PYLA v0.2.0

PYLA 0.2.0 — first public release of the renamed project (previously Argo).

What's in this release

• Rule sets: unlimited named sets in SQLite, per-rule enable/disable, reorder, duplicate, import from the live UFW state, atomic apply with automatic rollback and command preview.
• Live nftables viewer: read-only view of the whole kernel ruleset (UFW, Docker, libvirt, kernel tables) with live packet/byte counters.
• Exposure check (v3): evaluates TCP listeners (IPv4 and IPv6 assessed separately) against the live nft input chains, so a dual-stack listener on [::] is not masked by an IPv4 verdict.
• CVE intelligence: Ubuntu Security API tracking for the exact running kernel, cached locally in SQLite (schema v2) with lazy background refresh.
• Temporary mitigations: subsystem-level, fully reversible hardening (sysctl or kernel-module blocking) for still-unpatched kernel CVEs, with an exposure check before and after.
• Privilege separation: the GUI runs as the user; root actions go through pyla-helper at a fixed path, authorised by the polkit action space.pyla.app.helper, executing binaries by absolute path with a cleared environment and never through a shell.

Packaging
pyla_0.2.0_amd64.deb installs /usr/bin/pyla, /usr/local/libexec/pyla/pyla-helper, the polkit policy /usr/share/polkit-1/actions/space.pyla.app.policy, the desktop entry space.pyla.app.desktop and icons; the licence is shipped at /usr/share/doc/pyla/copyright.

Upgrading from Argo? Run packaging/migrate-argo-to-pyla.sh before the first launch — see the README.

Verified on the build host: cargo build --workspace OK, cargo clippy --workspace --all-targets clean, cargo test --workspace -> 24 passed / 0 failed (3 --ignored live tests skipped).