v0.2.0-beta.4

Changelog

• 29000f7: chore(deps): add Dependabot and freeze pre-commit revs (#73) (@ujjaval-verma)
• d8180ce: chore(make): install only the tools each target runs (#90) (@ujjaval-verma)
• 51c19c8: chore(make): vet 32-bit targets in make check; LoadRetained at four sizes (#95) (@ujjaval-verma)
• 1878d5b: ci: rename nightly workflow to main-verify (#69) (@ujjaval-verma)
• 46ee58d: fix(cmd/ward,hostlist): one remediation per loader error and bounded hostlist WARN (#99) (@ujjaval-verma)
• dd801e9: fix(dataplane): Shutdown right after Serve no longer leaves Serve running (#88) (@ujjaval-verma)
• cf131b1: fix(decoy,hostlist): shared fuzz log counter, one SkippedLines meaning, overlong-line remediations (#86) (@ujjaval-verma)
• e2ba6f0: fix(serve): one listen validator for ward.yaml and the serve flags (#78) (@ujjaval-verma)
• 9e353c1: fix(serve): start the dashboard after the dataplane server exists (#66) (@ujjaval-verma)
• b0d10f8: fix(upstream): close_notify for expired idle extras, Close-path tests, burst timing in main-verify (#94) (@ujjaval-verma)
• 388be51: refactor(hostlist): the query side folds with hostlist.FoldName (#72) (@ujjaval-verma)
• ef9a312: refactor(serve): extract startup steps from serveRun (#70) (@ujjaval-verma)
• 5b3a4ff: refactor(serve): inject the second-signal exit and extract the wait and shutdown steps (#71) (@ujjaval-verma)
• 296861f: refactor(ward): one constructor for the model: stanza in ward eval and ward serve (#93) (@ujjaval-verma)
• fdca4af: test(cmd/ward): cover doctor's real TCP bind and prove the serve TCP path (#98) (@ujjaval-verma)
• 15355d0: test(cmd/ward): doctor and TCP-twin bind-probe seams, waits to 5 s (#84) (@ujjaval-verma)
• 2d7d825: test(config,hostlist,decoy): fuzz the file loaders and require Load error remediations (#82) (@ujjaval-verma)
• a79bcf6: test(dataplane): benchmark handleQuery with the in-process assessor (#81) (@ujjaval-verma)
• 07a6887: test(serve): finish the port-race cleanup and deadline-based failover tests (#79) (@ujjaval-verma)

v0.2.0-beta.3

Upgrade notes

• Security: built with Go 1.26.10, which fixes GO-2026-6809 in crypto/x509 (reachable via ward update verify). v0.2.0-beta.2 was built with Go 1.26.8, so upgrade.
• Breaking: ward serve, ward doctor, ward config export and ward eval now reject a config with an unknown key or a second YAML document. They exit with code 2 and name the key, its line and the valid keys (#39).
• ward serve exits non-zero when the DNS port bind fails (#43).

Highlights

• ward serve --listen-addr <host:port>, and the bound address in the dns: listening and dashboard: ready log lines (#49).
• Pooled DoT upstream connections: a 100-query burst went from 46 to 647 qps (#53).
• Hostlist retained heap is down 44%.
• One hostname rule set for block/allow/decoy lists and the wasm demo. Underscore labels now load, and invalid decoy names are skipped with a WARN (#65).
• Model child lifecycle is bounded and reported on /healthz, classify concurrency is bounded, and built-in classifications drain on shutdown.

Verify with cosign v3 as described in docs/engineering/release.md.

Changelog

• e537cef: chore(check-public): drop two personal identifiers from the internal-only pattern (#7) (@ujjaval-verma)
• ae31286: chore(ci): nightly post-merge verification of main (ADR-0002 amendment) (#34) (@ujjaval-verma)
• 7d4148c: chore(deps): bump Go toolchain to 1.26.9 (#6) (@ujjaval-verma)
• 6db4d40: chore(deps): bump golang.org/x/crypto and x/net, require Go 1.26 (#9) (@ujjaval-verma)
• 1af905a: chore(hooks): bring cold pre-push under 20 s and run the full race suite (#33) (@ujjaval-verma)
• c1a38b2: chore(hooks): fail make check and pre-push on unpinned workflow actions (#51) (@ujjaval-verma)
• 717af95: chore(hooks): run invariant gates on pre-push (#32) (@ujjaval-verma)
• abe3f56: docs(adr): record secret scanning and SHA-pinned Actions policy (#38) (@ujjaval-verma)
• 6f686fa: docs(security): point reporters to GitHub private reporting and record the settings in ADR-0002 (#55) (@ujjaval-verma)
• 61f1a37: fix(check-public): fail when git grep errors instead of passing silently (#8) (@ujjaval-verma)
• 6e57402: fix(config): reject unknown YAML keys (#39) (@ujjaval-verma)
• ff1caf9: fix(dataplane): drain built-in classifications on Shutdown (#47) (@ujjaval-verma)
• e865fda: fix(dataplane): exit non-zero when the DNS port bind fails (#43) (@ujjaval-verma)
• b27c9f3: fix(dataplane): give the upstream fallback its share of the query budget (#44) (@ujjaval-verma)
• fd6e314: fix(deps): bump Go toolchain to go1.26.10 for GO-2026-6809 (#37) (@ujjaval-verma)
• 1912019: fix(model): bound classify concurrency so a burst no longer disables the classifier (#45) (@ujjaval-verma)
• 33469b8: fix(model): bound the model child's lifecycle and report it on /healthz (#48) (@ujjaval-verma)
• 3bf9e89: perf(hooks): pre-push budget to 30 s, concurrent gates, parallel deadline tests (#56) (@ujjaval-verma)
• ef969dd: perf(upstream): pool DoT connections so throughput is not capped at 1/RTT (#53) (@ujjaval-verma)
• 4d8d660: refactor(config): deduplicate list-source validation and move file I/O out of validate (#63) (@ujjaval-verma)
• 3f81992: refactor(hostlist): hash-indexed arena storage cuts retained heap 44% (#60) (@ujjaval-verma)
• e149e7b: refactor(hostlist): one hostname rule set for hostlist, decoy and the wasm demo (#65) (@ujjaval-verma)
• ea65045: test(cmd/ward): make the builtin flags-on-dashboard serve test deterministic (#49) (@ujjaval-verma)
• 6b3d1eb: test(perf): add benchmarks for the DNS hot path and list loading (#58) (@ujjaval-verma)

v0.2.0-beta.2

Changelog

• d22d630: fix(release): sign checksums as a cosign v3 Sigstore bundle (#5) (@ujjaval-verma)