v0.10.5

What's Changed

• fix: a clickable detection notification, and a CFA read that works off-Defender by @ClementG91 in #114
• docs: state who made the binaries, and what leaves the machine by @ClementG91 in #115
• feat: report what is actually protecting the machine, not just Defender by @ClementG91 in #116
• docs: record the second unsigned waiver as a pattern, not another exception by @ClementG91 in #117
• fix: a watch loop that never returns does not belong on the thread pool by @ClementG91 in #118

Full Changelog: v0.10.4...v0.10.5

v0.10.4

What's Changed

• fix(wfp): the two mutations that used to stay green now fail by @ClementG91 in #92
• docs(validation): put the VM qualification steps under version control by @ClementG91 in #93
• fix(firewall-service): close both review findings on the install boundary by @ClementG91 in #94
• fix(validation): the protocol only ran when launched one specific way by @ClementG91 in #95
• docs(validation): repin the VM kit past the closure-scope defect by @ClementG91 in #96
• docs(validation): record the 25/25 WFP qualification on candidate f0a3f16 by @ClementG91 in #97
• feat(validation): an adversarial gate for service-path trust by @ClementG91 in #98
• fix(validation): the trust gate mis-read correct refusals and ran a hollow race by @ClementG91 in #99
• docs(validation): record the 11/11 trust-boundary pass on candidate f84ac36 by @ClementG91 in #100
• test(firewall): close the pipe ACL against a silent widening by @ClementG91 in #101
• feat(firewall): a shipped IPC self-test for the multi-user boundary by @ClementG91 in #102
• fix(validation): the IPC restricted leg read its output a beat too early by @ClementG91 in #103
• docs(validation): record the 7/7 multi-user IPC pass on candidate c9177cd by @ClementG91 in #104
• docs: index the validation records and state the signing gap plainly by @ClementG91 in #105
• chore(repo): make the signature requirement bind the account that can bypass it by @ClementG91 in #106
• feat(release): sign artifacts before hashing, and guard i18n against silent rot by @ClementG91 in #107
• docs: add a threat model, a production-readiness verdict, and correct a false claim by @ClementG91 in #108
• docs: turn the README into a product page, not a development diary by @ClementG91 in #109
• chore(ci): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #110
• chore(ci): bump actions/attest-sbom from 3.0.0 to 4.1.0 by @dependabot[bot] in #111
• docs: remove the orphaned SCREENSHOTS.md by @ClementG91 in #112
• feat: add CFA posture reporting (v0.10.4) by @ClementG91 in #113

