Release v0.15.26 · InnerWarden/innerwarden

InnerWarden 0.15.26

DShield (SANS ISC) reputation is now a real decision signal on the Warden classifier path, not just LLM context. DShield enrichment already attached the community's global attack history to attacker profiles and fed the LLM prompt, but the on-device Warden classifier and its deterministic Context Gate ignored it. The gate now reads a structured ip_dshield_attacker signal (DshieldReputation::is_known_attacker: ISC reports > 0 or active threat-feed membership) and, escalate-only, (1) refuses to passively close (dismiss/ignore) an incident from a DShield-confirmed global attacker, surfacing it instead, and (2) blocks the provenance-driven benign-dismiss for such IPs. It can only ever raise a weak verdict, never relax an enforcement action. The trained classifier's text input is intentionally not changed (novel input is out-of-distribution; enriching the model input is the separate re-distill path), so the model's behaviour is unchanged; DShield acts deterministically in the gate that wraps it. New unit tests pin: a confirmed attacker's confident dismiss is surfaced, an enforcement verdict is left intact, and a non-DShield low-severity dismiss is unchanged.

Installer no longer sends the telemetry ping from CI / automation. Installer smoke-tests run on ephemeral CI runners (GitHub Actions and friends), each a fresh machine-id from a US x86_64 box, so every run was writing an install row into the opt-out install telemetry, inflating the install count with non-users (most of a given window's "installs" were our own CI). install.sh now detects a CI environment (CI=true/1, or any of GITHUB_ACTIONS/GITLAB_CI/JENKINS_URL/BUILDKITE/CIRCLECI/TF_BUILD/TEAMCITY_VERSION/DRONE) and skips the ping (logging that it did). The install itself still runs and is still verified in CI; only the ping is suppressed, so the telemetry reflects real installs. CI=false (some dev shells) is correctly treated as not-CI.

curl -fsSL https://innerwarden.com/install | sudo bash
# already installed:  sudo innerwarden upgrade --yes

fix(install): skip telemetry ping in CI / automation by @maiconburn in #1114
feat(agent): DShield reputation as a decision signal in the Context Gate by @maiconburn in #1115
release: 0.15.26 by @maiconburn in #1116

Full Changelog: v0.15.25...v0.15.26