runs stay signal-rich.

Added

• Live Playwright release smoke — Added tests/playwright/live_release_smoke.spec.js to exercise token login, sample alert injection, live monitor refresh, and release screenshot capture against a running server.

v0.41.1

Security Hardening & Bug Fixes

Fixed

• Authentication enforcement — 23 new API endpoints (/api/license, /api/search, /api/metering/*, /api/billing/*, /api/marketplace/*, /api/prevention/*, /api/pipeline/*, /api/backup/*, /api/collectors/*, /api/ml/*, /api/auth/session, /api/auth/logout) now require bearer-token authentication. SSO login/callback remain pre-auth as intended.
• Search endpoint — POST /api/search now executes queries against the SearchIndex instead of returning hardcoded empty results.
• InMemoryEventStore filters — query_events() and count_events() apply all 8 filter fields (device_id, event_class, src_ip, severity_min/max, process_name, time range) instead of ignoring them.
• Pipeline backpressure — Increment-before-check with rollback ensures backpressure threshold is correctly enforced; DLQ releases its mutex before acquiring the metrics mutex to prevent potential deadlocks.
• Marketplace race condition — install_pack() verifies dependency availability before mutating pack state.
• Cluster snapshots — create_snapshot() handles post-compaction state gracefully; try_advance_commit() uses else-break for missing log entries.
• ML normalization — TriageFeatures::to_vec() clamps hour_of_day to [0,23] and day_of_week to [0,6].
• Auth panics — 4x .expect() calls in auth.rs replaced with .unwrap_or_else() to prevent panics on lock poisoning.
• Backup symlink safety — collect_files() skips symbolic links to prevent infinite recursion.
• SSO callback — Requires state parameter for CSRF protection; extracts user identity from id_token claims instead of using hardcoded values.
• License validation — POST /api/license/validate calls validate_license() with real Ed25519 verification.
• Auth session — GET /api/auth/session validates the bearer token and returns actual identity instead of always returning anonymous.
• Admin console RBAC — RoleProvider defaults to viewer (not admin) on API failure; validates HTTP response status before parsing.

v0.41.0

Enterprise Scale: ClickHouse Storage, ML Triage, HA Snapshots & Cloud Collectors

Added

• ClickHouse storage adapter (storage_clickhouse.rs) — EventStore trait with ClickHouseStorage (buffered batch inserts, MergeTree DDL, materialized views, auto-flush, retention purge) and InMemoryEventStore fallback. 12 tests.
• ML triage engine (ml_engine.rs) — TriageResult, TriageLabel enum (TruePositive/FalsePositive/NeedsReview), TriageFeatures normalization, triage_alert() heuristic scoring. API endpoints: GET /api/ml/models, POST /api/ml/triage. 4 new tests.
• HA cluster snapshots (cluster.rs) — Snapshot struct, InstallSnapshotRequest/Response, create_snapshot(), handle_install_snapshot(), compact_log() for log compaction, raft_log_schema() DDL for persistent Raft state (raft_log, raft_state, raft_snapshots tables). 6 new tests (24 total).
• OIDC/SAML SSO endpoints — 5 API routes wired: /api/auth/sso/config, /api/auth/sso/login, /api/auth/sso/callback, /api/auth/session, /api/auth/logout.
• Cloud collector endpoints — 4 API routes: /api/collectors/status (combined AWS/Azure/GCP), /api/collectors/aws, /api/collectors/azure, /api/collectors/gcp.
• Structured logging enhancements (structured_log.rs) — TracingConfig, TracingFormat enum (Json/Pretty/Compact), generate_request_id(), build_logger() factory function.
• React Router + RBAC — Admin console migrated from hash routing to react-router-dom with RequireRole component, RoleProvider, and role-level filtering (viewer/analyst/admin).
• Demo seed data — demo/ directory with Docker Compose, seed.sh script, and JSON datasets: 10 alerts, 10 agents, 5 incidents, 3 cases, 15 IoCs.
• Search module (search.rs) — Full-text SearchIndex with tantivy-style API, query parsing, faceted results. 7 tests.
• Metering module (metering.rs) — MeteringManager with usage tracking, plan limits, overage calculation. 9 tests.
• Billing module (billing.rs) — BillingManager with plans, subscriptions, invoice generation. 9 tests.
• Marketplace module (marketplace.rs) — 10 built-in content packs, install/uninstall lifecycle. 8 tests.
• Prevention module (prevention.rs) — PreventionEngine with default response policies, block/allow/quarantine actions. 9 tests.
• Pipeline module (pipeline.rs) — PipelineManager with ingestion metrics, backpressure tracking, DLQ handling. 7 tests.
• Backup module (backup.rs) — BackupManager with scheduled backups, retention, restore verification. 8 tests.
• License module (license.rs) — Ed25519-signed license validation, tier enforcement, feature gating. API endpoints wired.

Improved

• API surface — 30+ new endpoint blocks wired into server.rs covering all new modules.
• Sigma rules — Expanded from 51 to 202 detection rules across 21 categories.
• Admin console — Full SPA routing with browser back/forward, role-based section visibility, history fallback.

v0.39.5

Admin Console UX Overhaul, Detection Engine Improvements & Escalation Management

Added

• Structured form editor — Settings page replaces raw JSON with toggle switches, number inputs, and text fields organized by section. Form/JSON toggle for power users.
• Monitoring scope toggles — New Settings "Monitoring" tab with toggle switches for each monitoring feature (file integrity, network, auth events, process monitoring) and path listing.
• Config diff view — "Show Changes" button in Settings computes line-by-line diff between saved and current config, highlighting additions (green) and removals (red).
• Reset to defaults — Settings "Reset Defaults" button restores sensible defaults (collection_interval: 15s, alert_threshold: 2.5, entropy: 10%, etc.).
• Recharts visualizations — Dashboard now features severity breakdown pie chart, 24h alert timeline bar chart, and telemetry area chart (CPU + memory trends).
• Dashboard drill-down — Clickable alert rows expand to show score, host, source, agent, signal contributions, and full reason breakdown.
• Alert severity filter — Both Dashboard and Live Monitor support filtering alerts by severity level (all/critical/severe/elevated/low).
• FP feedback button — Each alert in Live Monitor stream has a "FP" button that submits false-positive feedback with auto-extracted pattern from alert reasons.
• Bulk alert actions — Multi-select checkboxes in Live Monitor with bulk operations: Mark as FP, Acknowledge/Triage, Create Incident.
• Cross-signal correlation — Detector applies bonus multiplier when ≥3 signal axes are simultaneously elevated (3→15%, 4→30%, 5→50%, 6+→70%).
• Auth failure rate smoothing — Rolling 8-sample window tracks auth failure acceleration; rate-of-change >4.0 over 3 samples triggers additional detection signal.
• Suppression rules management — ThreatDetection hunts tab includes suppression table with inline creation form (name, rule_id, hostname, severity filters).
• Hunt management UI — ThreatDetection hunts tab displays hunt table with Name/Severity/Owner/Enabled/Threshold/Last Run columns, inline creation form, and per-hunt Run button.
• Escalation management console — New SOC Workbench "Escalation" tab with policy management (create/list with name, severity, channel, targets, timeout), active escalation tracking with acknowledge button.
• Incident detail view — Incident drill-down shows structured fields (ID, severity badge, status, created, updated, owner), related events/alerts/agents, storyline timeline, close/export buttons.
• Escalation API functions — escalationPolicies, createEscalationPolicy, escalationStart, escalationActive, escalationAck, deleteSuppression.

Improved

• Eliminated JSON dumps — SOCWorkbench overview, cases, response, entity, timeline tabs now render structured key-value grids, tables, and timeline views instead of raw JSON blocks.
• Infrastructure structured display — Monitor, correlation, drift, energy, mesh, and system tabs replaced JSON dumps with key-value grids and proper tables.
• Sigma suppressions preview — Sigma tab shows suppression summary table with link to full management in hunts tab.
• Clickable table rows — Dashboard alerts/processes and Live Monitor alerts support click-to-expand for detailed inspection.

v0.39.4

Cross-Platform Process Monitoring, Enhanced Thread Analysis & Bug Fixes

Added

• Cross-platform process monitoring — /api/processes/live, /api/processes/analysis, and /api/host/apps now work on all three platforms (macOS, Linux, Windows) instead of returning empty stubs on non-macOS.
• Linux process analysis — Detects suspicious names (crypto-miners, reverse shells, /tmp execution), high CPU/memory, root non-system processes, and deleted executable detection (fileless malware pattern unique to Linux). Uses ps for CPU/memory enrichment and /etc/passwd for UID resolution. ~45 known system processes whitelisted.
• Linux app inventory — Enumerates installed packages via dpkg-query (Debian/Ubuntu) with automatic rpm fallback (RHEL/Fedora/SUSE).
• Windows process analysis — Detects 25 suspicious patterns including LOLBins (certutil, mshta, regsvr32, rundll32), credential tools (mimikatz, procdump, PsExec), encoded PowerShell, and suspicious execution paths (temp, downloads, AppData). ~33 known system processes whitelisted.
• Windows app inventory — Enumerates installed software via wmic product with registry fallback (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall).
• Enhanced thread analysis — /api/threads/status now reports: OS thread count, process RSS memory (MB), process ID, human-readable uptime, actual sample collection rate, platform/architecture, and subsystem health status.

Improved

• Process analysis deduplication — Linux and Windows analyzers no longer discard lower-risk findings for processes with multiple issues; all findings are reported and sorted by risk.
• Endpoint responses include platform field — All process/apps endpoints include a platform key ("macos", "linux", "windows") so the admin console can display platform-specific context.

v0.39.3

Live Process Monitoring, App Inventory & Admin Console UX

Added

• Live process monitoring — New /api/processes/live endpoint calls macOS collect_processes() directly, returning all running processes with CPU/memory usage. Processes tab in Live Monitor with sortable columns (CPU, Memory, Name, PID), text filtering, and security findings display.
• Process security analysis — New /api/processes/analysis endpoint scans running processes for suspicious names (crypto-miners, reverse shells, tmp execution, encoded commands), high CPU (>80%), high memory (>50%), and non-system root processes. Known macOS system processes (~40) are whitelisted to reduce false positives.
• Installed apps inventory — New /api/host/apps endpoint enumerates /Applications and ~/Applications, reads Info.plist for version and bundle ID, calculates directory size. Displayed in new Infrastructure → Inventory tab.
• System inventory tab — Infrastructure component now has an "Inventory" tab showing hardware info, software packages, services (launchctl), network ports, users, and installed applications in structured tables.
• SOC Workbench process-tree overhaul — Process Tree tab now shows live processes sorted by CPU, security findings with risk-level badges, and deep chain analysis in proper tables instead of raw JSON.