Full Changelog: v0.10.3...v0.10.4

v0.10.3

Full Changelog: v0.10.2...v0.10.3

v0.10.2

Full Changelog: v0.10.1...v0.10.2

v0.10.1

Full Changelog: v0.10.0...v0.10.1

v0.10.0

Full Changelog: v0.9.1...v0.10.0

v0.9.1

Full Changelog: v0.9.0...v0.9.1

v0.9.0

What's Changed

• docs: remove em-dash separators across docs, UI strings and comments by @ClementG91 in #29
• feat(firewall): audit-only Phase 2 service endpoint + AI-surface evals by @ClementG91 in #30
• feat(firewall): host the audit-only endpoint as a least-privilege Windows service by @ClementG91 in #31
• feat(firewall): read-only Application gateway for the dashboard by @ClementG91 in #32
• feat(dashboard): read-only Outbound Firewall view over the service gateway by @ClementG91 in #33
• feat(firewall): ship and register the outbound-firewall service (opt-in, audit-only) by @ClementG91 in #34
• feat(firewall): read-only WFP interop self-test (safe first WFP step) by @ClementG91 in #35
• feat(firewall): WinSight WFP provider and sublayer (containers only, no filter) by @ClementG91 in #36
• feat(firewall): non-blocking WFP PERMIT filter (proves filter interop) by @ClementG91 in #37
• feat(firewall): per-application outbound BLOCK via WFP (isolated to one app) by @ClementG91 in #38
• fix(firewall): correct FWP_BYTE_BLOB_TYPE constant (12, not 10) by @ClementG91 in #39
• fix(firewall): block outbound over IPv6 as well as IPv4 by @ClementG91 in #40
• feat(firewall): multi-application block and the real WFP engine by @ClementG91 in #41
• feat(firewall): enforcement opt-in wired to the policy store (audit-only default) by @ClementG91 in #42
• fix(firewall): auto-start the service when enforcement is enabled (survive reboot) by @ClementG91 in #43
• feat(firewall): dashboard-side policy write path + async service entry point by @ClementG91 in #44
• feat(dashboard): interactive outbound-firewall controls by @ClementG91 in #45
• fix(dashboard): make firewall controls reliably visible and legible by @ClementG91 in #46
• fix(dashboard): responsive layout for the results view by @ClementG91 in #47
• fix(firewall): dashboard could not authenticate to the service (pipe impersonation) by @ClementG91 in #48
• fix(firewall): unify executable-path canonicalization across CLI, IPC and WFP by @ClementG91 in #49
• fix(dashboard): firewall controls cannot crash the app on an unexpected error by @ClementG91 in #50
• refactor(core,netmonitor): remove sync-over-async from child-process reads by @ClementG91 in #51
• refactor: code-review polish across monitors, mcp and application by @ClementG91 in #52
• feat(scan): make scans cancellable end-to-end by @ClementG91 in #53
• feat(persistence): detect credential providers and browser helper objects by @ClementG91 in #54
• feat(persistence): detect Windows Load/Run values and application shims by @ClementG91 in #55
• feat(dashboard): block an app's outbound directly from a finding by @ClementG91 in #56
• feat(dashboard): make block feedback enforcement-aware by @ClementG91 in #57
• fix(persistence): drop the shim-database surface (guaranteed false positive) by @ClementG91 in #58
• feat(persistence): detect print providers (verified false-positive-free) by @ClementG91 in #59
• fix(firewall): harden LocalSystem trust boundary by @ClementG91 in #60
• fix(firewall): trust legitimate install paths in ServicePathTrust by @ClementG91 in #61
• fix(firewall): let the service start by provisioning the chain it owns by @ClementG91 in #62
• feat(firewall): let enforcement be enabled again, over the authenticated pipe by @ClementG91 in #63
• docs: add the Arm64 runtime validation protocol by @ClementG91 in #64
• fix(firewall): make a refused service start diagnosable by @ClementG91 in #66
• feat(firewall): tell the operator when something new reaches the network by @ClementG91 in #67
• fix(firewall): attribute the connections that matter, instead of none by @ClementG91 in #68
• feat(firewall): report the WFP state that is real, not the one that was intended by @ClementG91 in #73
• fix(firewall): bound runtime status verification by @ClementG91 in #74
• chore(ci): bump actions/attest-sbom from 51e74621a501c89df81fc1391c5a8f4cfc9fab2f to 4651f806c01d8637787e274ac3bdf724ef169f34 by @dependabot[bot] in #69
• chore(ci): bump actions/setup-dotnet from 5.4.0 to 6.0.0 by @dependabot[bot] in #70
• chore(ci): bump actions/download-artifact from 7.0.0 to 8.0.1 by @dependabot[bot] in #71
• chore(ci): bump actions/attest-build-provenance from 3.0.0 to 4.1.1 by @dependabot[bot] in #72
• feat(persistence): Guardian real-time persistence monitoring (Phase 3) by @ClementG91 in #75
• feat(persistence): Guardian on-start reconciliation across runs (increment 5) by @ClementG91 in #76
• fix(persistence): Guardian uses the shared cached WinVerifyTrust verifier by @ClementG91 in #77
• feat(persistence): broaden Guardian live coverage to high-value registry surfaces by @ClementG91 in #79
• docs: Status section reflecting shipped milestones by @ClementG91 in #78
• feat(persistence): Guardian scoped re-scan for near-instant detection by @ClementG91 in #80
• feat(ransomware): Phase 4 heuristics core (RansomWhere-class) by @ClementG91 in #81
• feat(ransomware): Phase 4 canary planting + file watcher (increment 2) by @ClementG91 in #82
• feat(ransomware): opt-in dashboard protection + alert (Phase 4 increment 3) by @ClementG91 in #83
• chore(release): prepare v0.9.0 by @ClementG91 in #84
• feat(ransomware): entropy-on-write sampling (Phase 4 increment 4) by @ClementG91 in #85
• fix(security): concurrency and link-following defects in the real-time watchers by @ClementG91 in #86
• fix(dashboard): record crashes instead of dying silently by @ClementG91 in #87
• fix(dashboard): crash capture must not write to real appdata, and must truly never throw by @ClementG91 in #88
• fix(ransomware): re-arm the burst detector after each alert by @ClementG91 in #89
• feat(alerts): journal every detection locally so a suppressed balloon does not lose it by @ClementG91 in #90
• feat: surface the alert journal as a dashboard tool by @ClementG91 in #91

Full Changelog: v0.8.1...v0.9.0

v0.8.1

Full Changelog: v0.8.0...v0.8.1

v0.8.0

Full Changelog: v0.7.2...v0.8.0