v0.4.0

[0.4.0] - 2026-06-09

Added

• Native Transparent IPv6 Support: Implemented dynamic IPv6 loopback detection, generating dual-stack or IPv4-only configurations depending on system availability. Added comprehensive IPv6 nftables rules for DNS/TCP redirection, loopback exemptions, and RFC 4193/RFC 3927 local range bypassing.
• Network Resilient Watchdog: Watchdog service now detects physical network carrier drops and default route removal. Under network offline states, watchdog checks are safely suspended to prevent false-positive emergency lockouts, automatically resuming after link reconnection and circuit stabilization.
• Structured JSON Logging: Added global --log-format command-line option supporting text and json outputs. Selecting json configures stdout/stderr and file log outputs to emit single-line structured JSON records with UTC ISO 8601 timestamps, log levels, logger namespaces, messages, and exception stack traces.
• Extended DoH Domain Blocking: Added MapAddress entries in torrc to neutralize DoH canary domains for Cloudflare (use-application-dns.net), Google, Quad9, OpenDNS, and AdGuard, signalling DoH-compliant browsers to fall back to the system resolver (which is safely routed through Tor).
• DoH IP-Level Blocking: Added filter_out nftables rules to reject TCP port 443 traffic destined for well-known DoH resolver IPs (Cloudflare, Google, Quad9, OpenDNS) - both IPv4 and IPv6 - as a defence-in-depth measure against non-compliant browsers that ignore the canary domain.
• CI/CD: Ruff Format Check: Added ruff format --check as the first step in scripts/verify.sh to enforce consistent formatting before any other pipeline step.
• CONTRIBUTING.md: Added ## Coding Standards section (ruff check/format commands, PEP 8 reference, type annotation requirement, no-dead-code rule) and ## Developer Certificate of Origin (DCO) section (sign-off requirement, git commit -s instructions, git rebase --signoff for retroactive signing, full DCO v1.1 text in collapsible block). Both sections added to the Table of Contents.
• docs/architecture.md: Removed duplicated content now canonical in interfaces.md. Section 4 (CLI command list) replaced with a cross-reference. Section 3.3 (firewall.py) condensed to design principles only, with execution order detail referenced from interfaces.md § 3.1. Section 3.4 (dns.py) condensed to design rationale only, with attribute table referenced from interfaces.md § 3.2. Section 3.6 (cli.py) trimmed to remove inline command enumeration, referencing interfaces.md § 1.
• README.md: ## Known Behavior section renamed to ## Known Behavior & Limitations and condensed — verbose inline explanations removed in favour of a reference to docs/security-assessment.md as the single source of truth for the risk breakdown.
• SECURITY.md: ## Scope bullet list condensed to a one-sentence summary with a cross-reference to docs/security-assessment.md for the full threat model.
• docs/security-assessment.md: Dependency monitoring table (§ 5.2) replaced with a cross-reference to DEPENDENCIES.md § 2.3 as the authoritative source for CVE scanning and Dependabot configuration.

Fixed

• Critical: DNS Leak via LAN Bypass Rule Ordering (firewall.py): The nftables output chain evaluated the LAN bypass rule (ip daddr { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 } accept) before the DNS redirect rule. Browsers that cache the LAN gateway (e.g. 192.168.1.1:53) as their DNS resolver would have their queries accepted by the LAN bypass and sent directly to the ISP resolver - bypassing Tor entirely. The DNS redirect rule now runs before the LAN bypass in both the output and prerouting chains. Discovered via manual leak testing on browserleaks.com/dns.
• Watchdog: Passive Tor Health Check (False Negative) (watchdog.py): check_system_integrity() was verifying Tor health via ctrl.close(), a local Python object operation that succeeds even when the Tor daemon has crashed and only a stale socket file remains. Replaced with ctrl.get_info("status/bootstrap-phase"), an active round-trip query that correctly raises an exception on a dead or stale socket.
• Watchdog: Ignored Auto-Healing Return Value (Killswitch Delay) (watchdog.py): run_watchdog_loop() ignored the return value of attempt_auto_healing(). If the healing command itself failed (e.g. nft unable to re-apply rules), the loop would still wait 3 seconds, re-run the integrity check, detect the same failure, and only then activate the killswitch - creating a window where traffic could flow in cleartext. The emergency killswitch is now triggered immediately if attempt_auto_healing() returns False.
• SELinux Module Version Inconsistency (scripts/install.sh): The shell installer checked for the presence of the ttp_tor_policy module without verifying its version. If v1.0 was installed, the script would skip reinstallation while Python's tor_detect.py would still report the module as outdated (requiring v1.1). The check is now grep -qE "ttp_tor_policy[[:space:]]+1\.1", consistent with the Python detection logic.