Skip to content

v2.0.0

Choose a tag to compare

View all tags
@kabirnarang39 kabirnarang39 released this 09 Aug 07:00
· 22 commits to main since this release
v2.0.0
04200b3

Wardline v2.0.0 — the v2.0 milestone (273+ commits since v1.0.4), closing out the roadmap's "v2.0 (shipped)" feature set plus a security + docs hardening pass.

Highlights since v1.0.0

  • Federation — cross-instance anomaly correlation over signed, pseudonymized peer summaries.
  • ML-based anomaly detection + auto-block — combined z-score ml_score heuristic and a real, time-bounded auto-block enforcement action.
  • SSO / SCIM + tenant isolation — OIDC and mTLS/SPIFFE credential bootstrap, SCIM-provisioned RBAC, tenant enforced end to end.
  • Three policy backends — YAML, OPA/Rego, and Cedar; policy enforcement widened to MCP resources/* and prompts/*.
  • Compliance evidence export hardening — RSA-PSS signing + verify-evidence, scheduled export, log retention, redacted identities, live aggregate API.
  • Policy-pack marketplace — YAML/OPA/Cedar pack variants, versioning, compose, and an operator -packs-dir.
  • HA — Postgres-backed budget counters, anomaly baselines, distributed auto-block, and signing-key rotation (JWKS kid).
  • gRPC transport — a second listener running the same identity → policy → budget → audit → auto-block pipeline.
  • Pixel-parity web dashboard with read-only Policy/Budget/RBAC/Anomalies/Blocked views and clickjacking protection.

This release's hardening pass

  • Security fix: SCIM PATCH deactivate no longer silently 204s a no-op — a missing Operations wrapper or unsupported op returns 400, so an offboarding can't report success without applying.
  • Refresh-token reuse detection + family revocation — replaying a consumed refresh token is treated as theft: the whole token family is revoked atomically (SELECT … FOR UPDATE across replicas), logged as a SECURITY event, and masked to a generic 401.
  • Anomaly baseline pruning — abandoned/renamed replicas' Postgres baseline rows are cleaned up automatically on the GC tick.
  • gRPC upstream TLS — grpc_upstream_tls dials the upstream over TLS instead of plaintext.
  • verify-evidence closed file-set — rejects a bundle carrying files outside its checksum manifest.
  • Helm chart now exposes the full config surface (rbac, anomaly, scim, federation, compliance, retention, credential OIDC/mTLS, gRPC).
  • Docs reconciled with shipped features; new gRPC transport + Federation pages; complete CLI/config reference; a live make demo.

Single static Go binary, Apache-2.0. No database, IdP, or sidecar required to start.

Assets 2
Loading