v0.9.0

What's Changed

• docs: remove em-dash separators across docs, UI strings and comments by @ClementG91 in #29
• feat(firewall): audit-only Phase 2 service endpoint + AI-surface evals by @ClementG91 in #30
• feat(firewall): host the audit-only endpoint as a least-privilege Windows service by @ClementG91 in #31
• feat(firewall): read-only Application gateway for the dashboard by @ClementG91 in #32
• feat(dashboard): read-only Outbound Firewall view over the service gateway by @ClementG91 in #33
• feat(firewall): ship and register the outbound-firewall service (opt-in, audit-only) by @ClementG91 in #34
• feat(firewall): read-only WFP interop self-test (safe first WFP step) by @ClementG91 in #35
• feat(firewall): WinSight WFP provider and sublayer (containers only, no filter) by @ClementG91 in #36
• feat(firewall): non-blocking WFP PERMIT filter (proves filter interop) by @ClementG91 in #37
• feat(firewall): per-application outbound BLOCK via WFP (isolated to one app) by @ClementG91 in #38
• fix(firewall): correct FWP_BYTE_BLOB_TYPE constant (12, not 10) by @ClementG91 in #39
• fix(firewall): block outbound over IPv6 as well as IPv4 by @ClementG91 in #40
• feat(firewall): multi-application block and the real WFP engine by @ClementG91 in #41
• feat(firewall): enforcement opt-in wired to the policy store (audit-only default) by @ClementG91 in #42
• fix(firewall): auto-start the service when enforcement is enabled (survive reboot) by @ClementG91 in #43
• feat(firewall): dashboard-side policy write path + async service entry point by @ClementG91 in #44
• feat(dashboard): interactive outbound-firewall controls by @ClementG91 in #45
• fix(dashboard): make firewall controls reliably visible and legible by @ClementG91 in #46
• fix(dashboard): responsive layout for the results view by @ClementG91 in #47
• fix(firewall): dashboard could not authenticate to the service (pipe impersonation) by @ClementG91 in #48
• fix(firewall): unify executable-path canonicalization across CLI, IPC and WFP by @ClementG91 in #49
• fix(dashboard): firewall controls cannot crash the app on an unexpected error by @ClementG91 in #50
• refactor(core,netmonitor): remove sync-over-async from child-process reads by @ClementG91 in #51
• refactor: code-review polish across monitors, mcp and application by @ClementG91 in #52
• feat(scan): make scans cancellable end-to-end by @ClementG91 in #53
• feat(persistence): detect credential providers and browser helper objects by @ClementG91 in #54
• feat(persistence): detect Windows Load/Run values and application shims by @ClementG91 in #55
• feat(dashboard): block an app's outbound directly from a finding by @ClementG91 in #56
• feat(dashboard): make block feedback enforcement-aware by @ClementG91 in #57
• fix(persistence): drop the shim-database surface (guaranteed false positive) by @ClementG91 in #58
• feat(persistence): detect print providers (verified false-positive-free) by @ClementG91 in #59
• fix(firewall): harden LocalSystem trust boundary by @ClementG91 in #60
• fix(firewall): trust legitimate install paths in ServicePathTrust by @ClementG91 in #61
• fix(firewall): let the service start by provisioning the chain it owns by @ClementG91 in #62
• feat(firewall): let enforcement be enabled again, over the authenticated pipe by @ClementG91 in #63
• docs: add the Arm64 runtime validation protocol by @ClementG91 in #64
• fix(firewall): make a refused service start diagnosable by @ClementG91 in #66
• feat(firewall): tell the operator when something new reaches the network by @ClementG91 in #67
• fix(firewall): attribute the connections that matter, instead of none by @ClementG91 in #68
• feat(firewall): report the WFP state that is real, not the one that was intended by @ClementG91 in #73
• fix(firewall): bound runtime status verification by @ClementG91 in #74
• chore(ci): bump actions/attest-sbom from 51e74621a501c89df81fc1391c5a8f4cfc9fab2f to 4651f806c01d8637787e274ac3bdf724ef169f34 by @dependabot[bot] in #69
• chore(ci): bump actions/setup-dotnet from 5.4.0 to 6.0.0 by @dependabot[bot] in #70
• chore(ci): bump actions/download-artifact from 7.0.0 to 8.0.1 by @dependabot[bot] in #71
• chore(ci): bump actions/attest-build-provenance from 3.0.0 to 4.1.1 by @dependabot[bot] in #72
• feat(persistence): Guardian real-time persistence monitoring (Phase 3) by @ClementG91 in #75
• feat(persistence): Guardian on-start reconciliation across runs (increment 5) by @ClementG91 in #76
• fix(persistence): Guardian uses the shared cached WinVerifyTrust verifier by @ClementG91 in #77
• feat(persistence): broaden Guardian live coverage to high-value registry surfaces by @ClementG91 in #79
• docs: Status section reflecting shipped milestones by @ClementG91 in #78
• feat(persistence): Guardian scoped re-scan for near-instant detection by @ClementG91 in #80
• feat(ransomware): Phase 4 heuristics core (RansomWhere-class) by @ClementG91 in #81
• feat(ransomware): Phase 4 canary planting + file watcher (increment 2) by @ClementG91 in #82
• feat(ransomware): opt-in dashboard protection + alert (Phase 4 increment 3) by @ClementG91 in #83
• chore(release): prepare v0.9.0 by @ClementG91 in #84
• feat(ransomware): entropy-on-write sampling (Phase 4 increment 4) by @ClementG91 in #85
• fix(security): concurrency and link-following defects in the real-time watchers by @ClementG91 in #86
• fix(dashboard): record crashes instead of dying silently by @ClementG91 in #87
• fix(dashboard): crash capture must not write to real appdata, and must truly never throw by @ClementG91 in #88
• fix(ransomware): re-arm the burst detector after each alert by @ClementG91 in #89
• feat(alerts): journal every detection locally so a suppressed balloon does not lose it by @ClementG91 in #90
• feat: surface the alert journal as a dashboard tool by @ClementG91 in #91

Full Changelog: v0.8.1...v0.9.0