Improved

• Dashboard restructured — Dashboard now organized into five logical sections (System Health, Threat Overview, Process Security, Detection Engine, Recent Alerts) with SectionTitle components instead of raw JSON dumps.
• Live Monitor — Added fourth "Processes" tab with sort controls, filter input, security findings banner, and scrollable process table (top 200 shown with pagination hint).

v0.39.2

Share Links, Alert Grouping UI, Isolation Guidance & Detection Tuning

Added

• Hash-based deep-linking — React admin console now supports URL hash routing (#live-monitor, #settings, etc.) with browser back/forward navigation and a "Share Link" button in the topbar that copies the current view URL to clipboard.
• Version badge — Wardex version (v0.39.2) displayed prominently in the admin console topbar, sourced from the /api/health endpoint.
• Isolation & response guidance — Alert analysis now includes per-detection-reason isolation_guidance with specific threat descriptions and step-by-step remediation instructions for: network burst, auth failures surge, integrity drift, process count spike, entropy anomalies (low/high), memory pressure, thermal deviation, and disk pressure.
• Structured analysis display — Analysis tab in Live Monitor renders a rich UI with summary, metrics cards, severity breakdown, reason table, and isolation guidance cards instead of raw JSON.

Improved

• Alert grouping display — Grouped alerts tab renders a proper table with severity, count, scores, time range, and reasons instead of a raw JSON dump.
• Entropy anomaly threshold — Low entropy detection threshold tightened from 15% to 10% of max entropy, and score boost reduced from 0.4 to 0.25, significantly reducing false positives on single-host deployments where metrics like battery, temperature, and integrity are naturally stable.
• Network burst threshold — Raised from 1800 kbps (1.8 Mbps) to 3500 kbps (3.5 Mbps) to reduce false positives from normal development and operational traffic while still detecting genuine data exfiltration.

v0.39.1

Comprehensive Security Hardening, Bug Fixes & Clippy Cleanup

Security

• ZK proof forgery (CRITICAL) — proof.rs Sigma ZK verification accepted any response value. Redesigned to XOR-based nonce masking scheme (response = H(k) XOR H(c)) with algebraically verifiable recovery.
• Deterministic spool encryption (CRITICAL) — spool.rs used a fixed counter with no IV, making ciphertext deterministic. Added random 16-byte nonce prepended to each encrypted spool, with spool_encrypt/spool_decrypt split.
• Threat-intel fuzzy matching over-reach — threat_intel.rs applied fuzzy/substring matching to all IoC types including hashes and IPs. Restricted to BehaviorPattern and NetworkSignature only.

Fixed

• Unbounded timing variance — side_channel.rs Welford accumulator grew monotonically and never reflected the sliding window. Recompute mean/variance from windowed samples on each push.
• WASM compiler ignored operator precedence — wasm_engine.rs compiled expressions left-to-right with no precedence. Implemented shunting-yard algorithm with correct precedence for * / + - > < >= <= == && || !.
• Sigma regex alternation — sigma.rs Re modifier failed to expand (a|b|c) alternation groups, causing silent rule misses.
• Sigma kernel event suppression borrow conflict — sigma.rs evaluate_kernel_event borrowed engine immutably while needing mutable suppression access. Refactored to collect candidate rules first.
• CSV escape corrupted negative numbers — archival.rs quoted any field starting with -, breaking numeric exports. Added parse::<f64>() guard.
• Campaign empty-set Jaccard returned 1.0 — campaign.rs treated two empty technique sets as identical. Now returns 0.0.
• Benchmark median for even-length arrays — benchmark.rs took wrong index. Fixed to average the two middle elements.
• FIM stale baselines for deleted files — fim.rs reported deletions but never cleaned up baseline entries, causing repeated alerts.
• Alert analysis unsorted cluster members — alert_analysis.rs computed first/last_seen from unsorted members. Added timestamp sort before window calculation.
• WebSocket subscriber ID reuse — ws_stream.rs used HashMap::len() as subscriber ID, causing collisions after unsubscribe. Switched to monotonically incrementing counter.
• Event forwarder O(n^2) drain — event_forward.rs used remove(0) in a loop. Replaced with drain(0..excess).
• Edge-cloud scheduler ignored resource limits — edge_cloud.rs placed EdgeOnly workloads without decrementing remaining CPU/memory.
• UEBA impossible travel near-zero time — ueba.rs divided by near-zero hours producing infinite speed. Added automatic detection for hours < 0.001 && dist > 100km.
• Lateral movement NaN panic — lateral.rs partial_cmp unwrap panicked on NaN scores. Changed to unwrap_or(Equal).
• Kill chain phase misclassification — kill_chain.rs mapped T1021/T1570/T1534/T1080 (lateral movement) to ActionsOnObjectives instead of Installation.
• Ransomware low-entropy false positives — ransomware.rs threshold of 1.0 was too permissive. Raised to 2.0.
• AWS collector truncation split UTF-8 — collector_aws.rs byte-sliced strings, potentially splitting multi-byte characters. Uses char_indices().take_while() now.
• Response stale-expiry lost audit trail — response.rs expire_stale silently expired requests without recording an audit entry.
• Response approve endpoint ignored body approver — server.rs always used auth identity as approver, ignoring the approver field from the JSON body.
• Spool constructor panicked on bad key — spool.rs new() used assert!. Added try_new() returning Result, new() delegates with .expect().
• React useApi stale closure — hooks.jsx fetch callback captured stale state. Used fnRef pattern and fixed loading initial state for skipped hooks.
• React LiveMonitor index-based selection — LiveMonitor.jsx used array index for alert selection, breaking on list reorder. Switched to stable alert IDs.
• React SOCWorkbench index fallbacks — SOCWorkbench.jsx used array index 0 as fallback for missing IDs.
• React FleetAgents blob URL leak — FleetAgents.jsx created blob URLs for export without revoking them.

Changed

• Zero clippy warnings — resolved all clippy lints: unnecessary casts, useless format!, collapsible if, is_multiple_of(), and from_str trait shadowing.
• Verification — automated test count is now 1145 (982 lib + 163 integration).
• Version sync — Cargo, Helm, Kubernetes, OpenAPI, SDK, admin console, docs, and site metadata aligned to 0.39.1.

v0.39.0

Detection Engine Improvements, React Admin Console, MITRE Coverage & ML Stub

Added

• MITRE ATT&CK coverage tracker (src/mitre_coverage.rs) — 12 tactics, ~65 techniques in matrix, 27 builtin detection-module mappings, heatmap generation, coverage summary with gap analysis, 5 tests.
• Detection tuning profiles — TuningProfile enum (Aggressive/Balanced/Quiet) with configurable threshold multipliers and learn thresholds, plus normalized 0-100 threat scoring via sigmoid mapping.
• False-positive feedback loop (src/alert_analysis.rs) — FpFeedbackStore tracks analyst FP markings per alert pattern, computes FP ratios and suppression weights (min 0.1, requires ≥5 samples), 4 tests.
• IoC aging / TTL purge (src/threat_intel.rs) — purge_expired(now, ttl_days) removes stale IoCs; enrichment_stats() provides by-type/severity/source breakdowns, 3 tests.
• ML inference engine stub (src/ml_engine.rs) — InferenceEngine trait, StubEngine placeholder with 3 planned model slots (anomaly detector, entity classifier, alert triage). Prepared for future ONNX runtime integration, 4 tests.
• 12 new Sigma rules — fileless malware (LOLBins, .NET assembly load), persistence (Run keys, scheduled tasks, systemd, LaunchAgent), defense evasion (indicator removal, masquerading, timestomping), exfiltration (alt protocol, large transfer, archive creation).
• 11 new API endpoints — /api/threat-intel/stats, /api/threat-intel/purge, /api/mitre/coverage, /api/mitre/heatmap, /api/detection/profile (GET/PUT), /api/fp-feedback (POST), /api/fp-feedback/stats, /api/detection/score/normalize.
• React admin console — full Vite + React 19 migration of admin console with 10 sections (Dashboard, Live Monitor, Threat Detection, Fleet & Agents, Security Policy, SOC Workbench, Infrastructure, Reports & Exports, Settings, Help & Docs), all wired to ~160 live API endpoints with auth, dark/light theme, auto-refresh, toast notifications, MITRE heatmap visualization, and tabbed navigation.

Fixed

• Auth token display — server startup now prints the full 64-character API token instead of only the first 8 characters, fixing the "wrong token" login issue after fresh start.

Changed

• Verification — automated library test count is now 981 (991 total with chaos integration).
• Version sync — Cargo, Helm, Kubernetes, OpenAPI, SDK, docs, and site metadata aligned to 0.39.0.

v0.38.1

Approval Separation, Audit Attribution, and Post-Release Hardening

Security

• Response self-approval blocked — response.rs now rejects approval decisions where the approver is the original requester, enforcing separation of duties for approval-gated response actions.

Fixed

• GraphQL aggregate runtime wiring — the aggregate query path is now registered in the server execution layer instead of existing only in schema/tests.
• Hunt automation production wiring — response actions now execute from scheduled and manual hunt runs, using full matched event/agent scope instead of sample-only context.
• Threat-intel expiry ordering — IoC expiry evaluation now compares RFC3339 timestamps chronologically and avoids mixed parsed/string fallback errors.
• Response notify gating — min_level is enforced when evaluating hunt notification actions.
• Response target deduplication — hunt automation no longer collapses multiple agents that share a hostname when generating response targets.
• Hunt incident reuse — repeat automation runs now update an existing open hunt incident instead of creating duplicates on every run.
• Response request IDs — manual and automated response request IDs now use the hardened unique ID helper instead of timestamp-only generation.
• Approval audit attribution — live-response sessions and playbook executions now record the authenticated actor rather than trusting request-body identity fields.

Changed

• Version sync — Cargo, Helm, Kubernetes, OpenAPI, SDK, docs, and site metadata aligned to 0.38.1.
• Verification — automated library test count is now 963 passing tests.

v0.38.0

XDR Enrichment, Aggregation Engine, Response Automation & Security Fixes

Security

• CRLF header injection (CRITICAL) — notifications.rs format_email() now sanitises all user-controlled fields (\r stripped, \n → space) before interpolation into email headers, preventing SMTP header injection attacks.

Fixed

• Jaccard empty-set similarity — campaign.rs alert_similarity() returned 0.0 for two empty technique/reason sets; now correctly returns 1.0 (identical empty sets).
• UEBA risk decay collapse — ueba.rs risk decay was applied per-second instead of per-hour, causing rapid decay to zero after frequent observations. Changed to apply only for hours_elapsed >= 1.0 using hours_elapsed.floor() in the exponent.
• Incident auto-cluster early break — incident.rs auto_cluster_incidents() broke after merging into the first matching open incident, silently skipping other qualifying incidents. Removed break in both MITRE-technique and severe-burst clustering loops.

