v0.3.0

Changes

• #1373 | docs(ui): trim stale nmap CVE footnote from Dockerfile comment
• #1376 | fix(ci): retry check-action-node-versions.sh's action.yml fetch on transient infra response
• #1372 | fix(setup): detect non-functional systemd, not just a present systemctl binary
• #1312 | fix(dhcp): add apk update/upgrade step before package install
• #1272 | Add new CDN domains to cdn-domains.txt & rework sgguestions
• #1257 | test: add cargo-fuzz harnesses for NATS/PowerDNS/Kea/Netdata parsers
• #1208 | feat(dns,dhcp): rescue mode for crash-looping PowerDNS/Kea (#763)
• #1206 | docs(dns): add WHY-comments for RFC 1035 domain-length check and RPZ SOA fields (#724)
• #1139 | dhcp: bound run_dhcp_probe's container wait with a diagnostic-rich timeout
• #1128 | fix(ui): remove duplicate DHCP-mode card, add update-status readout on Setup page (#1068)
• #1122 | fix(images): add nano/lsof/ripgrep + default EDITOR to service images (#1068)
• #695 | docs: record review-gate completion in CHANGELOG
• #542 | Promote v0.2.0 to master (publishes as edge channel)

🐛 Fixed

• #1387 | fix(ci): extend service-scoped skip check into the ancestor-candidate walk
• #1371 | fix(ci): ensure-pr-staging-images falls back to nearest built ancestor when the PR base commit was never built
• #1354 | fix(proxy): forward matched registrable-root standard-mode SNI passthrough to the requested SNI
• #1347 | fix(dhcp): fix silent known-good-snapshot bugs from Alpine migration
• #1351 | fix(watchdog): force base-10 arithmetic for CHECK_INTERVAL/SYSLOG_MAX_GB/selflog env vars
• #1330 | fix(ci): reap stale per-branch Trivy cache directories on runner hosts
• #1277 | fix(proxy): generate deep wildcard certs for multi-label leading-dot CDN entries
• #1325 | fix(ci): stop paths-ignore from permanently blocking required checks on doc-only PRs
• #1326 | fix(ci): reset checkout's actual persisted extraheader before the automated patch-tag push
• #1321 | fix(ci): skip build/test/scan jobs on metadata-only PR events
• #1315 | fix(build-tools): apply project-wide trixie-backports policy to the build-tools image
• #1309 | fix(ui): apply project-wide trixie-backports policy to services/ui's final stage
• #1308 | fix(watchdog): apply project-wide trixie-backports pin policy
• #1311 | fix: apply project-wide trixie-backports package-source policy to services/ntp
• #1307 | fix(dns): apply project-wide trixie-backports package-source policy
• #1310 | fix(dhcp-proxy): add apk upgrade step for base-layer packages
• #1305 | fix(ci): ensure dhcp/dhcp-proxy staging images for the deep-validate syslog simulation
• #1285 | fix(ci): services/ui Docker build touches only main.rs, leaving stale lib.rs mtime (E0432 on every PR)
• #1274 | fix(ci): wire PR_AUTHOR into pr-tracking-metadata-check-hosted job
• #1268 | fix(ui): create stub src/lib.rs for the Dockerfile dependency pre-cache build
• #1248 | fix(watchdog): bound fluent-bit's own self-log file during a syslog-ng outage
• #1266 | fix(ci): stop referencing matrix.language in codeql.yml's job-level if (unbreaks every PR)
• #1251 | ci: harden runner resource lifecycle + move nightly to a green-gated daily build (Q2)
