v0.3.0

Changes

• #1373 | docs(ui): trim stale nmap CVE footnote from Dockerfile comment
• #1376 | fix(ci): retry check-action-node-versions.sh's action.yml fetch on transient infra response
• #1372 | fix(setup): detect non-functional systemd, not just a present systemctl binary
• #1312 | fix(dhcp): add apk update/upgrade step before package install
• #1272 | Add new CDN domains to cdn-domains.txt & rework sgguestions
• #1257 | test: add cargo-fuzz harnesses for NATS/PowerDNS/Kea/Netdata parsers
• #1208 | feat(dns,dhcp): rescue mode for crash-looping PowerDNS/Kea (#763)
• #1206 | docs(dns): add WHY-comments for RFC 1035 domain-length check and RPZ SOA fields (#724)
• #1139 | dhcp: bound run_dhcp_probe's container wait with a diagnostic-rich timeout
• #1128 | fix(ui): remove duplicate DHCP-mode card, add update-status readout on Setup page (#1068)
• #1122 | fix(images): add nano/lsof/ripgrep + default EDITOR to service images (#1068)
• #695 | docs: record review-gate completion in CHANGELOG
• #542 | Promote v0.2.0 to master (publishes as edge channel)

🐛 Fixed

• #1387 | fix(ci): extend service-scoped skip check into the ancestor-candidate walk
• #1371 | fix(ci): ensure-pr-staging-images falls back to nearest built ancestor when the PR base commit was never built
• #1354 | fix(proxy): forward matched registrable-root standard-mode SNI passthrough to the requested SNI
• #1347 | fix(dhcp): fix silent known-good-snapshot bugs from Alpine migration
• #1351 | fix(watchdog): force base-10 arithmetic for CHECK_INTERVAL/SYSLOG_MAX_GB/selflog env vars
• #1330 | fix(ci): reap stale per-branch Trivy cache directories on runner hosts
• #1277 | fix(proxy): generate deep wildcard certs for multi-label leading-dot CDN entries
• #1325 | fix(ci): stop paths-ignore from permanently blocking required checks on doc-only PRs
• #1326 | fix(ci): reset checkout's actual persisted extraheader before the automated patch-tag push
• #1321 | fix(ci): skip build/test/scan jobs on metadata-only PR events
• #1315 | fix(build-tools): apply project-wide trixie-backports policy to the build-tools image
• #1309 | fix(ui): apply project-wide trixie-backports policy to services/ui's final stage
• #1308 | fix(watchdog): apply project-wide trixie-backports pin policy
• #1311 | fix: apply project-wide trixie-backports package-source policy to services/ntp
• #1307 | fix(dns): apply project-wide trixie-backports package-source policy
• #1310 | fix(dhcp-proxy): add apk upgrade step for base-layer packages
• #1305 | fix(ci): ensure dhcp/dhcp-proxy staging images for the deep-validate syslog simulation
• #1285 | fix(ci): services/ui Docker build touches only main.rs, leaving stale lib.rs mtime (E0432 on every PR)
• #1274 | fix(ci): wire PR_AUTHOR into pr-tracking-metadata-check-hosted job
• #1268 | fix(ui): create stub src/lib.rs for the Dockerfile dependency pre-cache build
• #1248 | fix(watchdog): bound fluent-bit's own self-log file during a syslog-ng outage
• #1266 | fix(ci): stop referencing matrix.language in codeql.yml's job-level if (unbreaks every PR)
• #1251 | ci: harden runner resource lifecycle + move nightly to a green-gated daily build (Q2)
• #1258 | fix(ci): force-kill actionlint with an inner SIGKILL timeout (standalone extraction from #1251)
• #1244 | fix(ci): correct build_retry/docker_buildx_retry's broken pipe-status capture
• #1241 | fix(ci): tear down buildx builders to stop self-hosted runner disk leak
• #1239 | CLD-1784958100 fix(watchdog): add separate timeout for container restart to prevent false-warning race with Docker grace period (#1166)
• #1238 | ci: apply AG-CI-013 retry wrapper to build-push.yml container-scan
• #1240 | fix(ci): retry build-tools.yml's local amd64 image build only on the transient BuildKit layer-lock signature
• #1237 | fix(ci): authenticate validate-compose's build-tools image pull to GHCR
• #1230 | fix: clear checkout's Authorization extraheader before the automated patch-tag push (#819)
• #1227 | fix: add dnsmasq-relay to lancache_ui_dhcp_mode_override_is_valid()'s accept-list
• #1221 | fix: sync RFC 1035 domain-length comment across domain-validation library copies
• #1144 | fix(dhcp): actionable error + convergence fold for never-provisioned DHCP container (#1068 item 6)
• #1177 | fix(ci): answer the LanCache-NG-NTP wizard prompt in expect simulations
• #1173 | fix(tests): retarget healthcheck_service_lists.bats and quickstart_compose_lock.bats at post-#1112 topology
• #1156 | fix(setup): treat one-shot dhcp-probe exit-0 as satisfying the update health gate
• #1154 | fix(ci): resolve_build_tools_channel no longer routes everything to the retired dev channel
• #1097 | docs(ci): correct stale #504 reference in rust_coverage threshold comment
• #1103 | fix(dhcp): make compose healthcheck KEA_CTRL_TOKEN placeholder detection consistent
• #1125 | fix(observability): netdata pid: host for apps.plugin cross-container proc access (#1068)
• #1151 | fix(build-tools): bust apt-get cache layer so security fixes land
• #1142 | ci(release): master publishes latest, current_dev publishes nightly, retire dev channel
• #1127 | fix(dns): friendly PowerDNS default SOA + in-app bare-TLD error banner (#1068)
• #1116 | fix(ui): Admin UI can't read nginx access log (empty cache stats/logs)
• #1102 | fix(dhcp): clean up DDNS records when a lease is released via the Admin UI
• #1101 | fix(ui): make secondary "Copy" button work over plain-HTTP LAN (#1068 item 19)
• #1089 | fix(nats-subscriber): close cross-batch stale-record clobber race (#772)
• #1134 | fix(ci): move Kea sim work_dir out of the git tree so leftovers can't poison checkout
• #1090 | ci: group Dependabot updates to cut merge-burst runner saturation
• #1121 | test: fix disabled-entry test bugs blocking build-tools CI
• #1124 | fix(ci): reset kea-data ownership in dhcp-kea-ctrl-agent-mutation-simulation.sh cleanup
• #1104 | fix: master-targeted build-tools checks resolve to the maintained dev channel
• #1106 | fix: sync grpc-go CVE fix (#1080) from master into current_dev
• #1074 | fix: cdn-domains.txt entries support three explicit, non-overlapping match modes
• #1064 | fix(ci): exempt dependabot[bot] from PR template/tracking-metadata checks (current_dev)
• #1058 | fix(ci): trigger build-push.yml on current_dev pushes/PRs (#1057)

