v0.5.1

v0.5.1 reports the correct module version in binaries installed with go install.

v0.5.0

v0.5.0 updates the Go module path and tightens the CLI and public examples.

• Go installs and imports now use github.com/alephnull-sh/deadair.
• check now leads with READY, READY WITH LIMITS, or BLOCKED; command help and option validation are clearer and more consistent.
• Terminal output is easier to scan while JSON output remains stable for automation.
• The embedded sample command has been removed. README and usage captures now come from a reproducible disposable Elastic lab.

Go consumers should update existing imports to the new module path.

v0.4.0

v0.4.0 makes deadair easier to evaluate and more precise about what it can prove.

• Added a credential-free deadair demo with deterministic evidence and the same terminal, JSON, and HTML report paths used by live scans.
• Added backend-native input resolution for aliases, data streams, selectors, and remote or unsupported inputs, with explicit evidence and assessment states in reports.
• Added versioned report and fleet contracts, public JSON Schemas, producer metadata, backend version evidence, and capability reporting.
• Added trusted live compatibility coverage for Elastic 8.19.19 and 9.4.4, OpenSearch 2.19.6 and 3.7.0, plus a cross-backend fleet proof.
• Split fork-safe validation from trusted integration CI and opened a contributor path with contributing guidance, code ownership, an adapter RFC template, a public roadmap, and a backend support policy.
• Bounded native-resolution concurrency and tightened unused-telemetry reporting so empty sources are not counted as unused data.
• Updated the README to show the findings produced by the embedded demo.

The full validation suite and all five trusted integration jobs passed before this release.

v0.3.4

v0.3.4 tightens the first-run experience and the MSSP/operator story.

• Rewrote the docs so SOC engineers and detection engineers can see the tool's job immediately: enabled detections mapped to the telemetry they depend on, with dead rules, impaired rules, source health, and unused telemetry called out separately.
• Added an MSSP lab GIF recorded from the Docker-backed simulated fleet artifacts.
• Added the Docker-backed MSSP lab workflow for a five-instance fleet with healthy tenants, bad credentials, an unreachable tenant, redacted reports, downtime handling, schema drift, and exporter metrics.
• Fixed scan --rule for single pretty-printed JSON rule files.
• Removed the unsound truncated-lookback impairment check and tightened lag attribution so lag-blind-window names the specific laggy source.
• serve --redact now redacts fleet instance names before logging per-instance scan failures.

Supported backends remain Elastic Security 8.x and OpenSearch Security Analytics 2.x.

v0.3.3

Finds the detection rules in your SIEM that are running blind — dead, impaired, or fed by unused telemetry. Elastic Security and OpenSearch Security Analytics; single deployment or multi-tenant fleet. See README and CHANGELOG.