v0.4.0

0.4.0 (2026-06-09)

Features

• analyze: M3 analyzer + policy derivation (#80) (7cfd1fa)
• build: M6 build subcommand end-to-end orchestrator (#86) (4ab3873)
• generate: M4 generators (Containerfile + Quadlet + seccomp + README) (#82) (44901b4)
• verify: M5 verify (diff-only) (#84) (8410197)

Bug Fixes

• sandbox/collectors: drop stray BEGIN printf opener from .bt files (#70) (78aecdd), closes #58
• sandbox/collectors: key bind.bt proto map by (pid<<32 | fd) instead of tid (#71) (664c594), closes #52
• sandbox: kernel-headers in runner image + 15s grace for bcc compile (#76) (87d05ee)
• sandbox: replace bcc tcpconnect/tcpaccept with bpftrace (#77) (#78) (0d11f14)
• trace: bind-mount kernel tracefs + headers + CI rootful podman (#74) (716740e)

Documentation

• m3: analyzer + policy derivation spec + implementation plan (#79) (122df45)
• m4: spec + implementation plan for generators (#81) (d1add90)
• m5: spec + implementation plan for verify (#83) (fff07d1)
• m6: spec + implementation plan for build subcommand (#85) (7f7dcc1)
• plan: add M2 sandbox + trace implementation plan (#46) (7ba3bd3)
• spec: add M2 sandbox + trace design spec (#45) (d540fc4)