Added

• UEBA peer-group normalization (XDR Phase B) — new PeerGroupBaseline struct, peer_group_baseline() for aggregate group stats, and peer_deviation_check() that flags entities deviating >3× risk or >5× data volume vs. peers (excluding self from baseline).
• GraphQL aggregation engine (XDR Phase C) — AggregateOp enum (Count/Sum/Avg/Min/Max/Distinct) with FromStr, aggregate() supporting optional GROUP BY over JSON arrays, full AggregateResult/AggregateGroup types, and schema integration.
• Hunt response automation (XDR Phase D) — HuntResponseAction enum (Notify/CreateIncident/AutoSuppress/IsolateAgent), SavedHunt extended with response_actions, tags, mitre_techniques fields, and evaluate_responses() method with template variable substitution.
• STIX/TAXII data enrichment (XDR Phase E) — threat_intel.rs gains ingest_stix_bundle() for STIX 2.1 indicator parsing, batch_check() for bulk IoC lookups, expiring_iocs() for feed rotation, and parse_stix_pattern() supporting 8 IoC types.
• 17 new tests (931 → 948): CRLF injection, empty-set similarity, risk decay preservation, peer deviation detection, multi-incident clustering, 7 GraphQL aggregation tests, 2 response automation tests, 3 STIX/threat-intel tests.

Changed

• Clippy — AggregateOp::from_str() refactored to impl std::str::FromStr to satisfy clippy::should_implement_trait.

v0.37.0

Production Hardening: Code Safety, Structured Logging, Release Optimisation

Fixed

• 25 unwrap/panic sites eliminated — cluster.rs (15 mutex locks), feature_flags.rs (8 mutex locks), entity_extract.rs (1 parts.last().unwrap()), storage.rs (1 Option::clone().unwrap()). All mutex locks now use unwrap_or_else(|e| e.into_inner()) for poison recovery.
• Double-unwrap on storage initialisation fixed in server.rs (2 sites, shipped in v0.36.3 hotfix).
• Raft log gap vulnerability — cluster.rs handle_append() now rejects non-contiguous entries instead of silently creating log gaps that could cause state divergence across cluster nodes.
• Spool nack data-loss bug — spool.rs nack() was popping a new entry from the front of the queue instead of retrying the failed one. Changed signature to accept the failed entry, ensuring correct retry semantics.
• RBAC authorization bypass — check_rbac() in server.rs returned true when no RBAC users were configured, allowing any authenticated token to bypass authorization. Now correctly denies non-admin access when RBAC is unconfigured.
• Version sync — fixed 10+ stale version references across site, SDK, OpenAPI, Helm values, Kubernetes manifests, and documentation.

Changed

• Structured logging — all ~45 eprintln! calls in production code converted to log::info!/log::warn!/log::error! via the log crate. env_logger initialised at startup; set RUST_LOG=info (or debug/trace) to control verbosity.
• Release profile optimised — [profile.release] added with lto = true, codegen-units = 1, strip = true. Binary size reduced to ~8.6 MB.
• Clippy-clean codebase — [lints.clippy] all = "warn" enforced. 220 warnings resolved (auto-fixes + manual). unsafe_code = "forbid" at crate level.
• Version sync — Cargo.toml, Helm Chart.yaml, README, STATUS, and ROADMAP all aligned to 0.37.0.

Added

• 11 new tests — cluster concurrent-operations safety, commit-index advancement, election check, Raft gap rejection, feature-flags kill-switch override, concurrent stress, unknown-flag safety, entity-extract edge cases (empty input, domain validation, no-IP verification), spool multi-entry nack correctness. Total: 931 lib tests.
• env_logger = "0.11" and log = "0.4" dependencies.

v0.36.3

TLS/mTLS Listener, Chaos Tests Expansion, Hardening 98%

Added

• TLS/HTTPS listener — opt-in tls Cargo feature enables Server::https() via rustls. Set WARDEX_TLS_CERT and WARDEX_TLS_KEY env vars to activate. Falls back to plain HTTP when not configured or feature not compiled.
• mTLS support — ListenerMode::Tls carries full TlsConfig including client CA path and require_client_cert for mutual TLS agent authentication.
• 5 new chaos/fault-injection tests — oversized headers, wrong HTTP methods, empty/invalid auth headers, rapid endpoint sweep, oversized JSON bodies. Total chaos tests: 10.

Changed

• Production hardening score updated from 95% (56/59) to 98% (58/59). Only 1 control remains: package manager distribution (10.5).
• Startup banner now shows https:// scheme when TLS is active.
• Warns at startup if WARDEX_TLS_CERT/KEY env vars are set but binary was compiled without tls feature.

Tests

• 920 lib + 10 chaos integration tests passing, 0 failures, 0 warnings.

v0.36.2

Complete Retention Purge, Production Hardening 95%

Added

• Metrics purge — purge_old_metrics(retention_days) in storage.rs; wired into background scheduler.
• Response actions purge — purge_old_response_actions(retention_days) in storage.rs; wired into background scheduler.

Changed

• Background retention scheduler now purges all 4 record types (alerts, audit_log, metrics, response_actions) instead of just 2.
• Production hardening score updated from 80% (47/59) to 95% (56/59). Only 3 controls remain: mTLS for agents, package manager distribution, chaos testing.

Tests

• 920 lib tests passing, 0 failures, 0 warnings.

v0.36.1

Bug Fixes: Spool Safety, WASM, Ransomware API, Migration Rollback

Fixed

• Spool counter overflow — replaced .expect() panic with wrapping_add() in spool cipher counter (src/spool.rs).
• WASM div-by-zero — replaced overly strict f64::EPSILON comparison with == 0.0 check (src/wasm_engine.rs).
• Dead code cleanup — removed unused crc32_simple() function and its test from archival.rs. Zero compiler warnings.

Added

• Ransomware detector API — GET /api/detectors/ransomware endpoint exposing multi-signal ransomware evaluation (velocity, extension entropy, canary, FIM drift).
• DB migration rollback — POST /api/admin/db/rollback endpoint and StorageBackend::rollback_migration() method executing sql_down for the most recent migration.
• Spool tenant isolation — peek_for_tenant(), dequeue_for_tenant(), drain_for_tenant(), len_for_tenant() methods for tenant-scoped spool operations.
• Audit chain purge test — validates verify_audit_chain() succeeds after purge_old_audit() rechain.

Tests

• 920 lib tests passing (+4 net: 5 new tenant isolation/audit tests, 1 dead CRC32 test removed), 0 failures, 0 warnings.

v0.36.0

Completeness: GraphQL, Real SMTP/Gzip, Poison Recovery, Syslog

Added

• GraphQL API — wired /api/graphql POST endpoint with 5 resolvers (alerts, agents, status, events, hunts) backed by live AppState, plus schema introspection.
• Syslog forwarding — audit events forwarded via UDP RFC 5424 to configurable target (WARDEX_SYSLOG_TARGET env var) with severity mapping.
• DB schema version API — GET /api/admin/db/version endpoint returning migration history and current schema version.
• Schema introspection — StorageBackend::schema_version() and schema_info() methods exposing migration state.

Changed

• Real gzip compression — replaced CRC32/DEFLATE stub in archival.rs with flate2::GzEncoder for standards-compliant gzip output.
• Real SMTP delivery — replaced email stub in notifications.rs with full SMTP conversation (EHLO → MAIL FROM → RCPT TO → DATA → QUIT) over TCP with retry and exponential back-off.
• Mutex poison recovery — all 232 .lock().unwrap() sites now use .unwrap_or_else(|e| e.into_inner()) to survive poisoned mutexes without panicking.
• OpenAPI spec bumped to 0.36.0 with GraphQL and DB version endpoint definitions.

Tests

• 916 lib tests passing, 0 failures.

v0.35.0

Ship-Readiness, Operational Maturity, and Competitive Differentiation

Added

• OpenAPI 3.0.3 spec (openapi) — machine-readable API documentation with OpenApiSpec, OpenApiBuilder fluent API, wardex_openapi_spec() factory covering 90+ endpoint definitions, 18 tags, full schema objects (Alert, Incident, Agent, Error), and JSON serving via /api/openapi.json.
• Prometheus metrics (metrics) — native text exposition format (no external dependency) with MetricsRegistry, SharedMetrics (Arc<Mutex>), 20+ wardex_* prefixed counters/gauges/histograms, thread-safe record_*() helpers, and serving via GET /metrics.
• WebSocket event stream (ws_stream) — RFC 6455 frame encoder/decoder with masking support, EventBus pub/sub with ring buffer, per-subscriber channel filtering, WsConnection tracking, compute_accept_key handshake, and convenience event constructors for alerts, incidents, agents, and heartbeats.
• Python SDK (sdk/python/) — wardex PyPI package with WardexClient providing ~30 typed methods (alerts, incidents, agents, detection, events, policies, IOCs, response, reports, config, metrics, OpenAPI), custom exception hierarchy (WardexError, AuthenticationError, NotFoundError, RateLimitError, ServerError), and 10 unit tests with responses mocks.
• Structured logging (structured_log) — JSON-formatted log output with LogLevel (Trace→Fatal), LogEntry struct, pluggable LogSink trait (StdoutSink, BufferSink, FileSink), Logger with minimum-level filtering and default fields, SharedLogger, and helper functions request_log(), security_log(), audit_log().
• Kubernetes manifests + Helm chart (deploy/) — production-ready k8s manifests (Deployment, Service, ConfigMap, Ingress, PVC) with security contexts, resource limits, and Prometheus annotations, plus a full Helm chart (deploy/helm/wardex/) with configurable values, helpers, and conditional resources.
• Data archival (archival) — ArchivalEngine with JSONL+gzip compression, CSV export with dynamic column detection, SHA-256 checksums, manifest sidecars, retention-based pruning, and S3 upload stubs.
• Sigma rule library (rules/sigma/, sigma_library) — 39 detection rules across 6 categories (authentication, network, endpoint, IoT/OT, cloud, supply chain), YAML multi-document parser, query API (find_by_id, find_by_tag, find_by_level, find_by_category), and simple event matching engine.
• Compliance templates (compliance_templates) — pre-built framework mappings for CIS Controls v8 (11 controls), PCI-DSS v4 (11), SOC 2 Type II (9), and NIST CSF 2.0 (10), with AutoCheck evaluation engine, SystemState input struct, and per-control pass/fail scoring.
• CI hardening (.github/workflows/ci.yml) — weekly scheduled runs, cargo-audit security scan, cargo-tarpaulin code coverage with artifact upload, MSRV check (Rust 1.88.0), and Cargo dependency caching.
• GraphQL query layer (graphql) — lightweight execution engine with GqlSchema, query parser supporting selections/args/aliases/sub-fields, GqlExecutor with resolver registration and sub-field filtering, introspection (__schema), and wardex_schema() with 12 root query fields and 10 types.
• HA clustering (cluster) — Raft-inspired leader election with ClusterNode, NodeRole (Follower/Candidate/Leader), term-based voting, log replication with AppendRequest/AppendResponse, majority-based commit advancement, per-peer status tracking, health monitoring, and fencing token support.

