Added
-
A statement of what 1.0 means, as its own README section. The command and its verbs, the
flag syntax, the availability of the five output formats, the config file and allowlist
drop-in naming, and the exit codes do not change again without a major version. Detection
is deliberately outside that promise: thresholds and the findings a given log produces
keep changing between 1.0 releases. The status line and the FAQ point at the section. -
A code of conduct at
.github/CODE_OF_CONDUCT.md, adopting the Contributor Covenant
2.1 by reference and covering issues, pull requests, and other project spaces. Reports
go to a private address named in the document.
Changed
-
The release checklist's recovery path no longer deletes a pushed tag, which the tag
ruleset refuses anyway. A failed release is left in place and the fix ships under the next
patch number with a new signed tag. The two recovery commands the maintainer token cannot
run are now browser steps, and the approval gate names the real workflow jobs. -
The bug report form no longer invites field-kit output into a public issue,
and all three issue forms open with the same list of what to redact. A corpus
someone chooses to share goes to a private address, is used only to test
sigwood, and is deleted on request. -
An era deck written to
--outas text or HTML is now written to a fresh name and moved
into place, matching the PDF deck and every other whole-file output. Opening the
destination directly emptied a file that a hard link still referred to. -
A prior work page collects the published research behind the three
detectors whose run-summary tag names a technique, and states plainly that the other six
name a house method with no paper behind it. It also lists the specifications the parsers
implement. It is a reading list rather than a lineage claim: sigwood implements none of
these papers and inherits none of their measured performance. -
Every IPv4 and IPv6 address in the repository is now checked on each test run.
Documentation ranges, addresses reserved for a role, and a short list of shared private
placeholders pass, as do a handful of wider ranges named exactly. Everything else fails,
so a real internal range cannot ship unnoticed. Some fixtures named addresses assigned to
real organizations and now use reserved space instead. -
Several documentation statements that a reader could check and find false are corrected.
The security policy's verification example named a tag that does not exist, and its signing
start date left two unsigned commits inside the range it claimed. The manual said auth
reconciliation prevents log dialects from inflating each other's counts, when the opposite
is true and the page now says so. Known Issues and the FAQ described a dormant auth HIGH
rule; auth never reports HIGH, and the pages say that instead. The authgatefield
documented six values and ships nine. The exfil evidence record said the demo corpus cannot
exercise the detector, which it does. Both DNS pages blamed Pi-hole for a missing resolution
outcome that sigwood's own parser drops. -
The connection-log scrubber takes the capture's internal networks on the command line
instead of carrying fixed ranges in source, refuses a source network that overlaps its own
output ranges, and maps any number of networks rather than exactly two. -
The roadmap no longer describes the DNS measured pass as in progress. Its
behavior-corroborated severity and below-gate families shipped in 0.2.9 and its Pi-hole
dense-cluster scan in 0.6.0; the section now names the shipped passes and points at the
evidence ledger for what is measured next. -
The release checklist audits dependencies under the development interpreter, takes the
release commit message from a file the maintainer writes, validates from a fresh clone rather
than an archive export, and inspects and publishes the GitHub Release in the browser.
Following the checklist for 0.7.1 showed that each replaced form either failed or could not
run with the command-line token it prescribes.