v7.0.0

7.0.0 (2026-10-13)

⚠ BREAKING CHANGES

• run systemd substrate nodes without host cgroup or added privilege (#1174)

Features

• cli: add aptl doctor to check the host and Docker runtime before a start (#1266) (4617180)
• cli: add aptl lab reset to return the lab to a clean state (#1268) (14b8b84)
• cli: give doctor, lab start, stop and status stable JSON output and exit status (#1267) (f4150a1)
• execute SDL participant inject sequence (#1170) (f3b9b3c)
• report selected lab execution boundaries (#1172) (19e62fd)
• restore browser desktop seats through Guacamole (#1181) (1249119)
• run systemd substrate nodes without host cgroup or added privilege (#1174) (566dfb0)
• seat: enforce event and administrative privilege modes (#1187) (a7fe9ff)
• seat: restore browser desktop VM seats (#1185) (cfae1ea)

Bug Fixes

• announce the lilrae package and keep core startup free of the workbench (#1359) (d77c06f)
• bump the MCP SDK and DOMPurify, apply Alpine fixes and drop unused pebble (#1270) (ef570dd)
• complete pending lab cleanup across APTL upgrades (#1180) (e209284)
• correct Wazuh API retry and capture cold-boot evidence (#1192) (11e90ac)
• deployment: explain how to recover from an unowned service index (#1264) (1ef14d8)
• land TechVault on env-packs 6.2.1 (compat, detection, CVE gates, docs) (#1248) (a5833df)
• mcp: harvest Kali captures from the workspace-scoped capture container (#1257) (1abe440)
• preserve transcript evidence through redaction (#1204) (378fd81)
• qualify published participant study (#1200) (2901a2c)
• realize TechVault database before portal use (#1184) (61cf655)
• realize TechVault database with password access and bounded initialization (#1205) (ce802b9)
• recover missing Wazuh API during TechVault retry (#1189) (384601e)
• refuse rootless Docker before lab start and drop the cert-generator mapping (#1253) (97f3913)
• remove the stale all-interface DNS publication from the Compose stub (#1255) (3b20343)
• repair Wazuh rule authoring through MCP (#1251) (efbc3bd)
• replace image-free terminology and make security scanner gates blocking (#1203) (3777697)
• resolve the CodeQL alerts that block the dev to main promotion (#1362) (3ba00a5)
• seat: keep CLI source selection below Sonar limit (#1197) (a281d52)
• seat: unblock signed image bake (#1247) (5bef477)
• update devalue, SvelteKit, nanoid and source-map-js in the web lockfile (#1301) (7ae27dd)
• verify declared networks across startup routes (#1196) (d9c35e6)
• workbench: enforce provider deadlines and clean up owned child processes (#1260) (8ab91f6)
• write generated environment files safely (#1256) (d40e5aa)

Documentation

• align runtime documentation and tests with the shipped lab (#1263) (41551db)
• document the LilRAE name change and establish naming guidance (#1233) (5828f62)
• remove the workflow platform product name from public docs (#1254) (103ebfb)
• rename ADR-040 file to repair git date provenance (#1231) (7b5320d)
• requirements: reconcile remaining records with their issues and ADR-035 (#1252) (3b067ea)
• requirements: withdraw requirements for closed backlog issues (#1240) (80e7591)