LUnA v1.4.0

Added

• Noise decided centrally, removed at the source (Apex). A new noise_fingerprint processor enforces the
  platform's noise decisions on the host: it computes the same template fingerprint the platform computes
  at ingest and drops or marks every event whose fingerprint is in its set — one hash lookup per event,
  so thousands of templates cost the same as one. A managed configuration can carry the set today; the
  control plane filling it in automatically follows on its side. By default events of severity err and
  worse always pass.
• The control plane can see — and adopt — the configuration an agent is running. Each heartbeat now
  tells the control plane which configuration the agent runs, so the fleet view can show it and adopt it
  as the managed configuration without anyone copying files off the host. Secrets never leave the host:
  every token, key, password, passphrase and authorization header is replaced by a keep marker before the
  text is sent, and a configuration pulled back with that marker keeps the agent's own local value. A
  pulled configuration the agent has to refuse is now reported on the heartbeat as a failed apply for that
  version, instead of a log line only on the host. Off switch: management.report_config: false.
• Primary and secondary collectors for the syslog output. Give failover_endpoints an ordered list and
  the agent moves to the next collector inside the same delivery attempt when the active one refuses or
  drops a connection, then probes the primary every failback_every and returns to it. The spool now takes
  over only when every endpoint is down. New per-destination metrics report the active endpoint and each
  switch. Syslog and Snare, TCP/TLS. In our end-to-end test the switch took under a second.
• Your heartbeat and /metrics now tell you how stale delivered data is, and how much each processor removed.
  output_event_delay_seconds is the age of the newest event a destination just accepted (source timestamp
  to acceptance — includes upstream lag and spool wait); pipeline_latency_seconds is how long the agent
  itself held it (independent of source clocks). Both have per-destination variants.
  processor_<name>_dropped_total for every processor and processor_reduction_ratio (share of received
  events removed by processors, 0–1) make the edge-reduction funnel a number rather than a claim. The FIPS
  posture (fips140_enabled, fips140_ems_relaxed) now rides every heartbeat too. Every metric carries a
  plain-language description; the Configuration Reference explains each one and /metrics carries the same
  explanation in its HELP text.

Fixed

• buffer.flush_every now takes effect. The setting was accepted and validated but never read: the
  spool drain loop ran at a fixed 2 seconds whatever you configured, and the configuration reference marked
  it "partial". It now paces how often each destination retries its backlog once the output is reachable
  again (live events still ship immediately). If your configuration carries a value other than 2s, drain
  cadence changes to what you asked for on upgrade.

---

About these downloads. LUnA ships as signed binaries — the luna-* assets above are the release.
Verify them with SHA256SUMS and cosign (public key: cosign.pub in this repository).

The "Source code (zip)" / "Source code (tar.gz)" links below are added automatically by GitHub to every
release and cannot be removed. They are not the agent's source, and they are empty: this repository
publishes signed binaries and documentation only. LUnA's source is not publicly distributed.