🚀 Added

• #1355 | feat(watchdog): scaffold Rust health-check/restart core
• #1378 | ci(build-push): widen Step 4 push-reuse allowlist to all 8 services (retry of #1356)
• #1374 | build(build-tools): add musl cross-compilation target, verify services/ui musl network paths
• #1353 | test(dhcp): add real-socket regression coverage for dhcp-probe xid/unicast-release/retransmission fixes
• #1346 | fix(watchdog): migrate services/watchdog to an Alpine base
• #1345 | fix(ntp): migrate services/ntp to an Alpine base image
• #1344 | ci: scan the published digest for every service, not only build-tools
• #1336 | feat(dhcp): replace dhcp-probe.sh (nmap+dhclient) with a native Rust DHCP probe
• #1339 | fix(ci): skip build-tools rebuild/rescan on unchanged push, retag channel image instead
• #1331 | ci(build-push): generalize channel-digest push-reuse to 7 product services (Step 4, #1095)
• #1282 | feat(dns): fill uklans/cache-domains gaps in cdn-domains.txt
• #1249 | feat(docker): add real healthchecks to dhcp-proxy, netdata, ntp, docker-socket-proxy
• #1246 | fix(netdata): wire web_log collector into prod and quickstart deploy profiles
• #1247 | feat(watchdog): add alert-only docker-socket-proxy probe
• #1234 | fix(dhcp): migrate dnsmasq and Kea images to Alpine base
• #1235 | feat: forward fluent-bit self-log to syslog-ng and add dhcp/dhcp-proxy E2E logging coverage
• #1174 | Add Admin UI cache-resize capability (issue #1069 part 3)
• #1172 | feat(nats): actively disconnect a secondary's live NATS connection on removal/rotation
• #1168 | security(nats): encrypt auth-callout request/response via xkey
• #1167 | watchdog: monitor and auto-restart nats (#842)
• #1165 | feat(ui): render watchdog per-service health as a live dashboard card
• #1117 | feat(dhcp): add a real dnsmasq DHCP-relay mode alongside ProxyDHCP
• #1157 | ci: auto-close linked issues on current_dev merges
• #1082 | feat: LanCache-NG-NTP -- chrony NTP server with Admin UI + DHCP auto-populate
• #1129 | ci(build-push): path-scope the four redundant Rust jobs on push
• #1111 | feat(ui): manual PTR (reverse DNS) record management + display (#1077)
• #1115 | feat(ui): active DNS health check for secondaries (#1084)
• #1087 | feat(dhcp): accept PXE top-level subnet fields in custom-option routes
• #1096 | feat(dhcp): add independent "Enable DDNS Updates" toggle
• #1099 | docs: Steam prefill design plan + #871 overlap analysis (#816)
• #1105 | setup.sh: allow pinning the standalone bootstrap's git ref
• #1135 | feat(dhcp): show full lease details on a successful client dry-run
• #1093 | feat(nats): hash secondary NATS credentials with Argon2id, not SHA-256 (#680)
• #1098 | docs(governance): require new services to be wired into full-stack CI validation
• #1109 | ci: opt-in GitHub-hosted overflow fallback for image build/scan/publish
• #1086 | docs: written scope decisions for Kea + dnsmasq DHCP Admin UI (#646, #647)
• #1100 | docs: WireGuard remote LAN access design plan (#818)

