LUnA v1.2.0

Licensing — fifteen modules are now marked Apex (advance notice; nothing is disabled)

Fifteen modules belong to the paid Apex tier but were not marked as Apex in the
documentation and were not checked at startup. They are now marked and checked. This release
disables none of them.

	Modules
Inputs	etw · wmi · linux_audit · mqtt_in
Processors	redact · lookup · adaptive_sample
Outputs	snare · hec · sentinel · xsiam · kafka · s3 · loki · otlp

What you will see. If your entitlement does not cover these and your configuration uses
them, the agent logs one warning at startup naming exactly which modules are affected, and
reports its licence posture as degraded on /metrics and on every heartbeat. Every module
keeps running and no events are lost. Managed fleets will see affected agents marked
degraded in the fleet view — that is the notice reaching you, not a fault.

What changes later. These modules are disabled at the next major version, in line with
the published deprecation policy — one full release line of notice. Before upgrading to that
version, either install a licence (licensing.license_file), enroll the agent with a licensed
logrok deployment (Apex is included at no charge), or move the pipeline onto Core modules.

The free Core tier is unchanged and nothing was taken out of it: file tail, syslog-in,
journald, HTTP-in, the parsers (parse_json, parse_csv, parse_kv, parse_xml, expr,
add_fields, filter), RFC 5424 syslog output over TCP/TLS, and /metrics — free, at any
scale, with no licence. Core forwarding is never blocked in any licence posture, and TLS is
never gated. The dividing line is now stated plainly in the operator documentation: Core
collects from the host and forwards one open standard to one destination; anything that reads a
privileged or proprietary operating-system subsystem, or speaks a named vendor or platform API,
is Apex.

Existing licensed and logrok-managed deployments are unaffected — an Apex entitlement already
covers all fifteen.

Fixed

• The quota processor is now actually withdrawn when unlicensed. quota is an Apex
  capability and was correctly detected and reported as one, but the degrade path never removed
  it — so an agent that had degraded to Core carried on enforcing its daily volume cap. If you
  are running quota without an entitlement, that cap now stops being applied when the agent
  degrades. Licensed deployments are unaffected.

---

About these downloads. LUnA ships as signed binaries — the luna-* assets above are the release.
Verify them with SHA256SUMS and cosign (public key: cosign.pub in this repository).

The "Source code (zip)" / "Source code (tar.gz)" links below are added automatically by GitHub to every
release and cannot be removed. They are not the agent's source, and they are empty: this repository
publishes signed binaries and documentation only. LUnA's source is not publicly distributed.