Tests

• cargo test passes with 1,025 automated tests (878 unit + 147 integration).

v0.34.0

Production Hardening: Persistence, Enforcement, Notifications, and SBOM

Added

• Persistent storage backend (storage) — atomic JSON file persistence with StorageBackend, SharedStorage (thread-safe), stored alerts/cases/audit entries/agent state, query filters (tenant, level, device, time range, pagination), schema migrations, audit chain integrity via SHA-256, and retention purge.
• Real enforcement execution (enforcement) — EnforcementExecutor with dry-run mode, command safety filter (whitelisted: kill, pfctl, nft, iptables, chmod, mv, mkdir, echo), execute() / execute_batch(), kill_process(), quarantine_file(), block_network() / unblock_network() with IP validation, platform-conditional shell execution, and execution logging.
• Outbound notifications (notifications) — NotificationEngine delivering to Slack (blocks API), Microsoft Teams (MessageCard), PagerDuty (Events API v2), generic Webhook, and Email (SMTP stub). Per-channel severity filtering, retry with exponential back-off (3 attempts), and delivery history.
• Alert deduplication (alert_analysis) — deduplicate_alerts() grouping alerts by fingerprint with configurable time-window splits, optional cross-device merging, max-merge limits, and DedupIncident output with aggregated statistics.
• Atomic agent update with rollback (auto_update) — AtomicUpdater with 5-step pipeline (download → verify SHA-256 → backup → swap → validate), automatic rollback on failure, explicit rollback_to_previous(), state machine tracking, and update history.
• Dashboard deep-linking (site/admin.js, site/admin.html) — URL hash-based deep-links (#reports/sample/3), navigateToHash() / shareableUrl() / copyShareLink(), history.replaceState integration, and share-link button in topbar.
• Operator runbooks (docs/runbooks/) — new deployment and troubleshooting runbooks covering atomic upgrades, fleet enrollment, diagnostics, common errors, log analysis, and escalation paths.
• YARA rule engine (yara_engine) — lightweight YARA-style pattern matching with text/hex/glob patterns, AllOf/AnyOf/AtLeast/AllOfWithMaxSize conditions, file scanning, 4 built-in rules (ELF packed, webshell, cryptominer, ransomware note), and JSON rule loading.
• Timeline visualization (site/admin.js, site/admin.html) — renderTimeline() with severity-colored dots, proportional positioning, click-to-navigate, legend, and timeline container in Reports section.
• Multi-tenancy hardening (multi_tenant) — TenantGuard for access isolation, cross_tenant_summary(), update_tier(), resolve_request() API key lookup, filter_by_tenant(), and Enterprise/Government-only cross-tenant access.
• Real mesh networking (swarm) — MeshTransport with MeshFrame (checksum, hop limits), PeerConnection state tracking, send() / broadcast() / receive() with integrity validation, heartbeats, frame forwarding, and TransportStats.
• SBOM generation (sbom) — SbomGenerator producing CycloneDX 1.5 and SPDX 2.3 documents from Cargo.lock, with dependency tracking, component PURLs, file export, and UUID generation.

Tests

• cargo test passes with 915 automated tests (768 unit + 147 integration).

v0.33.0

Advanced Threat Hunting, Analytics, and Detection Fusion

Added

• Playbook condition DSL (playbook) — evaluate_condition() function supporting numeric operators (>, <, >=, <=, !=), string equality (==), CONTAINS operator, and AND/OR compound expressions with variable substitution.
• Named entity extraction (entity_extract) — new module extracting IPs, domains, file paths, SHA-256/MD5 hashes, MITRE technique IDs, port numbers, and suspicious process names from alert reason text with deduplication.
• File integrity monitoring (fim) — FimEngine with policy-based watched paths, SHA-256 baseline checksums, scan/check operations detecting modified/new/deleted files, and platform-specific default critical paths.
• Fleet campaign clustering (campaign) — CampaignDetector using Jaccard similarity on MITRE technique + reason sets, time-windowed adjacency (1h default), connected-component extraction, and multi-host campaign reports.
• Memory forensics (memory_forensics) — MemoryForensics engine detecting RWX regions, unbacked executable sections, and process hollowing (image-base mismatch + high entropy). Platform-specific collection plans for Linux (6 artifacts), macOS (4), and Windows (4).
• Side-channel score fusion (detector) — CompoundThreatDetector.evaluate_with_side_channel() integrates SideChannelReport risk level into compound threat scores (critical +1.5, elevated +0.8).
• Device fingerprint EWMA drift (fingerprint) — update_ewma() method for online fingerprint adaptation, allowing gradual device profile evolution while detecting abrupt impersonation.
• Deception engine enhancements (threat_intel) — deploy_random_canary_set() auto-deploys one of each decoy type with randomised names; attacker_behavior_profile() reconstructs multi-decoy attack paths per source.
• Digital twin calibration (digital_twin) — calibrate_from_real() snaps twin state to real-world telemetry and returns per-parameter drift report.
• Federated convergence loop (privacy) — convergence_loop() runs multi-round federated averaging until convergence delta drops below target threshold, with pluggable update generation.
• UEBA geo-validation (ueba) — GeoIpResolver with prefix-matching IP→location lookup and validate_geo() impossible-travel check integrated into UEBA observations.
• Sigma-KernelEvent bridge (sigma) — kernel_event_to_sigma_fields() converts KernelEvent into Sigma-compatible field maps; evaluate_kernel_event() evaluates all loaded Sigma rules against kernel events without OCSF conversion.

Tests

• cargo test passes with 832 automated tests (685 unit + 147 integration).

v0.32.0

Enterprise XDR: kernel monitoring, behavioral analytics, and incident automation

Added

• Kernel event abstraction (kernel_events) — unified KernelEvent enum normalising eBPF (Linux), Endpoint Security Framework (macOS), and ETW (Windows) telemetry into a single stream with thread-safe ring buffer, MITRE ATT&CK auto-tagging (suggest_mitre), and 22 event kinds (process exec/exit, file ops, network, registry, AMSI, WMI persistence, TCC, Gatekeeper, SELinux/AppArmor denials, container events).
• UEBA engine (ueba) — per-entity behavioural profiling with login-time anomalies, impossible-travel detection (haversine), process/port/data-volume deviation scoring, peer-group comparison, risk decay, and warm-up suppression.
• Kill-chain reconstruction (kill_chain) — maps alert sequences through Reconnaissance → Weaponisation → Delivery → Exploitation → Installation → C2 → Actions-on-Objectives with phase scoring and gap analysis.
• Lateral movement detection (lateral) — graph-based tracking of host-to-host connections with fan-out analysis, depth scoring, and credential-reuse correlation.
• Beacon / DGA / DNS-tunnelling detection (beacon) — C2 beacon detection via inter-arrival jitter analysis, DGA domain flagging (Shannon entropy + consonant ratio), and DNS-tunnelling indicators (query length, TXT ratio).
• SOAR playbook engine (playbook) — declarative playbook definitions with trigger matching (severity, MITRE techniques, host patterns), 11 step types (RunAction, Notify, Enrich, Conditional, Parallel, Escalate, Contain, etc.), execution tracking, and approval gates.
• Live response sessions (live_response) — interactive forensic sessions with per-platform command whitelists (Linux 17, macOS 20, Windows 17 commands), audit logging, file retrieval tracking, and session timeouts.
• Automated remediation (remediation) — 14 remediation actions (KillProcess, QuarantineFile, BlockIp, DisableAccount, etc.) with platform-specific command generation for Linux/macOS/Windows, rollback snapshots, and approval gating.
• Escalation engine (escalation) — SLA-driven auto-escalation with multi-level policies, 7 notification channels (Email, Slack, PagerDuty, Teams, Webhook, SMS, Syslog), on-call rotation, and acknowledgement tracking.
• Evidence collection plans (forensics) — per-platform artifact catalogues: Linux 20 artifacts, macOS 18 artifacts, Windows 17 artifacts, with volatile/persistent filtering.
• OS-specific containment commands (enforcement) — Linux (cgroup, nftables, seccomp, namespace isolation), macOS (sandbox-exec, pfctl, ESF muting), Windows (Job objects, netsh, AppLocker, WFP).
• 30+ new API endpoints — full REST coverage for all new engines: UEBA observe/risky/entity, beacon connection/dns/analyze, kill-chain reconstruct, lateral connection/analyze, kernel event push/recent, playbook CRUD/execute/executions, live-response sessions/commands/audit, remediation plan/results/stats, escalation policies/start/acknowledge/SLA-check, evidence plans, containment commands.

Tests

• cargo test passes with 786 automated tests (639 unit + 147 integration).

v0.31.0

Enterprise operations, website refresh, and release packaging

Added

• Enterprise domain layer — new persisted enterprise subsystem for saved hunts, scheduled hunt execution, native content rules, rule test/promote/rollback flows, suppressions, content packs, enrichment connectors, ticket sync, IDP/SCIM configuration, change-control entries, diagnostics metrics, entity pivots, and incident storyline generation.
• Enterprise APIs — new endpoints for hunts, hunt history and execution, content rules, packs, suppressions, MITRE coverage, entity profile and timeline, incident storyline, enrichment connectors, ticket sync, identity providers, SCIM config, admin audit, support diagnostics, and dependency health.
• SOC Workbench v2 — investigation pivots, storyline loading, evidence export, enterprise response context, and richer case/incident workflows in the admin console.
• Detection Engineering UI — hunts, suppressions, managed rule controls, MITRE coverage rendering, and refresh flows in the browser console.
• Enterprise admin surfaces — identity and provisioning management, connector management, diagnostics, change-control review, and manager-level overview widgets in the console.
• Reusable browser smoke — repository-tracked Playwright smoke coverage for the enterprise console.

Improved

• Public website refresh — the landing site now presents Wardex as a product surface centered on platform workflows, enterprise readiness, deployment, and operator resources instead of backlog and implementation-log sections.
• Documentation alignment — refreshed README, feature summary, getting-started guide, status doc, and roadmap so release posture, capabilities, and operator guidance are consistent with the shipping product.
• Release metadata — version bumped to 0.31.0, product description updated, and release packaging prepared for Linux, macOS, and Windows tagged builds.

Fixed

• Live admin smoke stability — the enterprise browser smoke now seeds a sample alert before asserting live-monitor content and correctly re-opens the sidebar when validating mobile navigation.
• Integration-test warning cleanup — removed a non-fatal scheduled-hunt polling warning in the enterprise API regression suite.

Tests

• cargo test passes with 692 automated tests.
• Live browser smoke passes for the enterprise admin console.

v0.30.0

XDR/SIEM depth, UI polish & hardening

Added — Phase A: Quick Polish

• Loading skeletons — shimmer animations for alerts and XDR event tables during data fetch.
• Rich empty states — icon + title + subtitle + action button shown when alerts, events, or incidents tables are empty.
• Confirm modal — all destructive confirm() calls replaced with a styled async modal dialog (showConfirm()).
• Copy-to-clipboard — one-click copy buttons for enrollment tokens and admin session tokens.
• Theme toggle — light/dark theme switch with full CSS variable overrides and persistent localStorage preference.
• Severity-colored metric cards — threat level cards dynamically styled by severity class.
• Error handling — all silent catch blocks replaced with log() calls for visibility.