📚 Documentation

• #1392 | docs(release): record fresh Part B stack-validation pass for v0.3.0 (commit 885e2f4)
• #1390 | docs(governance): add AG-REL-013, fixed branch-promotion procedure
• #1355 | feat(watchdog): scaffold Rust health-check/restart core
• #1388 | docs(governance): add AG-WF-034, no PR-stacking via snapshot copy with prose-only merge order
• #1380 | chore(watchdog): register the new Rust crate with Dependabot/CodeQL/cargo-audit
• #1385 | ci(scripts): add review-chronology comment guard (AG-CODE-003)
• #1387 | fix(ci): extend service-scoped skip check into the ancestor-candidate walk
• #1371 | fix(ci): ensure-pr-staging-images falls back to nearest built ...

v0.2.0

Changes

• #1013 | perf(cargo): tune release profile (lto=fat, codegen-units=2) for lancache-ui and nats-subscriber
• #982 | security: eliminate remaining argv secret exposure found during #955 review
• #981 | refactor(tests): dedupe cmd_secondary heredoc-extraction logic in bats tests
• #943 | test(setup): cover the reset-to-last-known-good-config Kea recovery family
• #795 | fix: prove SSL-mode DNS routes to a distinct MITM endpoint (#668)
• #744 | fix: close arm64 rollout gaps in backfill guard, docs, and setup.sh platform check
• #746 | fix: harden ssl-mitm-cache-simulation.sh against 5 robustness gaps
• #747 | docs: explain shared validation-network proxy address for SSL/standard DNS (#668)
• #713 | docs: batch-fix 7 documentation accuracy issues
• #708 | fix: prefix build-tools branch tags to avoid release-tag collision
• #690 | ci: derive Compose project name and Admin UI port per validation run
• #691 | ci: attest the merged multi-platform manifest digest in merge-manifests
• #689 | test: repeat-run idempotence proof for Kea DHCP config snapshot adapter (#640)
• #693 | fix(dhcp): stop writing host-reservation-identifiers at Kea subnet scope
• #687 | ci: complete cheap-lint GitHub-hosted fallback, document Rust/image fallback decision
• #688 | test: repeat-cycle convergence tests for watchdog restart/status writer
• #684 | fix: close build-tools manifest merge permission and tag races
• #643 | feat(dhcp-proxy): expose configurable dnsmasq relay/proxy DHCP options
• #678 | fix(ci): publish_coverage_badge skipped on push due to implicit success() trap
• #589 | ci(_Issue510): publish dynamic Rust coverage badge
• #631 | feat: persisted known-good Kea DHCP config snapshots (#614)
• #638 | feat(logging): syslog-ng central receiver + fluent-bit forwarder (dev/prod/quickstart)
• #637 | dhcp: safe Kea activation preflight before serving LAN clients
• #641 | test: repeat-run idempotence proof for setup.sh update .env migration (#456)
• #649 | docs: reword CHANGELOG "Unreleased" heading to reflect the dev channel
• #642 | dhcp: real Kea lease-flow behavior test, distinct from #377 discovery
• #635 | docs: define project-wide runtime naming convention
• #636 | fix: remove last CACHE_DIR_STANDARD/CACHE_DIR_SSL residue after single-CACHE_DIR migration
• #629 | fix: publish OCI index-level description annotations on manifest lists
• #627 | ci: push PR-scoped staging tags so full-setup-validate tests the PR's own commits
• #616 | feat: known-good configuration snapshots for nginx and dnsmasq (#415)
• #600 | ci: default full-setup-validate to edge, not stale latest
• #624 | ci: derive full-setup-validate subnet per-run instead of hardcoded 172.30.99.0/24
• #618 | fix: restore executable bit on ui-nats-dns-integration-simulation.sh
• #613 | fix: feed distcc-pump bare hostnames and stop treating --randomize as a host list
• #609 | fix: distinguish git dubious-ownership rejection from no-.git in setup.sh
• #602 | ci: add a check that git-tracked files use Unix (LF) line endings
• #594 | ci: execute setup.sh end-to-end instead of only bash -n (#403)
• #612 | docs: move Watchtower entry from Deprecated to Changed in CHANGELOG.md
