Repository navigation
Releases: OpenRAE/lilrae
Releases · OpenRAE/lilrae
Release list
v8.0.0
8.0.0 (2026-10-14)
⚠ BREAKING CHANGES
- a base-container variable that used to be filled from an exported shell variable or a same-named .env key now needs an environment grant in aptl.json, and a value-less plain or unknown variable is delivered empty instead of being omitted.
Bug Fixes
v7.0.0
7.0.0 (2026-10-13)
⚠ BREAKING CHANGES
- run systemd substrate nodes without host cgroup or added privilege (#1174)
Features
- cli: add aptl doctor to check the host and Docker runtime before a start (#1266) (4617180)
- cli: add aptl lab reset to return the lab to a clean state (#1268) (14b8b84)
- cli: give doctor, lab start, stop and status stable JSON output and exit status (#1267) (f4150a1)
- execute SDL participant inject sequence (#1170) (f3b9b3c)
- report selected lab execution boundaries (#1172) (19e62fd)
- restore browser desktop seats through Guacamole (#1181) (1249119)
- run systemd substrate nodes without host cgroup or added privilege (#1174) (566dfb0)
- seat: enforce event and administrative privilege modes (#1187) (a7fe9ff)
- seat: restore browser desktop VM seats (#1185) (cfae1ea)
Bug Fixes
- announce the lilrae package and keep core startup free of the workbench (#1359) (d77c06f)
- bump the MCP SDK and DOMPurify, apply Alpine fixes and drop unused pebble (#1270) (ef570dd)
- complete pending lab cleanup across APTL upgrades (#1180) (e209284)
- correct Wazuh API retry and capture cold-boot evidence (#1192) (11e90ac)
- deployment: explain how to recover from an unowned service index (#1264) (1ef14d8)
- land TechVault on env-packs 6.2.1 (compat, detection, CVE gates, docs) (#1248) (a5833df)
- mcp: harvest Kali captures from the workspace-scoped capture container (#1257) (1abe440)
- preserve transcript evidence through redaction (#1204) (378fd81)
- qualify published participant study (#1200) (2901a2c)
- realize TechVault database before portal use (#1184) (61cf655)
- realize TechVault database with password access and bounded initialization (#1205) (ce802b9)
- recover missing Wazuh API during TechVault retry (#1189) (384601e)
- refuse rootless Docker before lab start and drop the cert-generator mapping (#1253) (97f3913)
- remove the stale all-interface DNS publication from the Compose stub (#1255) (3b20343)
- repair Wazuh rule authoring through MCP (#1251) (efbc3bd)
- replace image-free terminology and make security scanner gates blocking (#1203) (3777697)
- resolve the CodeQL alerts that block the dev to main promotion (#1362) (3ba00a5)
- seat: keep CLI source selection below Sonar limit (#1197) (a281d52)
- seat: unblock signed image bake (#1247) (5bef477)
- update devalue, SvelteKit, nanoid and source-map-js in the web lockfile (#1301) (7ae27dd)
- verify declared networks across startup routes (#1196) (d9c35e6)
- workbench: enforce provider deadlines and clean up owned child processes (#1260) (8ab91f6)
- write generated environment files safely (#1256) (d40e5aa)
Documentation
- align runtime documentation and tests with the shipped lab (#1263) (41551db)
- document the LilRAE name change and establish naming guidance (#1233) (5828f62)
- remove the workflow platform product name from public docs (#1254) (103ebfb)
- rename ADR-040 file to repair git date provenance (#1231) (7b5320d)
- requirements: reconcile remaining records with their issues and ADR-035 (#1252) (3b067ea)
- requirements: withdraw requirements for closed backlog issues (#1240) (80e7591)
v6.0.0
v5.6.0
5.6.0 (2026-09-22)
Features
- add installed scenario pack adapter seams (#1141) (9b86286)
- appliance: deliver qualified KVM seats and public artifacts (#1107) (35ebb3b)
- integrate full TechVault delivery and host MCP access (#1102) (ffecaf0)
- scope backend resource ownership (#1054) (d9dfbb6)
Bug Fixes