Added — Phase B: UI Restructure

• Fleet tab split — Fleet & Agents section split into 3 tabs: Fleet Overview, Agent Registry, Events & Triage.
• Incident Response tab split — IR section split into 3 tabs: Incidents, Investigation, Response.
• Chart.js theme awareness — charts adapt grid/tick/label colors to light or dark theme; resize on section switch.
• ARIA accessibility — role="tablist", role="tab", role="tabpanel" on all tab systems; aria-label on 7 data tables.

Added — Phase C: XDR Wiring

• Correlation score escalation — cross-agent correlated alerts receive a +0.15 score boost (capped at 1.0) with level re-evaluation.
• Response execution — execute_approved() method transitions Approved→Executed with descriptive action logs; new POST /api/response/execute endpoint.
• Agent policy enforcement — background policy poll thread applies server-pushed alert_threshold and interval_secs to the agent monitoring loop via Arc<Mutex<>>.

Added — Phase D: SIEM Depth

• SIEM config API — GET/POST /api/siem/config endpoints for runtime SIEM configuration; config() and update_config() methods on SiemConnector.
• SIEM retry with backoff — send_to_siem() retries up to 3 times with exponential backoff (500ms, 1s, 2s).
• STIX/TAXII 2.1 client — TaxiiClient pulls STIX indicator objects from TAXII collection endpoints, parses patterns and confidence into SiemIntelRecord; new GET /api/taxii/status, GET/POST /api/taxii/config, POST /api/taxii/pull endpoints.
• SIEM/TAXII configuration UI — Settings card with SIEM push config (type, endpoint, token, index) and TAXII 2.1 threat intel config (URL, auth, poll interval, manual pull button).

Added — Phase E: Hardening

• Enrollment token TTL — expires_at field on EnrollmentToken with new_with_ttl() constructor; is_valid() checks both uses and expiry; POST /api/agents/token accepts optional ttl_secs.
• Forensic bundle encryption — write_encrypted() / read_encrypted() using AES-256-GCM (12-byte nonce ∥ ciphertext); aes-gcm dependency added.
• CSS transitions — smooth transitions on buttons, cards, and interactive elements; touch target sizing (44px minimum on coarse pointer devices).

Tests

• 667 tests (542 unit + 125 integration), all passing.
• New tests: STIX pattern parsing, STIX bundle parsing, TAXII disabled client, SIEM config getter/setter, token TTL valid/expired/round-trip, forensic encryption round-trip + wrong-key rejection.

v0.29.1

Code review hardening & admin panel improvements

Fixed

• CORS origin validation — cors_origin() now rejects wildcard "*" origins and validates that the SENTINEL_CORS_ORIGIN value uses an http:// or https:// scheme, defaulting to "http://localhost" for invalid or missing values.
• CSV formula injection — csv_escape() now prefixes cell values starting with =, +, -, @, |, or tab with a single-quote character to prevent spreadsheet formula injection in exported CSV files.

Added

• Session Management panel (admin console Settings) — displays session info (uptime, token age, TTL, expiry countdown, status, mTLS requirement) and provides one-click token rotation with automatic UI credential refresh.
• Audit & Retention panel (admin console Settings) — shows audit chain integrity status (record count, checkpoint count, head hash) with verify button, and retention policy controls (max records per category, current counts) with apply/refresh actions.
• Auto-load on navigation — opening the Settings section now automatically refreshes session info and retention status alongside existing settings data.

Improved

• Comprehensive code review — 38-point review covering security, error handling, logic, code quality, API design, test coverage, performance, and deployment. Verified constant-time token comparison and checkpoint interval guards were already in place from v0.29.0.

v0.29.0

Production hardening: session management, retention, container & service deployment

Added

• Token TTL & session expiry — configurable security.token_ttl_secs (default: 1 hour) with automatic rejection of expired tokens in check_auth(). GET /api/auth/check now returns TTL metadata (ttl_secs, remaining_secs, token_age_secs).
• Token rotation — POST /api/auth/rotate generates a new admin token and resets the TTL clock, immediately invalidating the previous token.
• Session info — GET /api/session/info returns uptime, token age, TTL, expiry status, and mTLS requirement.
• Configurable retention policies — new [retention] config section with audit_max_records, alert_max_records, event_max_records, audit_max_age_secs, and remote_syslog_endpoint. GET /api/retention/status shows policy and current counts. POST /api/retention/apply trims alerts and events to configured limits.
• Audit chain verification endpoint — GET /api/audit/verify reports audit log integrity status, record count, and chain verification result. Added verify_and_report() and apply_retention() to the cryptographic AuditLog.
• Spool per-tenant partitioning — SpoolEntry now carries an optional tenant_id. Added enqueue_with_tenant(), entries_for_tenant(), and tenant_counts() for multi-tenant event isolation.
• mTLS configuration — new [security] config section with require_mtls_agents and agent_ca_cert_path fields, wiring into the existing TLS module's with_mtls() support.
• Remote log forwarding — retention.remote_syslog_endpoint config field for remote syslog destination, complementing the existing SIEM connector push capabilities.
• Dockerfile — multi-stage container build with non-root user, health check, read-only filesystem, and volume for persistent state. Includes docker-compose.yml reference.
• Systemd service unit — deploy/wardex.service with full security hardening (NoNewPrivileges, ProtectSystem, MemoryDenyWriteExecute, etc.), journal logging, and restart policy.
• Launchd plist — deploy/com.wardex.agent.plist for macOS service deployment with KeepAlive and throttle interval.
• Chaos/fault injection tests — 5 new integration tests: rapid token rotation stress (10 cycles), concurrent burst load (50 requests), malformed JSON resilience, expired token rejection across endpoints, and path traversal rejection.
• 6 new API integration tests — token rotation, session info, auth check TTL metadata, audit verify, retention status, retention apply.
• 8 new unit tests — security/retention config round-trips, audit verify/report, audit retention trimming, spool tenant-aware enqueue/filter/persist.

Improved

• EventStore — added count() and apply_retention(max) methods for policy-driven event trimming.
• 656 tests (531 unit + 125 integration), all passing.

v0.28.0

Research tracks UI, monitoring UX, and code review hardening

Added

• Research Tracks panel — new admin console section displaying all 40 research tracks (R01–R40) grouped into 8 thematic categories, with expandable detail cards showing approach, rationale, and current state. Includes filter-by-status controls (Foundation/Scaffolded/Planned/Future) and live track count.
• Research Tracks nav item — dedicated navigation entry between Reports & Exports and Settings.

Improved

• Monitoring scope UX (Settings) — the "Monitoring Scope" header now clearly indicates it applies to the Main Server & Default for Agents, with guidance text explaining that per-agent overrides are available in Fleet & Agents.
• Per-agent monitoring scope layout (Fleet) — replaced inline flex-wrap with a proper responsive grid layout (grid-template-columns: repeat(auto-fill, minmax(170px, 1fr))) for cleaner alignment of the 13 monitoring toggles. Improved description text to reference Settings → Monitoring Scope.

Fixed

• Critical: IIFE scope bug — 11 inline onclick handlers referenced functions defined inside the IIFE closure, causing ReferenceError at runtime for Sigma Rules refresh, Case Management (refresh/new/submit/cancel), Alert Queue refresh, RBAC (add/refresh), and Feature Flags refresh. Replaced all inline onclick attributes with addEventListener wiring inside the IIFE.
• XSS vulnerability — dynamically generated onclick attributes for Alert Queue "Ack" and RBAC "Remove" buttons used single-quoted string literals that could be broken by crafted IDs/usernames. Replaced with data-* attribute event delegation pattern.
• Missing CSS variables — --danger, --green, and --teal were used but never defined in :root. Added definitions: --danger: #ef4444, --green: #22c55e, --teal: #14b8a6.
• Missing CSS class — .dot-teal was used in Case Management and Process Tree section headers but never defined. Added definition.

v0.27.1

Bug-fix: network burst false positives & RBAC admin bypass

Fixed

• Critical: macOS network byte overcounting — netstat -ib lists each interface multiple times (once per address: Link, IPv4, IPv6, etc.) with identical cumulative byte counters. The collector summed all rows, inflating the metric by up to 9× on en0. Now only <Link#N> rows are counted, yielding accurate kbps values and eliminating cascading false "network burst" alerts.
• RBAC admin token lockout — after adding the first RBAC user, the admin token holder was denied sensitive operations (DELETE users, config, shutdown) because the RBAC enforcement checked "admin-bootstrap" which didn't exist in the user store. Admin token holders now bypass RBAC entirely.
• Minimum column check — macOS collect_network() now requires ≥ 10 columns (was 7), matching the actual netstat -ib layout.

Added

• tests/live_test.py — comprehensive 77-endpoint live server test harness.
• tests/verify_admin.py — admin console data-shape verification script.

v0.27.0

Phase 27: Operational contract & production hardening

Added

• OpenAPI 3.0 specification (docs/openapi.yaml) covering all 149 API endpoints with schemas, tags, and security annotations.
• GET /api/openapi.json — public endpoint serving the OpenAPI spec.
• GET /api/slo/status — service-level objective metrics (latency, error rate, availability, budget).
• POST /api/rbac/users and DELETE /api/rbac/users/{username} — RBAC user create/remove endpoints.
• Schema lifecycle documentation (docs/SCHEMA_LIFECYCLE.md) — versioning strategy, compatibility rules, migration process, fixture validation.
• Disaster recovery plan (docs/DISASTER_RECOVERY.md) — backup/restore procedures, RTO/RPO, key escrow, DR validation tests.
• SLO policy (docs/SLO_POLICY.md) — availability, latency, and error budget definitions with alerting rules.
• Deployment models guide (docs/DEPLOYMENT_MODELS.md) — standalone, multi-tenant, edge relay, regional federation.
• Threat model (docs/THREAT_MODEL.md) — promoted from handoff pack with adversary profiles, abuse cases, trust boundaries.
• Production hardening checklist (docs/PRODUCTION_HARDENING.md) — 59-control scorecard (47 implemented, 80%).
• XDR professional roadmap (docs/ROADMAP_XDR_PROFESSIONAL.md) — Tier 1–4 feature plan through Phase 36.
• Request counter (request_count, error_count) in server state for SLO computation.

Fixed

• Critical: apiFetch() undefined in admin console — 16 call sites used an undefined function, making all newer admin sections non-functional. Defined proper apiFetch() helper.
• Data-shape bugs in admin console — refreshSigma(), refreshRbac(), refreshCases() now correctly unwrap server response objects (.rules, .users, .cases).
• Sigma stats field name — stats.total_matches → stats.total_rules.
• Separated server rate limiting into read/write/static buckets so authenticated admin polling no longer self-triggers 429 Too Many Requests under normal use.
• Hardened the default CORS origin to http://localhost when SENTINEL_CORS_ORIGIN is unset.

