LogLens v0.6.0 — Detection Episodes, Parser Coverage, and Audit Signals

Highlights

• Multiple time-separated detection episodes for one rule subject.
• Stable finding identity fields: finding_id and episode_index.
• Report schema v3: loglens.report.v3 with schema_version: 3.
• Modular parser handler registry.
• Deterministic parser property coverage and optional libFuzzer smoke coverage.
• Dedicated util-linux login handler for selected login failure and session messages.
• Audit-only privilege authentication signals for sudo and su failures; these remain visible without counting as detector evidence by default.

Upgrade note

Consumers of loglens.report.v2 / schema_version: 2 should migrate to v3 and use finding_id or include episode_index, window_start, window_end, and evidence_event_ids in their composite identity.

The optional CSV contract is unchanged. Findings remain bounded triage signals; this release does not claim compromise, attribution, blocking, or cross-host correlation.

Issues #100–#102 are intentionally outside the v0.6.0 release scope.