- address backend resources by their workspace-scoped names in integration tests (#1104) (1448f16)
- detection,mcp: fire custom Suricata rules (303020) and repair MISP add_indicator (#1036) (ba41876)
- detection,mcp: fire custom Suricata rules and repair MISP add_indicator (ba41876), closes #1034
- ground Wazuh evidence and scenario credentials (#1152) (d1871df)
- make issue 956 lab startup and QA reliable (#1110) (5a2a9b1)
- realize authored spawn-template images as written (#1131) (3ce89ad), closes #974
- realize SDL runtime authority as authored (#1108) (18dcc70)
- realize unfixed host publications and persist workflow history (#1142) (faf39e3)
- remove helpers stranded by a killed aptl process on stop (#1147) (a810dac)
- retire MISP and Redis post-realization mutation (#1109) (e6bef3c)
- security: drop privileges to install the operator key and keep credentials off argv (#1106) (0b2e0d2)
- stop helper containers and anonymous volumes outliving teardown (#1145) (5d3ab1f)
- stop the TechVault build cache accepting caller-supplied paths (#1154) (dd9145b)
Documentation
v5.5.0
v5.4.0
v5.3.1
5.3.1 (2026-09-15)
Bug Fixes
- env: reconcile hash-pinned indexer/dashboard fixtures during .env hydration (#1023) (31d8f85), closes #1021
- prevent partial lab startup success (#1001) (16dc3d3)
- readiness: quiet Wazuh API warm-up and fail closed on persistent failure (#1016) (29bc37e)
- validation: stop BC-09's fixture losing the timeout race to its own setup (#1008) (d66d7b5)
Documentation
v5.3.0
5.3.0 (2026-09-11)
Features
- define scenario verification plugin seam (#973) (ff73990)
- realize runtime orchestration authority (#959) (6539050)
- scenario: qualify verifier compatibility atomically and install it on the gate path (#982) (e83dd86)
Bug Fixes
- derive lab-start pre-flight from the admitted realization (#960) (170593a)
- retire Shuffle post-realization mutation (#950) (b6928e5)
- workbench: escalate group teardown unconditionally and stop reading EPERM as presence (#997) (7c673a1)
Documentation
v5.2.0
5.2.0 (2026-09-03)
Features
- add host-side appliance seat launcher for kiosk lifecycle (#860) (c0854bf)
- add in-appliance participant workbench (#835) (4a188b9)
- add pack backend interaction seam (#927) (ebb4db2)
- add safe experimental parameter binding (#857) (2726603)
- add versioned disposable lab appliance (#840) (f71a72e)
- define bounded participant lab profile (#836) (621b4cb)
- enforce appliance network boundary (#838) (f7d343f)
- evidence: add portable research evidence bundle export (EXP-008) (#873) (a6322b3)
- honest per-dimension runtime readback for dynamic composition (#876) (#893) (3db5171)
- qualify bounded RAES participant agency (#855) (19014ac)
- raes: declare Cortex index as ADR-088 initial service state, native materializer + readback (#889) (#911) (aaf9235)
- record run-scoped apparatus and detection-content provenance (#871) (ca648f1)
- rename ACES to RAES and migrate to the raes 1.1.0 distribution (#846) (ced66dc)
- scenario: declare TechVault content in the SDL via the env-pack (#875) (#908) (4dcf07b)
- scenario: realization contract for TechVault, scenario-verification plugin seam, and standup fixes (#866) (#890) (7b21cdb)
- seal ACES run and evidence records for terminal execution attempts (#872) (1f6d17e)
Bug Fixes
- adopt OpenSSF Scorecard and remediate the supply-chain findings it reported (#850) (20ed98f)
- bind explicit models to installed participants (#865) (e2b8241)
- ci: allow exact dev promotion titles (#941) (95b16d5)
- clear appliance boundary quality gate (#839) (5a6c113)
- complete participant workbench integration (#837) (583e100)
- harden lab lifecycle recovery (#933) (fece8b2)
- make participant credential sourcing explicit (#928) (96302e4)
- preserve bounded participant execution semantics (#861) (0f0d8ee)
- quality: resolve SonarCloud new-code findings blocking the dev gate (#938) (8689d02)