Changed

• Admin console createCase() upgraded from browser prompt() to professional inline form with priority, description, and tags.
• Admin console ARIA accessibility: skip-to-main link, role attributes, aria-current navigation, keyboard handlers, focus-visible styles.
• Copyright updated to 2025–2026.
• generate_admin.py deprecated — edit site/admin.html directly.
• Version bumped to 0.27.0; 160/160 backlog tasks complete; all 27 phases done.

v0.26.0

Phase 26: Security audit fixes

Fixed

• RBAC enforcement on sensitive writes: check_rbac() previously returned true on all paths, effectively bypassing role-based access control. Now uses RbacStore::check_api_access() to deny sensitive write operations when RBAC users are configured and the request lacks sufficient privileges.
• RateLimiter memory leak: The per-IP rate-limit bucket map never evicted stale entries, allowing unbounded memory growth from ephemeral client IPs. Added periodic cleanup that retains only entries active within the last 120 seconds.
• Audit log status code accuracy: AuditLog::record() was always called with a hardcoded 200 status. Now extracts the actual HTTP response status via response.status_code().0 before recording.
• Spool cipher counter overflow protection: Upgraded the CTR-mode counter from u64 to u128 and switched from wrapping to checked_add() to prevent silent counter reuse (theoretical at u64, impossible at u128).

Changed

• Version bumped to 0.26.0.

v0.25.0

Phase 25: Code review hardening, platform collectors, analyst console

Added

• Phase 23 — OCSF, Sigma, Response, Feature Flags, Process Tree, Spool, RBAC (T188–T194):
• Phase 24 — Platform collectors, analyst console, SIEM formats, DLQ wiring (T195–T203):
• Phase 25 — Code review hardening (T204–T207):

Changed

• Total modules: 58 (was 44).
• Total tests: 635 (521 unit + 114 integration), up from 437.
• Runtime manifest: 120/120 tasks, 25 phases.
• Version bumped to 0.25.0.

Added

• Per-agent monitoring scope: Each enrolled agent can now have a custom monitoring scope override (CPU, memory, network, disk, processes, auth events, thermal, battery, file integrity, services, LaunchAgents, systemd units, scheduled tasks). GET/POST /api/agents/{id}/scope manages overrides; heartbeat responses now include the effective scope so agents can dynamically adjust collection.
• Cross-platform scope gating: All 13 monitoring signals in the collector are now individually gated by their respective scope toggle. Previously only 3 of 13 signals respected scope settings.
• Bulk event triage: POST /api/events/bulk-triage accepts an array of event IDs and applies status, assignee, tags, and notes to all in one call (max 500 events). The event table now has checkboxes for multi-select with a "Bulk Triage" button.
• Deployment rollback: POST /api/updates/rollback creates a new downgrade deployment targeting a previous release version with allow_downgrade: true. Rollback and Cancel buttons appear in the Agent Drilldown when a deployment is active.
• Deployment cancellation: POST /api/updates/cancel moves a pending deployment to cancelled status immediately.
• Automatic staged rollout progression: When auto_progress is enabled in rollout settings, completed canary deployments auto-progress to ring-1 after the configured soak period, and ring-1 auto-progresses to ring-2. Failed deployments trigger automatic rollback when auto_rollback is enabled.
• Rollout configuration API: GET /api/rollout/config returns current rollout settings; settings are patchable via the config reload endpoint with { "rollout": { ... } }.
• Admin UI rollout panel: Auto-rollout settings (progression toggle, soak times, auto-rollback, max failures) are now configurable directly from the Fleet section.
• Agent monitoring scope panel: The Fleet section now includes a per-agent monitoring scope configuration panel with 13 toggles and server-default reset functionality.
• Durable XDR event history: Fleet events are now persisted to JSON on disk so analyst workflow and fleet history survive server restarts.
• Event triage workflow: POST /api/events/{id}/triage lets operators assign analysts, attach tags, add notes, and move events through new, acknowledged, investigating, contained, and resolved states.
• Rollout controls for remote updates: Remote deployments now support rollout groups (direct, canary, ring-1, ring-2) and explicit downgrade opt-in for controlled rollback scenarios.

Changed

• Fleet dashboard payload: Dashboard analytics now include triage counts, event-history persistence status, and rollout-group summaries for deployments.
• Admin console Fleet view: Event Explorer now supports triage-state filtering, inline triage updates, bulk operations, and remote deployments expose rollout-group, rollback, and cancellation controls.
• Heartbeat protocol: Heartbeat responses now include monitor_scope with the effective monitoring scope for the agent (custom override or server default) and auto-rollout progression checks.
• Public architecture section: The GitHub Pages landing page now renders the pipeline stages as a responsive architecture board instead of a cramped horizontal strip.

v0.23.0

Fleet drilldowns and remote deployments

Added

• Remote agent update assignment: Operators can now assign a published release to a specific enrolled agent. Assigned versions are surfaced in heartbeat responses and prioritized during agent update checks.
• Agent drilldown API and UI: Fleet now exposes per-agent detail views with recent event timelines, risk transitions, aggregate risk metrics, and pending deployment visibility.
• Filtered event exploration and CSV export: GET /api/events now supports agent, severity, reason, and correlation filters, and GET /api/events/export exports the filtered result set as CSV for incident triage.
• Monitoring path health checks: Settings now report whether active file-integrity and persistence baseline paths exist and are readable on the current host.

Changed

• Fleet dashboard payload: The Fleet summary now includes recent release catalog data and pending deployment counts so the admin console can drive remote rollout actions directly.
• Agent update client flow: Agent downloads now resolve relative update URLs correctly and can react immediately to server-assigned deployment targets instead of waiting only for periodic polling.

v0.22.0

XDR analytics and monitoring visibility

Added

• Fleet event analytics: XDR now computes top attack reasons, severity mix, hot-agent risk summaries, and fleet-wide correlation rate from agent event traffic.
• Policy history visibility: Admin console can now inspect published policy history instead of only the current active version.
• Monitoring path visibility: Settings now show the active file-integrity and persistence baseline paths derived from the current monitoring scope.

Changed

• Authenticated event reads: GET /api/events and the new GET /api/events/summary now require admin auth while agent-side event ingestion remains tokenless for enrolled agents.
• Fleet posture freshness: Agent staleness is refreshed before agent-list and fleet-dashboard reads so XDR analytics use current status rather than stale cached values.

v0.21.1

Phase 24 follow-up

Added

• Scoped persistence baselines: Service-persistence monitoring now baselines OS-specific startup locations for systemd units, macOS LaunchAgents/LaunchDaemons, and Windows Scheduled Tasks when enabled in Settings.
• Per-platform operator guidance in Settings: The Monitoring Scope panel now explains which monitoring points are recommended or unavailable on the current host and shows how many persistence baseline paths are active.

Changed

• Auth-event scope toggle is live: Authentication-event collection is now a real configurable collector toggle instead of a read-only placeholder.
• Local monitor baselines persist across samples: File-integrity and persistence monitors now retain their baselines between server refresh cycles instead of being rebuilt on every sample.

v0.21.0

Phase 24

Added

• OS-aware monitoring scope settings: Settings now expose a Monitoring Scope section driven by host platform and capability data. Operators can see what is monitored, what is recommended on the current OS, and which signals are planned but not yet available.
• GET /api/monitoring/options: New authenticated endpoint returns grouped monitoring options, support status, recommendations, and host metadata for the admin console.

Fixed

• Frontend auth regressions: Settings loading, checkpoint counts, detection summary, and thread status requests now consistently send Bearer auth headers after Phase 23 hardening.
• Alert detail stale reopen: Manually closed alert detail rows no longer re-open on the next refresh because stale cached detail state is cleared correctly.
• Live report summary counts: /api/report now reports critical_count accurately instead of folding severe alerts into the critical total.
• Config validation and hot reload semantics: Negative severity thresholds are rejected, monitor intervals must be positive, numeric fields must be finite, and flat legacy patch fields now override nested objects predictably.
• File-integrity scope control: Local file-integrity monitoring now respects the configured monitoring scope instead of running whenever watch paths exist.

Security

• Additional sensitive GET endpoints now require auth: /api/checkpoints, /api/correlation, /api/monitoring/options, and /api/host/info metadata are aligned with the authenticated admin-console contract.

v0.20.0

Phase 23

Added

• Alert sort by criticality: Dropdown to sort alerts by Critical → Elevated or Elevated → Critical, in addition to default time order.
• Alert detail survives refresh: Open detail rows are preserved across auto-refresh cycles instead of being destroyed by table re-render.

Fixed

• False alarm suppression: Raised elevated_score from 1.4 → 2.8 and learn_threshold from 1.35 → 2.5 so normal system noise (~2.0 score) no longer triggers constant "Elevated" alerts. Baseline now adapts to normal fluctuations instead of freezing.
• Consecutive-sample confirmation: Monitor thread requires 2 consecutive elevated-score samples before firing an alert. Critical/Severe bypass confirmation for immediate response.
• Reports show live data: /api/report now generates report from live monitoring alerts instead of falling back to demo sample data. Empty state returns an empty report rather than synthetic data.

Security

• Auth required on sensitive endpoints: GET /api/alerts, /api/alerts/count, /api/report, /api/status, /api/endpoints, /api/threads/status, /api/detection/summary, and /api/telemetry/* now require Bearer token authentication. Only /api/health remains public.
• Frontend sends auth headers: All fetch calls (refreshAlerts, refreshReport, refreshStatus, refreshTelemetry, refreshHostInfo, loadApiEndpoints, refreshHealth) now include auth headers.

Removed

• Research Blueprint Coverage section removed from the Help panel along with renderTracks() function and related state.

v0.19.0

Phase 22

Added

• Graceful shutdown via CLI and web console: Real ctrlc::set_handler() for SIGINT/SIGTERM handling. POST /api/shutdown endpoint with auth and server.unblock() for clean exit. Shutdown button in Settings "Danger Zone" with double-confirmation dialog.
• Expandable alert detail rows: Click any alert row to reveal full telemetry snapshot (all 10 metrics) and detection analysis (score, confidence, all reasons, severity classification, recommendation). GET /api/alerts/{index} endpoint returns analysis JSON. Accordion-style collapsing (one open at a time).
• Help section redesign: Three categorised sections (Getting Started / Detection & Architecture / Reference) with improved spacing, line-height, and typography. All CLI commands and API references updated.
• Alert detail API: GET /api/alerts/{index} returns full telemetry, all detection reasons, severity class, multi-axis flag, and contextual recommendation.

Security

• JSON injection fixes: Replaced format!(r#"..."#) string interpolation with serde_json::json!() in agent deregistration, fleet registration, threat-intel IOC, and mode-set endpoints.
• Bounded body reads for chunked encoding: New read_body_limited() helper using std::io::Read::take() enforces 10 MB limit even for chunked transfer encoding. All 17 request body reads migrated.
• Sensitive GET endpoints require auth: /api/telemetry/current, /api/telemetry/history, /api/host/info, /api/config/current now behind token authentication.
• Auth on /api/mesh/heal: POST endpoint added to auth-required list.
• Consistent security headers: X-Frame-Options: DENY on static files (was SAMEORIGIN), Cache-Control: no-store added to static responses.

