LeakScope 0.2.0-rc.1

LeakScope 0.2.0-rc.1

Engineering prerelease. Production certification is incomplete.

Python component: native binaries/web assets are distributed separately in the standalone package.
Native tracing remains opt-in; image runs unprivileged with no BPF capabilities.

Source: 77eb3095be0ac1d3f8078279bacfc7e5a5a3920c.
See release-readiness.json and compatibility.json for precise qualification limits.

Recent reviewed commits

• Prepare v0.2.0-rc.1 (77eb309)
• Record final successful hosted release dry run and recovery regressions (2403968)
• Resolve pending GitHub drafts and bind manual release tags before registry publication (f87285b)
• Record hosted release rehearsal and real prerelease package validation (78fc3e7)
• Reject ambiguous registry ownership metadata and keep prerelease certification explicit (e24827b)
• Bind publication to immutable remote tags and unify manual/tag release locking (ee33b6a)
• Verify read-only release authorization in dry runs and guard consistent build inputs (69cf3c0)
• Preserve sealed runtime bytes in OCI builds and harden release validation races (d80e690)
• Document token-based first releases, channel gates and immutable recovery (41fec5d)
• Fix SBOM version shadowing and require observed GitHub finalization before success (76bec63)
• Validate generated API and Debian metadata during version preparation and release builds (0efb43e)
• Automate immutable token-based multi-registry releases with protected channels and recovery (8e21aaa)
• Centralize ecosystem release versions and make Cargo packages self-contained (1862ef6)
• Record passing remote CI and installed release qualification evidence (a9f3829)
• Document executed Phase 5 qualification and outstanding production gates (1ecbc79)
• Exercise effective-root API guard through the Python entry point (1610b6f)
• Verify real metadata and report preservation across package removal (bc90257)
• Reuse authenticated native-browser readiness and reject unsupported native dispatch (a0a3221)
• Restore executable flags without inheriting installer ACLs or capabilities (1d762e0)
• Reject effective-root API execution and restore under the filesystem owner (91254b4)
• Preserve service-owned databases and avoid inheriting installation ACLs or capabilities (06d2525)
• Reject unsafe installation ownership and privileged rollback paths (8269f98)
• Keep system installation files owned by the installing administrator (0795a3f)
• Checksum every published release payload and exclude stale artifact globs (69cdd9b)
• Qualify native windows through installed services and retain process-wide restore exclusion (7a61f62)
• Protect database bootstrap and require authenticated systemd readiness (040c3cf)
• Verify external sensor cleanup and fail closed on untrusted release environments (2c55351)
• Bound sensor allocator working set and verify active SQLite failure recovery (e65b8cc)
• Bundle offline runtime and qualify versioned deployment and reliability gates (97efd12)
• Harden SQLite persistence and recovery with authenticated deployment diagnostics (d0f8eb4)
• Fix nonblocking agent loss accounting and authenticated soak readiness (56f12b7)
• Record Phase 4 validation, measured costs and open production gates (1758a3c)
• Package source-identified engineering previews with offline checks (421330c)
• Qualify physical bursts and sustained observation with real fixtures (b6f6964)
• Preserve adaptive policy history through hard tracing guards (9430290)
• Connect translated monitoring, findings and comparison workflows (4c9cfbf)
• Expose evidence-backed findings and fail-closed release readiness (854f8e5)
• Bound ingestion pressure and preserve recoverable investigations (1d0a2ea)
• Connect durable metrics monitoring, authorized windows and evidence-backed investigations (8be1a7f)
• Rank sustained growth and leak hypotheses with explicit evidence limits (fcbe000)
• Add measured adaptive safety control and physically detached capture windows (405f22d)
• Document verified Python attribution, measured overhead and remaining release gates (cc30e39)
• Gate Python attribution and package compatibility sources with measured policy benchmarks (9c08181)
• Stream Lab finalization and suppress context after live collection loss (23d9a9e)
• Expose real Python attribution, operation timelines and Lab reports in the UI (fb1fa4b)
• Connect bounded Python operation and verified Lab allocation attribution (263a9bb)
• Add bounded Native Light lifetimes and matched component benchmarks (dadf2e6)
• Update permission and collector-outage runbooks for native capture (0a2896e)
• Align architecture and kernel compatibility documentation with native implementation (bf8d135)
• Declare the offline distribution's Python 3.12 runtime dependency (faedc2b)