• #1258 | fix(ci): force-kill actionlint with an inner SIGKILL timeout (standalone extraction from #1251)
• #1244 | fix(ci): correct build_retry/docker_buildx_retry's broken pipe-status capture
• #1241 | fix(ci): tear down buildx builders to stop self-hosted runner disk leak
• #1239 | CLD-1784958100 fix(watchdog): add separate timeout for container restart to prevent false-warning race with Docker grace period (#1166)
• #1238 | ci: apply AG-CI-013 retry wrapper to build-push.yml container-scan
• #1240 | fix(ci): retry build-tools.yml's local amd64 image build only on the transient BuildKit layer-lock signature
• #1237 | fix(ci): authenticate validate-compose's build-tools image pull to GHCR
• #1230 | fix: clear checkout's Authorization extraheader before the automated patch-tag push (#819)
• #1227 | fix: add dnsmasq-relay to lancache_ui_dhcp_mode_override_is_valid()'s accept-list
• #1221 | fix: sync RFC 1035 domain-length comment across domain-validation library copies
• #1144 | fix(dhcp): actionable error + convergence fold for never-provisioned DHCP container (#1068 item 6)
• #1177 | fix(ci): answer the LanCache-NG-NTP wizard prompt in expect simulations
• #1173 | fix(tests): retarget healthcheck_service_lists.bats and quickstart_compose_lock.bats at post-#1112 topology
• #1156 | fix(setup): treat one-shot dhcp-probe exit-0 as satisfying the update health gate
• #1154 | fix(ci): resolve_build_tools_channel no longer routes everything to the retired dev channel
• #1097 | docs(ci): correct stale #504 reference in rust_coverage threshold comment
• #1103 | fix(dhcp): make compose healthcheck KEA_CTRL_TOKEN placeholder detection consistent
• #1125 | fix(observability): netdata pid: host for apps.plugin cross-container proc access (#1068)
• #1151 | fix(build-tools): bust apt-get cache layer so security fixes land
• #1142 | ci(release): master publishes latest, current_dev publishes nightly, retire dev channel
• #1127 | fix(dns): friendly PowerDNS default SOA + in-app bare-TLD error banner (#1068)
• #1116 | fix(ui): Admin UI can't read nginx access log (empty cache stats/logs)
• #1102 | fix(dhcp): clean up DDNS records when a lease is released via the Admin UI
• #1101 | fix(ui): make secondary "Copy" button work over plain-HTTP LAN (#1068 item 19)
• #1089 | fix(nats-subscriber): close cross-batch stale-record clobber race (#772)
• #1134 | fix(ci): move Kea sim work_dir out of the git tree so leftovers can't poison checkout
• #1090 | ci: group Dependabot updates to cut merge-burst runner saturation
• #1121 | test: fix disabled-entry test bugs blocking build-tools CI
• #1124 | fix(ci): reset kea-data ownership in dhcp-kea-ctrl-agent-mutation-simulation.sh cleanup
• #1104 | fix: master-targeted build-tools checks resolve to the maintained dev channel
• #1106 | fix: sync grpc-go CVE fix (#1080) from master into current_dev
• #1074 | fix: cdn-domains.txt entries support three explicit, non-overlapping match modes
• #1064 | fix(ci): exempt dependabot[bot] from PR template/tracking-metadata checks (current_dev)
• #1058 | fix(ci): trigger build-push.yml on current_dev pushes/PRs (#1057)