Changed

• serve_loop rewritten from blocking iterator to recv_timeout(500ms) + shutdown check loop for clean exit.
• handle_api accepts server: &Server parameter for shutdown coordination.
• AppState gains shutdown: Arc<AtomicBool> field.
• Runtime manifest updated to 109/109 tasks, 22 phases.
• Version bumped to 0.19.0.

v0.18.0

Phase 21

Added

• Velocity rate-of-change detector: Tracks per-axis first derivative (velocity) and second derivative (acceleration) over a sliding window. Flags ramp-ups where the latest velocity exceeds mean + σ·std, even when absolute values remain below static thresholds. Configurable window size and sigma threshold.
• Shannon entropy detector: Computes per-axis entropy over a sliding window using histogram binning. Low entropy (<15% of max) flags constant attack traffic (cryptominers, DDoS floods). High entropy on auth-failures axis (>90%) flags randomised credential stuffing and evasion.
• Compound multi-axis threat detector: Counts simultaneously elevated axes and applies a score multiplier (score × (1 + fraction × 0.5)) when ≥40% of axes spike together. Detects coordinated attacks that spread across CPU, network, auth, disk, and temperature.
• Detection analysis panel in admin console: Threat Detection section now shows velocity, entropy, and compound detector configuration with live status from /api/detection/summary.
• GET /api/detection/summary endpoint returning velocity/entropy/compound detector state.
• Help & Docs updates: Three new detection method sections in the "How Detection Works" accordion.

Security

• Path traversal hardening: canonicalize() validation on static file serving prevents symlink-based directory escape.
• Request body size limit: 10 MB cap on API request bodies with 413 rejection.
• Security headers: X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Cache-Control: no-store on JSON responses; X-Frame-Options: SAMEORIGIN, X-Content-Type-Options: nosniff, and CORS headers on static file responses.
• MIME type coverage: Added ico and woff2 content types.

Changed

• Monitor thread now enriches EWMA signals with velocity, entropy, and compound analysis before alert threshold evaluation.
• Runtime manifest updated to 102/102 tasks, 21 phases.
• Version bumped to 0.18.0.

v0.17.1

Phase 20

Added

• Business Source License 1.1 (BSL 1.1): Free for development, testing, evaluation, and non-commercial use. Production commercial use requires a separate license. Converts to Apache 2.0 on 2029-04-01. See LICENSE.
• Global collapsible activity log panel: Docked to the bottom of the admin console across all views. Auto-expands when a new log entry arrives. Collapse/expand toggle and clear button. Replaces the Reports-only log area.
• Icon-only responsive sidebar: At ≤1024 px the sidebar collapses to 52 px width showing only icons. Hover CSS tooltip shows the full label. Full sidebar visible at >1024 px. Below 680 px the sidebar slides in/out as a drawer overlay (same as before).
• Ctrl+K / ⌘+K keyboard shortcut: Focuses the level filter in Reports & Exports, or the API token input on all other views. Also expands the activity log panel.

Changed

• Version bumped to 0.17.1.
• Cargo.toml: license field changed from "MIT" to license-file = "LICENSE" (BSL 1.1).
• README.md: License section updated with BSL 1.1 explanation.
• docs/STATUS.md: Phase 19 and Phase 20 entries added. Summary updated to Phases 0–20.
• site/index.html: Footer updated to v0.17.0, Phase 0–19, 434 tests, BSL 1.1 link.
• Admin console footer now shows "BSL 1.1" with link to LICENSE file.

v0.17.0

0.17.0

Added

• Phase 19 — Professional admin console, local auto-monitoring, demo mode (T164–T167).
• Local system auto-monitoring (T164): Background telemetry collection thread with 300-sample ring buffer. Server automatically monitors the host it runs on — no separate agent needed. Endpoints: GET /api/telemetry/current, GET /api/telemetry/history, GET /api/host/info, GET /api/threads/status.
• Professional dark-themed admin console (T165): Complete rewrite of admin.html. Dark theme with fixed sidebar navigation across 10 sections (Dashboard, Live Monitor, Threat Detection, Fleet & Agents, Security Policy, Incident Response, Infrastructure, Reports & Exports, Settings, Help & Docs). Canvas-based telemetry sparklines. Responsive layout with mobile sidebar toggle. Self-contained HTML with inline CSS/JS.
• Demo mode (T166): Client-side attack simulation toggle. Generates synthetic escalating telemetry (normal baseline → cryptominer + credential stuffing → critical) with real-time gauge and alert updates. No server-side state modification.
• Comprehensive help & documentation (T167): Accordion-based help section covering: what is monitored (10 telemetry axes explained), how detection works (EWMA, multi-axis scoring, modes, threat levels), XDR architecture, API reference (auto-loaded from endpoint listing), CLI commands, platform support, getting started guide, demo mode usage. Research Blueprint Coverage moved to Help section.

Changed

• Version bumped to 0.17.0.
• Status manifest: 96/96 tasks, 19 phases (was 92/92, 18 phases).
• #[allow(dead_code)] annotation on ServiceManager struct to suppress display_name warning.

v0.16.0

0.16.0

Added

• Phase 18 — XDR fleet management with SIEM integration (T157–T163).
• Agent enrollment (T157): enrollment.rs with token-based agent authentication, heartbeat tracking, staleness detection, file-backed JSON store. 5 tests.
• Agent client (T158): agent_client.rs for lightweight agent mode — enrollment, heartbeat, event forwarding, policy fetching, auto-update check/download/apply. 4 tests.
• Event forwarding (T159): event_forward.rs with cross-agent correlation (detects same anomaly across multiple agents within time window). 4 tests.
• Policy distribution (T160): policy_dist.rs with versioned policy bundles and rollback history. 3 tests.
• Service installation (T161): service.rs with cross-platform service installer — systemd (Linux), launchd (macOS), sc.exe (Windows). 5 tests.
• SIEM integration (T162): siem.rs with Splunk HEC, Elasticsearch bulk API, and generic JSON output; pull-based threat intel feed ingestion. 11 tests.
• Agent auto-update (T163): auto_update.rs with SHA-256 binary verification, semver comparison, path traversal protection. 5 tests.
• Central server + lightweight agent architecture: single binary runs as wardex server or wardex agent.
• XDR Fleet Dashboard in admin console with agent table, correlation alerts, enrollment token creation.
• 15+ new API endpoints for enrollment, heartbeat, event forwarding, policy distribution, SIEM status, fleet dashboard, update management.
• 8 new integration tests covering enrollment lifecycle, event ingestion, policy publish, SIEM status, fleet dashboard, and update checks.

Changed

• Version bumped to 0.16.0.
• Total modules: 44 (was 37).
• Total tests: 434 (342 unit + 92 integration), up from 387.
• Status manifest: 92/92 tasks, 18 phases.

v0.15.0

0.15.0

Added

• Phase 17 — Cross-platform XDR agent with live monitoring (T151–T156).
• Host telemetry collector (T151): collector.rs (~680 lines) with cross-platform OS detection (HostPlatform enum), live metric collection (CPU, memory, temperature, network, auth failures, battery, processes, disk pressure) via /proc/, sysctl, vm_stat, wmic dispatch, FileIntegrityMonitor with SHA-256 baselines, AlertRecord with syslog/CEF formatters. 12 unit tests.
• Simplified startup (T152): cargo run (no args) defaults to combined serve+monitor mode, cargo run -- start for explicit combined mode, cargo run -- monitor for CLI-only headless monitor. Auto-creates var/wardex.toml on first run. Ctrl+C graceful shutdown.
• Webhook & alert output (T153): send_webhook() via ureq, --syslog and --cef CLI flags for standard alert formats.
• Server alert API & health (T154): GET /api/health (version, uptime, platform), GET /api/alerts (last 100), GET /api/alerts/count (breakdown by severity), DELETE /api/alerts (clear), GET /api/endpoints (self-documenting), POST /api/config/save (persist to disk). Configurable CORS via SENTINEL_CORS_ORIGIN env var. 7 new integration tests.
• Admin console panels (T155): Live Monitoring panel with auto-polling alert table (3s), alert summary strip (total/critical/severe/elevated), health bar, CSV export. Settings panel with 6 config sections (Monitor, Notifications, File Integrity, Detection Tuning, Policy Thresholds, Server). Toast notification system. Token show/hide toggle.
• Monitor config model (T155): MonitorSettings struct in config.rs with interval, threshold, webhook, syslog, CEF, watch paths, dry-run, duration. Nested ConfigPatch support for admin console.

Changed

• Version bumped to 0.15.0.
• ureq promoted from dev-dependencies to dependencies.
• Status manifest: 85/85 tasks, 17 phases.
• Total test count: 387 (303 unit + 84 integration), up from 369.

Removed

• All hardcoded "2026" date references from source, docs, and site.
• AI tool entries from .gitignore.

v0.14.0

0.14.0

Added

• Phase 16 — Production hardening & self-healing (T147–T150).
• ML-DSA-65 post-quantum hybrid signatures (T147): MlDsaKeyPair with deterministic signing, HybridSignature dual-verification (classical Lamport + PQ ML-DSA), PqHybridCheckpoint with sign_checkpoint_hybrid() / verify_checkpoint_hybrid(). 8 new tests.
• TLS server configuration module (T148): TlsConfig with cert/key paths, mTLS client CA, TLS version enforcement (1.2/1.3), cipher suite selection, Unix key-permission checks, ListenerMode abstraction. GET /api/tls/status endpoint. 10 unit + 1 integration test.
• Zero-downtime config hot-reload (T149): ConfigPatch partial-update struct, apply() with validation and automatic rollback on failure, HotReloadResult. GET /api/config/current and POST /api/config/reload endpoints. 3 unit + 4 integration tests.
• Mesh self-healing topology (T150): BFS spanning-tree computation, connected-component partition detection, repair proposal algorithm (AddEdge, PromoteRelay, Reroute), SwarmNode::self_heal() and apply_repair() methods. GET /api/mesh/health and POST /api/mesh/heal endpoints. 12 unit + 2 integration tests.

Changed

• Version bumped to 0.14.0.
• Status manifest: 81/81 tasks, 16 phases (was 77/77, 15 phases).
• Total test count: 369 (292 unit + 77 integration), up from 329.

v0.13.0

0.13.0

Added

• Phase 15 — Integration test coverage & paper evaluation harnesses (T142–T146).
• 49 new HTTP integration tests (T142): covers all 40+ API endpoints including auth checks for every POST endpoint, bringing integration test count from 21 to 70.
• Per-sample latency benchmark (T143): run_latency_benchmark() in src/benchmark.rs with LatencyStats struct (mean, median, p95, p99, min, max in microseconds).
• Audit chain scaling benchmark (T143): run_audit_scaling_benchmark() measuring append + verify throughput at configurable chain lengths (10–100K records).
• 4 new benchmark unit tests: latency measurement, audit scaling at 3 sizes, 10K-record audit chain, and 1K-sample latency target.
• RESEARCH_TRACKS.md rewrite (T144): all 40 tracks updated from stale (many marked "Future"/"Planned") to accurate "Implemented foundation" status with current repo state descriptions.
• PAPER_TARGETS.md update (T145): Paper 1 gap analysis updated (5 of 9 gaps now closed), Papers 2 and 3 prerequisites marked as met.

