v2.2.0

2.2.0 (2026-07-19)

Features

• auth: add correlation.preview, never granted to read-only roles (925e971)
• capture: record every event outcome, not just successful deliveries (d6136e9)
• i18n: add the correlation namespace in pt, en and es (253fc56)
• inflight: classify events in the pipeline, before they reach the SIEM (428e337)
• inflight: preview a rule against real samples without persisting anything (184efd9)
• observability: per-rule 24h counters, which the 3h TTL made impossible (66ab079)
• routes: expose the volume-reduction levers end to end (fcf6044)

Bug Fixes

• capture-ui: align the outcome vocabulary with the backend enum (9104a60)
• contract: expose eval_mode to the client and name inflight as a Detection source (4c7f0f8)
• correlation: normalise timestamps to UTC and fail closed on a broken where (440a69e)
• dedupe: cut the TTL to 1 day, unify its default, and surface Redis eviction (ddaf54d)
• dedupe: release unsettled claims on every data plane, not just kafka (ac1a246)
• flow: attach the wheel-zoom listener as non-passive (fb0817a)
• inflight: implement contains, report rule truncation, and unbreak the cython sweep (a31b9c0)
• providers: advertise spec_kinds by runtime availability, not static catalog (af00344)
• quarantine: cap writes per reason per cycle and keep the metric faithful (7c13cfa)
• threat-intel: drop the dead re-export that made the package unimportable (84afcf8)

Performance Improvements

• normalize: resolve simple dot-paths without the jmespath interpreter (2034852)