🚀 Added

• #1355 | feat(watchdog): scaffold Rust health-check/restart core
• #1378 | ci(build-push): widen Step 4 push-reuse allowlist to all 8 services (retry of #1356)
• #1374 | build(build-tools): add musl cross-compilation target, verify services/ui musl network paths
• #1353 | test(dhcp): add real-socket regression coverage for dhcp-probe xid/unicast-release/retransmission fixes
• #1346 | fix(watchdog): migrate services/watchdog to an Alpine base
• #1345 | fix(ntp): migrate services/ntp to an Alpine base image
• #1344 | ci: scan the published digest for every service, not only build-tools
• #1336 | feat(dhcp): replace dhcp-probe.sh (nmap+dhclient) with a native Rust DHCP probe
• #1339 | fix(ci): skip build-tools rebuild/rescan on unchanged push, retag channel image instead
• #1331 | ci(build-push): generalize channel-digest push-reuse to 7 product services (Step 4, #1095)
• #1282 | feat(dns): fill uklans/cache-domains gaps in cdn-domains.txt
• #1249 | feat(docker): add real healthchecks to dhcp-proxy, netdata, ntp, docker-socket-proxy
• #1246 | fix(netdata): wire web_log collector into prod and quickstart deploy profiles
• #1247 | feat(watchdog): add alert-only docker-socket-proxy probe
• #1234 | fix(dhcp): migrate dnsmasq and Kea images to Alpine base
• #1235 | feat: forward fluent-bit self-log to syslog-ng and add dhcp/dhcp-proxy E2E logging coverage
• #1174 | Add Admin UI cache-resize capability (issue #1069 part 3)
• #1172 | feat(nats): actively disconnect a secondary's live NATS connection on removal/rotation
• #1168 | security(nats): encrypt auth-callout request/response via xkey
• #1167 | watchdog: monitor and auto-restart nats (#842)
• #1165 | feat(ui): render watchdog per-service health as a live dashboard card
• #1117 | feat(dhcp): add a real dnsmasq DHCP-relay mode alongside ProxyDHCP
• #1157 | ci: auto-close linked issues on current_dev merges
• #1082 | feat: LanCache-NG-NTP -- chrony NTP server with Admin UI + DHCP auto-populate
• #1129 | ci(build-push): path-scope the four redundant Rust jobs on push
• #1111 | feat(ui): manual PTR (reverse DNS) record management + display (#1077)
• #1115 | feat(ui): active DNS health check for secondaries (#1084)
• #1087 | feat(dhcp): accept PXE top-level subnet fields in custom-option routes
• #1096 | feat(dhcp): add independent "Enable DDNS Updates" toggle
• #1099 | docs: Steam prefill design plan + #871 overlap analysis (#816)
• #1105 | setup.sh: allow pinning the standalone bootstrap's git ref
• #1135 | feat(dhcp): show full lease details on a successful client dry-run
• #1093 | feat(nats): hash secondary NATS credentials with Argon2id, not SHA-256 (#680)
• #1098 | docs(governance): require new services to be wired into full-stack CI validation
• #1109 | ci: opt-in GitHub-hosted overflow fallback for image build/scan/publish
• #1086 | docs: written scope decisions for Kea + dnsmasq DHCP Admin UI (#646, #647)
• #1100 | docs: WireGuard remote LAN access design plan (#818)