• #608 | feat: real UI -> NATS -> DNS integration test, fix LAN record flow being completely non-functional
• #606 | fix: build docker CLI and docker-compose from source to fix CVE-2026-39822
• #598 | ci: real DNS/HTTP/HTTPS caching test against a Debian mirror
• #604 | fix: register template functions before parsing templates in load_templates
• #592 | ci: native arm64 image builds on GitHub-hosted runners
• #593 | docs(agents): AG-CI-008 -- Dockerfile ARG defaults are not a CI bug
• #582 | ci(_Issue557): add full-setup client simulation
• #588 | ci(_Issue528): verify build-tools arm64 scan image
• #591 | ci: _Issue509 github-hosted fallback for shellcheck and policy
• #584 | feat(_Issue556): add DHCP lease release and custom options
• #587 | feat(_Issue544): show running image version in Admin UI
• #585 | docs(_Issue549): document single cache migration touchpoints
• #576 | ci(_Issue569): attest stack pointer provenance
• #580 | ci(_Issue565): allow host network scan builds
• #572 | fix(_Issue563): migrate legacy strict proxy defaults
• #575 | ci(_Issue570): avoid build-tools fallback on light runner
• #579 | ci(_Issue566): run coverage merge in build-tools
• #581 | feat(_Issue560): run dashboard collectors concurrently
• #578 | ci(_Issue567): refresh build-tools multiarch bases
• #564 | docs: align action pinning guidance
• #577 | fix(_Issue568): carry pinned release tag resolution
• #574 | fix(_Issue561): preserve UI auth secret generation failures
• #573 | docs(_Issue562): document mirror.gcr.io base image policy
• #586 | docs(governance): merge triplicate no-new-language rules into AG-REL-001
• #531 | chore(governance): Track B hardening — rule IDs, enforcement matrix, conflict resolution, closing-report contract
• #554 | Update CONTRIBUTING.md for AI assistance notice
• #551 | docs: expand NGINX_UPSTREAM_RESOLVER note in README into a clear explanation
• #553 | feat: add project logo, favicon, and Admin UI branding
• #548 | feat: derive SSL cert root domains from cdn-domains.txt via real PSL
• #530 | docs: Fix three documentation-drift issues (DNS, auth, console behavior)
• #546 | fix(proxy): correct X-Served-By response header to lancache-ng
• #542 | Promote v0.2.0 to master (publishes as edge channel)
• #543 | docs: reconstruct full v0.2.0 changelog, bump crate versions to 0.2.0
• #541 | ci: re-authenticate to GHCR and back off before the in-job build retry
• #539 | fix(quickstart): copy dhcp-probe.sh into install dir, not just docker-socket-proxy.sh
• #527 | fix: improve error message when latest channel is unavailable
• #518 | feat(dhcp): complete dnsmasq-proxy mode with docs, tests, and compose coverage
• #517 | ci(codeql): surface Rust extraction-quality signal instead of silent green
• #535 | fix(ui): missing curl for full-setup healthcheck + drop unauthorized Go toolchain from build-tools
• #522 | docs: require issue depth and explicit successor-coverage statements
• #534 | fix(ci): make validate-full-setup-image wait for promote on push events
• #533 | fix(ci): stop promote/release from being silently skipped on push events
• #521 | fix(build): add sccache-failure fallback to Dockerfile run_cargo_build
• #520 | docs: document dev-stack .env resolution and Admin-UI auth-gate behavior
• #515 | test(nats-subscriber): add unit tests for real subscribe/forward logic (Closes #504)
• #512 | docs: document build-tools container as the only valid verification path
• #513 | docs: create CHANGELOG.md with v0.1.0 release notes
• #511 | docs: fix outdated two-proxy architecture description
• #516 | fix(ci): resolve full-setup-validate image channel from the target branch
• #514 | fix(tests): use single-quoted trap in setup-migration-semantics.sh
• #507 | feat(ci): wire up the documented but never-implemented dev channel
• #503 | ci: trigger build-push/codeql/build-tools workflows on v0.2.0 too
• #482 | ci: refresh build-tools libc headers

