Guardana Control 0.3.0-alpha

A configuration must now name its enforcement mode: one that relied on the
OBSERVE default no longer loads. The demo now starts with
dev --decision-point=silent and needs a system with process groups. A
resource prefix now refuses the dot segments, percent escapes, queries and
fragments that let an id leave it; evidence no longer carries previews; and a
result that cannot be hashed is recorded as UNKNOWN, not as a success. New
are a demo archive that runs without Go, an evidence export another program
resumes by cursor, and the documentation on the website.
docs/status.md says what is implemented and what is
experimental. Nothing here is a security boundary yet.

Changed

• mode has no default: a configuration that names no enforcement mode is
  refused at load instead of starting a plane in OBSERVE, which stops nothing
  its policy decides. Add mode: to a configuration that relied on the
  default (ADR-0032).
• The demo's decision point no longer listens on the fixed port
  127.0.0.1:18213, so demos run side by side: start the demo with
  dev --decision-point=silent, which the old command lacks and now needs.
  dev refuses a system without process groups before it starts anything.

Added

• A website for control.guardana.dev in site/: one static page with
  no script and nothing loaded from another host, whose diagrams
  make docs-gen draws from README's, and the project's mark in the
  README header (ADR-0030).
• The documentation on the website: every page, record, the roadmap and
  the changelog rendered under control.guardana.dev/docs/ by
  make docs-gen, with links, anchors and diagrams that mean there what
  they mean on GitHub, and a check that fails when a page and its rendering
  drift (ADR-0031).
• A demo archive per platform, guardana-control-demo_<version>_<os>_<arch>.tar.gz,
  that runs the tutorial and every scenario without Go or a checkout; each
  release runs its scenarios from the linux/amd64 archive before it is
  published
  (ADR-0033).
• dev --decision-point=silent: a decision point on a port dev binds and
  never answers, so a rule reading external is undetermined with
  PDP_TIMEOUT.
• guardana-gateway trail export: a trail file in a versioned format another
  program reads, with a cursor to resume from, a record for every line it
  cannot read, and a trailer; examples/evidence-report rebuilds each call's
  lifecycle from it without importing the project's internals
  (ADR-0035).

Fixed

• A restrict_resources obligation with a prefix let a resource id such
  as /srv/data/../../etc/passwd, /srv/data/%2e%2e/etc or
  https://api.example/pub/..?x through; under a prefix, an id holding a
  segment of dots, an empty segment, a backslash, a %, a ;, a ?, a #
  or a byte outside printable ASCII is now refused.
• The plane recorded whatever preview an adapter put on a call's arguments or
  its result; every event now reaches the sink without previews, as capture
  is off.
• A tool result that could not be encoded was recorded as a success with no
  hash; it is now UNKNOWN, with the protocol status unhashable.
• An approver's answer succeeded beside a consumed or not-resumed record it
  could not read; the store now refuses it and takes the answer back.
• An approver whose answer the plane spent between the approver's write and
  its check was told the approval had been consumed; it is now told the
  answer was filed, and any other consumed record still refuses it.
• The collector kept the argument and result previews another producer sent;
  it now clears them before the trail file holds an event. A trail file that
  already holds such an event reads a copy sent again as other content.
• A pending call told the agent to retry after 0 seconds when
  approvals.retry_after was under a second; the hint now rounds up to whole
  seconds.
• A scenario stopped as one that could not run when the plane's read of its
  pause file ran late on a busy machine and /healthz briefly reported the
  pause state stale; the runner now reads it again until its timeout, and any
  other unknown cause still stops it.

Image: ghcr.io/guardana/control-gateway@sha256:50f6b4bd91bb93e92f315150d2c5a511fa94d9e150aa768f207a61feb3a2e68a