📚 Documentation

• #1392 | docs(release): record fresh Part B stack-validation pass for v0.3.0 (commit 885e2f4)
• #1390 | docs(governance): add AG-REL-013, fixed branch-promotion procedure
• #1355 | feat(watchdog): scaffold Rust health-check/restart core
• #1388 | docs(governance): add AG-WF-034, no PR-stacking via snapshot copy with prose-only merge order
• #1380 | chore(watchdog): register the new Rust crate with Dependabot/CodeQL/cargo-audit
• #1385 | ci(scripts): add review-chronology comment guard (AG-CODE-003)
• #1387 | fix(ci): extend service-scoped skip check into the ancestor-candidate walk
• #1371 | fix(ci): ensure-pr-staging-images falls back to nearest built ancestor when the PR base commit was never built
• #1386 | docs(governance): add AG-VAL-031, check for a missing assertion before deleting an unused test variable
• #1384 | docs(governance): add AG-VAL-030, shell-semantics constructs need real executed proof
• #1374 | build(build-tools): add musl cross-compilation target, verify services/ui musl network paths
• #1382 | ci(build-push): hard line-count ceiling for workflow files (issue #1095 trigger bug guard)
• #1369 | docs(governance): add standing checks for 2026-08 incidents, refresh validation-state gap
• #1368 | docs(governance): add AG-VAL-029, AG-REL-011 -- release-validation-plan enforcement gap
• #1360 | security(watchdog): extract retention.sh with fail-closed path validation (scaffold, #842 Part 1)
• #1363 | docs(governance): add AG-WF-033, automated-reviewer findings follow the same obligations as human review
• #1362 | docs(governance): add AG-WF-029, recommendation answer is not execution authorization
• #1359 | docs(dhcp): fix stale CSRF-exempt claim for /api/dhcp/check
• #1357 | docs(ci): note workflow_dispatch always fully rebuilds
• #1354 | fix(proxy): forward matched registrable-root standard-mode SNI passthrough to the requested SNI
• #1349 | ci(ci): prepare go-gated docker daemon.json rollout script for runner hosts
• #1346 | fix(watchdog): migrate services/watchdog to an Alpine base
• #1341 | ci(scripts): narrow full-setup deep-validate should_run for verified CI-tooling-only scripts
• #1336 | feat(dhcp): replace dhcp-probe.sh (nmap+dhclient) with a native Rust DHCP probe
• #1338 | docs(security): accept libexpat's 5 unfixed Trivy HIGH CVEs in build-tools as documented residual risk (#1314)
• #1342 | docs(governance): add AG-CI-020, minimum 5-minute CI-check poll interval
• #1333 | docs(governance): add 'ntp' to AG-GH-18 PR-title scope list
• #1335 | docs(governance): add AG-WF-028, no dead/stale characterization without inspecting unique contribution
• #1330 | fix(ci): reap stale per-branch Trivy cache directories on runner hosts
• #1328 | docs(governance): move CLAUDE.md's remaining architecture/design content into AGENTS.md
• #1277 | fix(proxy): generate deep wildcard certs for multi-label leading-dot CDN entries
• #1323 | docs(security): accept curl's 7 unfixed Trivy HIGH CVEs as documented residual risk (#1304)
• #1315 | fix(build-tools): apply project-wide trixie-backports policy to the build-tools image
• #1301 | docs(governance): correct stale libnginx-mod-stream claim (Dockerfile + SoT-proxy.md)
• #1306 | docs(governance): move CLAUDE.md's rule content into AGENTS.md
• #1320 | fix(ci): generalize runner-host cleanup to reap orphaned validation and buildx-builder containers
• #1293 | docs(governance): add AG-CI-019, master-sync gate for CI/governance changes
• #1280 | ci: bump GitHub Actions pins to current latest tags
• #1286 | fix(security): patch golang.org/x/text CVE and suppress non-exploitable docker/docker findings in build-tools
• #1279 | ci(governance): auto-assign Dependabot PR milestones instead of exempting AG-GH-8
• #1289 | docs(governance): clarify AG-GOV-001's AGENTS.md/CLAUDE.md is authoritative on current_dev
• #1291 | docs(governance): add AG-CI-018, schedule triggers only fire from the default branch
• #1292 | docs(governance): add GOVERNANCE.md/ROADMAP.md, restore missing Passing badge, credit vuln reporters
• #1248 | fix(watchdog): bound fluent-bit's own self-log file during a syslog-ng outage
• #1249 | feat(docker): add real healthchecks to dhcp-proxy, netdata, ntp, docker-socket-proxy
• #1261 | docs: expand release-validation-plan.md for 2026-07-25 CI changes + flag validation-state invalidation
• #1246 | fix(netdata): wire web_log collector into prod and quickstart deploy profiles
• #1251 | ci: harden runner resource lifecycle + move nightly to a green-gated daily build (Q2)
• #1247 | feat(watchdog): add alert-only docker-socket-proxy probe
• #1259 | docs(governance): correct AG-GH-8 to require metadata at PR-open time
• #1242 | docs: correct agents.md *again*
• #1234 | fix(dhcp): migrate dnsmasq and Kea images to Alpine base
• #1243 | docs: fix remaining #724 AG-CODE-010 test-purpose-comment gaps + 2 config-template WHY fixes