🐛 Fixed

• #1022 | ci: verify bats/shellspec/docker buildx in build-tools smoke test + add drift guard (#822 Pattern G)
• #984 | fix: collect all missing cmd_secondary arguments and report together
• #976 | fix: sync cmd_secondary() heredoc healthcheck with dig-based probe (#946)
• #978 | fix: close DHCP domain/hostname/MAC validation gaps and CSRF-exempt GET /api/dhcp/check
• #960 | security: validate cdn-domains.txt entries before generating RPZ rules
• #933 | fix(ci): persist validation teardown env before non-retryable failures (#932)
• #953 | test: explain what each UI test actually checks (config.rs, main.rs, dhcp.rs)
• #956 | fix: stop exposing PAT/token as plain argv secrets
• #951 | test: basic_auth middleware full-chain integration tests
• #958 | docs: translate remaining German comments in deploy configs
• #931 | ci: retry Buildx bootstrap on GitHub-hosted arm64 runners
• #941 | fix(setup): declare leaked locals in migrate_env_for_update and cmd_secondary
• #939 | fix(setup): fail closed on cmd_restore's install-path sed rewrite
• #936 | fix(ci): verify base-channel image freshness before untouched-service backfill
• #934 | fix(ci): governance-guard check live-fetches PR title/body instead of stale event snapshot
• #929 | ci: generation-age retention for persistent Trivy cache dirs
• #927 | ci(build-tools.yml): scope Trivy cache dirs per ref and self-clean ephemeral ones
• #911 | fix(ci): stop racing Docker's growing restart backoff in crash-loop sim final check
• #881 | fix(ui): refuse remote-secondary registration without a reachable NATS URL
• #924 | fix(ci): ci_scope_policy Buildx guard could never fail (self-matching grep pattern)
• #922 | fix(ci): remove per-row fork storm in check-logging-matrix.sh's doc parser (Refs #633)
• #918 | fix(ci): serialize promote/backfill tag moves with a git-ref lock, not GH concurrency
• #916 | fix(nats): grant dns-ssl replica publish on lancache.dns.record (#906)
• #909 | fix(ci): strip CRLF from gh-fetched PR bodies before awk parsing
• #882 | fix(dns): grant rollback flush publish permission + surface flush failure (#867)
• #907 | ci: wrap two unwrapped stack-starting validation jobs in run-in-validation-subnet.sh
• #878 | fix(ui): report error instead of success on failed CDN domain write
• #905 | fix(ci): widen workflow-level permissions, fetch PR labels/milestone live too (#903 follow-up)
• #877 | fix: standardize SYSLOG_ENABLED/SYSLOG_MAX_GB parsing between Admin UI and watchdog
• #903 | fix(ci): checkout in ci_scope_policy (#901), fetch PR body live not from stale event payload
• #892 | fix(ci): scope build-push.yml cancellation to build/container-scan, not the whole run
• #880 | fix(ci): expand build-tools.yml path filter to real bats dependencies
• #890 | docs: stop CHANGELOG.md merge-conflict cascade at its source (Fixes #889)
• #885 | fix: watchdo...

v0.1.0

First initial Pre-release. this should work like it is.