v0.7.0

0.7.0 (2026-09-07)

Features

• history: add idempotent observation contribution protocol (a208b4d)
• history: add observation contribution bookkeeping (b15b739)
• history: add population scope domain (c9bb52b)
• observation: add durable observation persistence (a86c0ce)
• observation: add executor authority fencing (a632bb3)
• observation: add remaining runtime evidence sources (890e92a)
• observation: add v0.7 domain contract (55231d7)
• observation: add v0.7 identity primitives (786b14c)
• observation: complete filesystem runtime observation (d452e87)
• observation: enable bounded container-scoped capture (5f52495)
• observation: persist bounded normalized runtime facts (15f3f04)
• observation: release v0.7 Observation Workbench (#215) (929b04b)
• observation: resolve real target identity and truthful trace_open attach signal (17ade9a)

Bug Fixes

• observation: bound startup attachment waiting (4f0d10f)
• observation: close final G5 certification findings (8a8b6b5)
• observation: enforce lost-executor terminal recovery (d379efe)
• observation: qualify filesystem runtime events (092cd01)

v0.6.1

0.6.1 (2026-09-05)

Bug Fixes

• dependency: align custom Gadget build set with v0.55.1 runtime (#213) (c76986e)
• workbench: reproducible v0.6.1 contributor bootstrap (#211) (8fbe45b)

v0.6.0

0.6.0 (2026-09-04)

Features

• workbench: add full visual inspection experience (#209) (96cc07d)

v0.5.2

0.5.2 (2026-09-04)

Features

• rollback: add explicit governed rollback (#203) (897ebfd)

Miscellaneous Chores

• release: select v0.5.2 (#207) (ae125c4)

v0.5.1

Changelog

• 8da8637 feat(applyattempt): add durable mutation custody (#202)

Kubectl plugin form: rename the downloaded binary to kubectl-landlock_genprof (underscore, not dash — kubectl reads a literal dash as two separate subcommands) and place it on your $PATH — see INSTALL.md. trace requires Linux (Landlock/eBPF); the darwin/windows binaries build and run for version/review but trace will return a clear error there.

v0.5.0

Changelog

• cde96c3 docs(g5): record v0.5.0 G5 certification evidence (#200)
• f897188 docs(g6): define v0.5.0 pilot readiness boundary (#201)
• 5881f98 feat(dashborad): [v0.5.0][G4] Build cluster-centric read-only Workbench experience (#199)
• 628a5e1 feat(governance): certify workload associations (#192)
• 5bd01fc feat(governance): persist canonical target provenance (#195)
• d98ee1b feat(identity): add canonical governed target semantics (#179)
• 211f1b6 feat(k8s): add bounded Workbench read capability (#188)
• 9ec7f4b feat(k8s): add bounded cluster workload read model (#190)
• 9f7d04a feat(workbench): add workload security projections (#196)
• 34d5684 feat(workbench): establish the G3 local HTTP trust boundary (#197)

Kubectl plugin form: rename the downloaded binary to kubectl-landlock_genprof (underscore, not dash — kubectl reads a literal dash as two separate subcommands) and place it on your $PATH — see INSTALL.md. trace requires Linux (Landlock/eBPF); the darwin/windows binaries build and run for version/review but trace will return a clear error there.

v0.4.0

0.4.0 (2026-08-31)

Features

• ui: [v0.4.0][G2] expand Workbench review views (#168) (c9f61f9)
• ui: [v0.4.0][G2] prove or kill a vertical-slice local Workbench (#164) (408790a)

Bug Fixes

• history: partition confidence by evidence population (#175) (504ea40)

v0.3.0

0.3.0 (2026-08-27)

Features

• spo: add governed PodLock and SPO security profile convergence (#154) (089796a)

v0.2.3

0.2.3 (2026-08-20)

Bug Fixes

• docs: repair current architecture diagram (#146) (7a94396)

v0.2.2

0.2.2 (2026-08-20)

Bug Fixes

• docs: align documentation with governed policy lifecycle (#144) (fc3a5d9)