Changed

• Version bumped to 0.13.0.
• Status manifest: 77/77 tasks, 15 phases (was 72/72, 14 phases).
• Total test count: 329 (259 unit + 70 integration), up from 276.

v0.12.0

0.12.0

Added

• Phase 14 — Full admin console integration (T137–T141): Every feature module is now wired to the admin console with API endpoints and interactive UI panels.
• 18 new API endpoints (T137): /api/side-channel/status, /api/quantum/key-status, /api/quantum/rotate, /api/privacy/budget, /api/policy-vm/execute, /api/fingerprint/status, /api/harness/run, /api/monitor/status, /api/monitor/violations, /api/deception/status, /api/deception/deploy, /api/policy/compose, /api/drift/status, /api/drift/reset, /api/causal/graph, /api/patches, /api/offload/decide, /api/swarm/posture, /api/energy/harvest.
• Security Operations panel (T138): enforcement status/quarantine, threat intel IOC management, side-channel risk display, deception engine deploy.
• Fleet, Digital Twin & Testing panels (T139): fleet device registration, swarm posture, digital twin simulation, adversarial harness execution.
• Monitoring & Analysis panel (T140): temporal monitor status/violations, correlation analysis, drift detection reset, fingerprint status, causal graph.
• Compliance, Quantum, Policy, Infrastructure, Formal Exports panels (T141): compliance scoring, attestation status, privacy budget, quantum key rotation, policy composition, WASM VM execution, energy harvest/consume, patch management, workload offload, TLA+/Alloy/witness export.
• Monitor Predicate trait now requires Send for thread-safe admin console state.

Changed

• Version bumped to 0.12.0 (was 0.10.0 in Cargo.toml, 0.11.0 in changelog).
• Admin console expanded from 6 panels to 14 panels with full feature coverage.
• AppState expanded with 10 new module instances for complete feature wiring.

v0.11.0

0.11.0

Added

• Runtime pipeline wiring (T132): All Phase 12 modules (threat intel, enforcement, digital twin, energy, side-channel, compliance) are now integrated into the execute() pipeline. Enrichment data (enforcement actions, TI matches, energy state, side-channel risk, compliance score) flows through the full pipeline and appears in console reports.
• Criterion micro-benchmarks (T133): benches/pipeline.rs with four benchmark groups — full pipeline scaling (5/50/200/1000 samples), detector evaluate, policy evaluate, and throughput measurement (~55K samples/sec). Unblocks Paper 1 evaluation methodology.
• Continual learning loop (T134): DriftDetector (Page-Hinkley algorithm) and ContinualLearner wrapper that monitors anomaly score distribution and automatically resets/re-learns the baseline when concept drift is detected. Advances R01 from foundation to research-grade.
• Policy composition algebra (T135): CompositePolicy, compose_decisions(), and PolicyConflict types supporting four composition operators (MaxSeverity, MinSeverity, LeftPriority, RightPriority) with conflict detection. Advances R39 and enables Paper 2 evaluation.
• 9 new unit tests (276 total: 255 unit + 21 integration).
• RunResult now includes enforcement_actions, threat_intel_matches, energy_state, side_channel, and compliance_score fields.
• Console report output includes enforcement, threat intel, energy, side-channel, and compliance summaries.

Changed

• ureq dev-dependency now uses default-features = false to avoid ring build issues on some platforms.
• Pipeline throughput improved through integrated module wiring.

v0.10.0

0.10.0

Added

• Extended test fixtures (T110): four 120-sample CSV datasets (benign, credential storm, slow escalation, low-battery attack) for paper evaluation.
• Fixed-threshold baseline detector (T111): static per-signal threshold detector in fixed_threshold.rs with run_fixed_benchmark for comparison against adaptive EWMA.
• bench CLI command (T112): head-to-head detector comparison printing precision/recall/F1/accuracy and throughput.
• Per-signal contribution aggregation (T113): BenchmarkResult now carries averaged per-signal attribution; printed by bench CLI.
• 11 new unit tests (147 total: 126 unit + 21 integration).
• New source module: fixed_threshold.rs.

Changed

• CLI commands increased to 12 (added bench).
• BenchmarkHarness now tracks and averages per-signal contributions.

v0.9.0

0.9.0

Added

• Adapter-backed checkpoint restore (T100): rollback now reapplies abstract device isolation/quarantine state via pluggable action adapters.
• TLA+ and Alloy model export (T101): PolicyStateMachine::export_tla() and export_alloy() produce formal verification modules; /api/export/tla and /api/export/alloy endpoints.
• Proof backend interface (T102): DigestBackend and ZkStubBackend with serializable witness export; /api/export/witnesses endpoint.
• Single-source research-track data (T103): canonical research_tracks.json consumed by runtime, API (/api/research-tracks), and admin console with static-file fallback.
• Supply-chain attestation foundations (T104): BuildManifest generation with SHA-256 artifact hashing, TrustStore management, manifest/artifact verification, /api/attestation/status endpoint.
• export-model and attest CLI commands.
• 31 new unit tests (115 unit + 21 integration).
• New source modules: attestation.rs, proof.rs.

Changed

• CLI commands increased to 11 (added export-model, attest).
• Admin console trackGroups replaced with async loadTrackGroups() fetching from API/static JSON.

v0.8.0

0.8.0

Added

• Correlation engine integration (T090): runtime execute() now runs Pearson correlation analysis on the replay buffer and includes results in audit logs and console output.
• Temporal-logic monitor integration (T091): runtime pipeline feeds sample, alert, action, and transition events to a default safety monitor; violations are reported in audit and console output.
• Correlation API endpoint (T092): GET /api/correlation returns live correlation analysis of samples seen by the server-side replay buffer.
• Harness CLI command (T093): cargo run -- harness runs the adversarial test harness and prints evasion rates and coverage metrics.
• Behavioural device fingerprinting (T094): new fingerprint.rs module with DeviceFingerprint training from telemetry windows and Mahalanobis-inspired impersonation detection (R38).
• Server-side replay buffer in AppState — analyzed and demo samples are pushed to a 200-sample ring buffer for live correlation.
• 8 new unit tests across runtime, fingerprint modules (105 total: 91 unit + 14 integration).
• New source module: fingerprint.rs.

Changed

• CorrelationResult and CorrelatedPair fields changed from &'static str to String for serde compatibility.
• CLI commands increased to 9 (added harness).
• R38 research track status updated from "future" to "foundation".

Fixed

• JSONL line numbers in /api/analyze now enumerate before filter so errors report original file positions (CQ-12).
• observed_samples in detector uses saturating_add to prevent overflow (CQ-13).
• State machine step() validates transitions via is_legal() before accepting (CQ-14).
• Fingerprint standard deviation uses Bessel's correction (n−1) to avoid inflated z-scores with small sample counts (CQ-16).
• DeviceFingerprint::train() returns None if NaN/Inf propagates through computation (CQ-17).
• Temporal-logic monitor now receives state machine transition events so no_skip_escalation property is exercised (CQ-20).

v0.7.0

0.7.0

Added

• Explainable anomaly attribution (T080): per-signal contribution breakdown in AnomalySignal — each signal dimension's weighted score contribution is captured and included in JSON reports.
• Config validation (T081): Config::validate() checks threshold ordering (critical > severe > elevated), smoothing in [0.0, 1.0], non-zero warmup, and checkpoint interval. Called automatically on config load.
• Anomaly correlation engine (T082): Pearson-based multi-signal co-movement detection across replay buffer windows with co-rising signal identification.
• Temporal-logic runtime monitor (T083): lightweight SentinelTL property checker supporting safety (always P) and bounded-liveness (within N samples P) properties over live event streams.
• Adversarial test harness (T084): grammar-based evasion fuzzer with SlowDrip, BurstMask, and DriftInject strategies, decision-surface coverage metrics, and evasion rate measurement.
• 27 new unit tests across detector, config, correlation, monitor, and harness modules (96 total: 82 unit + 14 integration).
• Three new source modules: correlation.rs, monitor.rs, harness.rs.

v0.6.0

0.6.0

Added

• 14 end-to-end HTTP API integration tests (tests/api_integration.rs)
• 10,000-sample benchmark test validating detector performance at scale
• Auto-refresh exponential backoff with resume button in admin console
• Research-track status table (40 tracks) in admin console with badge styling
• Collapsible partially-wired and not-implemented detail lists in status panel
• FEATURES.md one-page marketing summary
• CHANGELOG.md

Changed

• CI matrix expanded to Linux, macOS, and Windows with cargo clippy and cargo fmt
• Version bumped from 0.1.0 to 0.6.0; license set to MIT
• Analyze and run-demo endpoints now feed the live detector baseline (enables meaningful checkpoints)
• Server request loop extracted into serve_loop with spawn_test_server for integration testing
• StatusManifest now includes research_tracks field with all 40 R-tracks

Fixed

• Checkpoint save returned 0 on fresh detector — now works after any analysis run
• PersistedBaseline now persists process_count and disk_pressure_pct (previously lost on checkpoint restore)
• CSV header detection uses exact match against known headers instead of fragile alphabetic heuristic
• Removed panicking unwrap() on JSON round-trips in run-demo and analyze handlers; store JsonReport directly
• Three endpoints now return HTTP 500 on serialization failure instead of empty 200 responses
• CSV parse error messages now report correct original line numbers
• auth_burst_detected() uses u64 accumulator to prevent overflow on large auth_failures sums
• Ring buffers (ReplayBuffer, CheckpointStore) guard against capacity=0 edge case
• ProofRegistry::verify() renamed to contains() to avoid implying cryptographic verification
• network_kbps and temperature_c now reject NaN and Infinity values during validation
• decay_rate parameter validated (must be finite, 0.0–1.0) in /api/control/mode endpoint
• Admin console enforces 10 MB file size limit on uploads

v0.5.0

0.5.0

Added

• Checkpoint save/restore via API (3 new endpoints)
• CSV report export from admin console
• Threat-level filter dropdown in admin console
• Improved connection error messages (auth failure, server offline, HTTP codes)
• Auto-detecting CSV column count (8 or 10 columns)
• 2 new checkpoint restore tests (54 total unit tests)

Fixed

• CLI command count corrected to 8 across all files
• Redundant CSV parsing in analyze endpoint removed

v0.4.0

0.4.0

Added

• Admin console auto-refresh (5 s polling) with connection status indicator
• Drag-and-drop JSONL/CSV file upload for custom analysis
• Decay rate slider for adaptation control
• Dark mode support via prefers-color-scheme: dark
• CORS hardened to http://localhost with Vary: Origin

v0.3.0

0.3.0

Added

• All 17 Rust modules with 52 unit tests
• 10-stage pipeline: ingest → parse → detect → decide → act → audit → checkpoint → replay → benchmark → report
• HTTP server with token-authenticated REST API
• Browser admin console and GitHub Pages site
• 8 CLI commands (demo, analyze, report, init-config, status, status-json, serve, help)
• Research documents for phases 5–7 (40 tracks across 7 categories)