v2.9.0

2.9.0 (2026-09-08)

Bug Fixes

• audit: a PII block row no longer carries the PII in argsPreview (0c01f07)
• canary: stop trusting the registry when deleting or overwriting files (d1d86d5)
• canary: the block message names the file the decoy came from (abdccd7)
• config: drop the dead SSRF lock, and let an empty list revoke (521d898)
• daemon: carry the SSRF knobs through the cache seam (74bf183)
• daemon: commit the watermark only after the totals upload is acknowledged (822f205)
• egress: accept node9 egress status (7de1912)
• egress: allow node9's own hosts by default (6743029)
• egress: close three SSRF bypasses and a non-overridable false-positive class (5bb917d)
• egress: exempt refuses a hostname, matching the dashboard (f32fcb3)
• egress: three review bugs in the new subcommands and the report (9bb73db)
• engine: bump CANONICAL_EXTRACTOR_VERSION to v10 after the card-detector change (6d5ea41)
• pii: Luhn-validate card matches, cover 15-digit Amex, close the multi-line bypass (40112d1)
• scan: the tool-result DLP path reported nothing, and a decoy hid real leaks (7173ca6)
• shipper: stop shipping canary fields the SaaS schema rejects, which wedged audit shipping (45e81d5)
• stop the floor surfaces claiming more than the floor does (2f9aa4c)
• test: assert on parsed audit rows, not on their JSON serialization (077d064)
• test: the service-removal row must use this platform's own artefact (5c84235)
• uninstall: remove the decoys and the auto-start service, before any purge (dd9b1e3)
• wiring: list UserPromptSubmit in Claude Code's agent spec (219eac8)

Features

• canary: registry, three plant sites, and the node9 canary command; posture learns the decoys (ec97cba)
• canary: the offline seams: transcript daemon, history extractor, extractor hash set (1d9138c)
• canary: the realtime seams: tool-call gate, prompt gate, audit attribution, shipper (5bf5d41)
• canary: the scan report: a tripped decoy is reported above every leak (30c7ba9)
• config: let the dashboard control the SSRF floor knobs (74d368b)
• dlp: canary matcher, seeded decoy generators, and pins for the two seams it will join (e0f6ee2)
• dlp: IBAN, Bitcoin WIF and BIP-32 extended keys, checksum-validated; one suppression path (60896e8)
• egress: make the SSRF floor visible, and reachable without the dashboard (3021a3e)
• egress: SSRF floor, and close a live bypass that reached cloud metadata (1b52968)
• posture: state the SSRF floor as a win, and stop overclaiming the gap (0785079)