• #1235 | feat: forward fluent-bit self-log to syslog-ng and add dhcp/dhcp-proxy E2E logging coverage
• #1231 | docs(governance): add AG-CI-014 -- diagnosed CI/release failures must be fixed immediately
• #1226 | docs(validation): recover stranded v0.3.0 Part A CI validation record from #1213's abandoned branch
• #1220 | chore: retire deploy/dev/ and config/dev/ entirely (#766)
• #1225 | docs(governance): add AG-CI-013 -- flaky external operations require a documented retry wrapper
• #1217 | docs: Stack-validation pass results for v0.3.0 (release-validation-plan.md Part B)
• #1207 | docs: DAU-readable incident runbooks for known-good-config-snapshots.md (#763)
• #1213 | docs: fix full-setup-deep-validate.yml branch-trigger claim + record v0.3.0 CI validation pass
• #1210 | docs(governance): add AG-WF-026 (consolidate durable knowledge before lifecycle transitions)
• #1205 | docs: add repeatable release-validation test plan + validation-state tracking
• #1174 | Add Admin UI cache-resize capability (issue #1069 part 3)
• #1172 | feat(nats): actively disconnect a secondary's live NATS connection on removal/rotation
• #1167 | watchdog: monitor and auto-restart nats (#842)
• #1165 | feat(ui): render watchdog per-service health as a live dashboard card
• #1152 | feat(dns): implement dns/pdns target for setup.sh reset-to-last-known-good-config
• #1117 | feat(dhcp): add a real dnsmasq DHCP-relay mode alongside ProxyDHCP
• #1194 | ci: generate per-release SBOMs and publish an OpenVEX document
• #1196 | docs: fix stale v0.2.0 feature-freeze framing in dns-admin-ui-scope.md
• #1189 | docs(security): name GitHub Security Advisories as the vulnerability publication venue
• #1186 | docs: dependency management policy + build-from-source instructions
• #1191 | docs(governance): add AG-CI-012 and AG-WF-025
• #1187 | docs: add OpenSSF Baseline badge to README
• #1193 | docs: CONTRIBUTING.md reflects the now-automated current_dev auto-close
• #1185 | docs: add OSPS Baseline Level 3 policy documentation
• #1183 | docs: refresh threat model for v0.3.0, cover the DNS rollback listener
• #1146 | docs(architecture-ng): Cache Warmer not-yet-implemented, version-field explanation, v0.3.0 AAAA note (#1068 item 5)
• #1182 | docs(governance): add MAINTAINERS.md
• #1145 | docs: adopt AGPL-3.0-or-later LICENSE (maintainer decision, refs #1130)
• #1159 | chore: rewrite pxe-client-probe from Python/scapy to Rust
• #1148 | chore(governance): exempt LICENSE/COPYING from the file-header check
• #1082 | feat: LanCache-NG-NTP -- chrony NTP server with Admin UI + DHCP auto-populate
• #1120 | fix(setup): pre-1.0 channel default, install-requirements commands, actionable no-stack message (#1068)
• #1129 | ci(build-push): path-scope the four redundant Rust jobs on push
• #1150 | fix: DNS healthcheck/functional probes queried steamcontent.com bare apex, no longer covered by RPZ
• #1142 | ci(release): master publishes latest, current_dev publishes nightly, retire dev channel
• #1087 | feat(dhcp): accept PXE top-level subnet fields in custom-option routes
• #1138 | docs(governance): refine issue-before-PR policy, document current_dev auto-close gap
• #1096 | feat(dhcp): add independent "Enable DDNS Updates" toggle
• #1099 | docs: Steam prefill design plan + #871 overlap analysis (#816)
• #1105 | setup.sh: allow pinning the standalone bootstrap's git ref
• #1118 | docs: fix ui-rust-dev-checks.md wording, cross-link release docs, explain Kea multi-threading (#1068)
• #1102 | fix(dhcp): clean up DDNS records when a lease is released via the Admin UI
• #1093 | feat(nats): hash secondary NATS credentials with Argon2id, not SHA-256 (#680)
• #1092 | docs: services/dhcp (Kea) capability inventory + fresh bug-hunt finding
• #1098 | docs(governance): require new services to be wired into full-stack CI validation
• #1126 | docs: privileged-vs-unprivileged LXC runner guidance (#1068)
• #1109 | ci: opt-in GitHub-hosted overflow fallback for image build/scan/publish
• #1114 | docs(governance): add Conventional-Commit PR-title rule and lint
• #1106 | fix: sync grpc-go CVE fix (#1080) from master into current_dev
• #1086 | docs: written scope decisions for Kea + dnsmasq DHCP Admin UI (#646, #647)
• #1100 | docs: WireGuard remote LAN access design plan (#818)
• #1108 | ci: add warn-only guard against direct CHANGELOG.md edits
• #1075 | feat(ui): per-domain enable/disable toggle for Default CDN entries
• #1074 | fix: cdn-domains.txt entries support three explicit, non-overlapping match modes
• #1060 | chore: rename edge release channel to nightly + daily 02:00 CET refresh
• #972 | docs(claude): reconcile CLAUDE.md across master/v0.2.0, tag 12 missing rule IDs
• #970 | docs(agents): reconcile AGENTS.md across master/v0.2.0, tag 28 missing rule IDs
• #823 | docs: require active issue/PR comment maintenance, not just a body

