sigwood v0.2.7

Added

• Recognized syslog transactions. The syslog detector now folds an administrative
  session (login through logout) or a system update run (package, kernel-module, and
  policy activity) into one labeled review unit per host - for example update run · 4 member findings · 1m - with every member finding preserved behind it: a compact
  drill-down at -v in text, an expandable row in HTML, and complete member evidence
  in JSON. Severity still comes only from the privileged program class; recognition
  groups findings, it never grades them. Default on; recognize_transactions = false
  under [detectors.syslog] restores the previous behavior exactly.
• Host suppression allowlist. A third flat-list kind silences a chatty machine's
  system logs whole-host: dot-free hosts* drop-ins in allowlist.d/ (one fnmatch glob
  or re: regex per line, matched case-insensitively against the syslog host column),
  applied before analysis across all three syslog feeds - flat files, the system journal,
  and Zeek syslog.log. DNS and connection logs are untouched. The run banner gains a
  third coverage clause (suppressed 9,412 rows from 2 hosts), JSON carries the new
  host_rows / host_total / hosts_matched suppression fields, and sigwood init
  seeds a blank hosts template whose header warns that host suppression removes the
  whole host's story and shifts relative rarity. Host lists are local-only - sigwood
  never ships one.

Changed

• Steadier terminal narration. The terminal cursor is hidden during narrated
  analyze, digest, graph, and export runs and restored across clean exits, failures,
  and interrupts; interactive prompts show it while you type. Quiet runs,
  dumb terminals, and redirected output see no cursor-control bytes at all.

Fixed

• Cross-feed syslog duplication no longer hides unique lines. When the same
  host's messages reach both the local system-log feed (files or the journal) and
  Zeek's syslog.log, the duplicate coverage doubled that host's template counts, so
  a line that should have surfaced as a unique rare event silently left the rare set.
  sigwood now arbitrates per host: a host present in the local feed keeps its local
  rows only, and Zeek contributes just the hosts the local feed lacks. The run
  summary discloses it in counts (system logs: 1 host carried by both the local feed and Zeek syslog.log - kept the local rows (16,094 Zeek rows set aside));
  loaded record counts are unchanged. Hosts only Zeek can see are unaffected, and
  hostless (unknown) lines are never arbitrated.

Security

• Artifacts are private by default. Every directory sigwood creates is now mode
  0700 and every file it writes is 0600 - reports, digests, graph artifacts, exports,
  config and its backups, and allowlist seeds - independent of the process umask, and
  re-applied when an artifact is overwritten in place. The CLI also sets a 077 umask
  backstop for every command except init.
• Loose-home advisory. When an existing sigwood home is group- or world-accessible,
  each run prints a one-line stderr reminder with the exact chmod 700 to close it.
  sigwood never changes permissions on a directory it did not create.
• A system-wide /etc/sigwood config keeps ordinary umask-governed permissions so
  non-root users can still read it.