🔧 Dependencies

• #1398 | build(deps): bump the docker-base-images group across 3 directories with 1 update
• #1400 | build(deps): bump the actions group with 3 updates
• #1380 | chore(watchdog): register the new Rust crate with Dependabot/CodeQL/cargo-audit
• #1329 | fix(ci): stop opening Dependabot PRs directly against master
• #1280 | ci: bump GitHub Actions pins to current latest tags
• #755 | chore(deps): bump the actions group with 3 updates
• #754 | chore(deps): bump regex from 1.12.4 to 1.13.0 in /services/ui in the rust-deps group

🧰 Chore / CI

• #1400 | build(deps): bump the actions group with 3 updates
• #1394 | fix(ci): silence SC2154 for Bats' $stderr in staging_ancestor_fallback.bats
• #1390 | docs(governance): add AG-REL-013, fixed branch-promotion procedure
• #1355 | feat(watchdog): scaffold Rust health-check/restart core
• #1388 | docs(governance): add AG-WF-034, no PR-stacking via snapshot copy with prose-only merge order
• #1380 | chore(watchdog): register the new Rust crate with Dependabot/CodeQL/cargo-audit
• #1385 | ci(scripts): add review-chronology comment guard (AG-CODE-003)
• #1387 | fix(ci): extend service-scoped skip check into the ancestor-candidate walk
• #1371 | fix(ci): ensure-pr-staging-images falls back to nearest built ancestor when the PR base commit was never built
• #1378 | ci(build-push): widen Step 4 push-reuse allowlist to all 8 services (retry of #1356)
• #1374 | build(build-tools): add musl cross-compilation target, verify services/ui musl network paths
• #1382 | ci(build-push): hard line-count ceiling for workflow files (issue #1095 trigger bug guard)
• #1383 | docs(ci): condense build-push.yml comments to clear the 8500-line guard
• #1369 | docs(governance): add standing checks for 2026-08 incidents, refresh validation-state gap
• #1360 | security(watchdog): extract retention.sh with fail-closed path validation (scaffold, #842 Part 1)
• #1363 | docs(governance): add AG-WF-033, automated-reviewer findings follow the same obligations as human review
• #1362 | docs(governance): add AG-WF-029, recommendation answer is not execution authorization
• #1361 | docs(ci): note real push-event retag proof is being tested now
• #1354 | fix(proxy): forward matched registrable-root standard-mode SNI passthrough to the requested SNI
• #1352 | build(netdata): evaluate first-party Alpine + musl static-build image (curl visibility caveat, not a clean fix)
• #1351 | fix(watchdog): force base-10 arithmetic for CHECK_INTERVAL/SYSLOG_MAX_GB/selflog env vars
• #1349 | ci(ci): prepare go-gated docker daemon.json rollout script for runner hosts
• #1344 | ci: scan the published digest for every service, not only build-tools
• #1341 | ci(scripts): narrow full-setup deep-validate should_run for verified CI-tooling-only scripts
• #1337 | refactor(setup): add list-prompts wizard introspection mode
• #1336 | feat(dhcp): replace dhcp-probe.sh (nmap+dhclient) with a native Rust DHCP probe
• #1334 | ci(build-push): push-event paths-ignore + supersession self-skip (#1095 Part 1)
• #1339 | fix(ci): skip build-tools rebuild/rescan on unchanged push, retag channel image instead
• #1331 | ci(build-push): generalize channel-digest push-reuse to 7 product services (Step 4, #1095)
• #1342 | docs(governance): add AG-CI-020, minimum 5-minute CI-check poll interval
• #1333 | docs(governance): add 'ntp' to AG-GH-18 PR-title scope list
• #1330 | fix(ci): reap stale per-branch Trivy cache directories on runner hosts
• #1329 | fix(ci): stop opening Dependabot PRs directly against master
• #1277 | fix(proxy): generate deep wildcard certs for multi-label leading-dot CDN entries
• #1325 | fix(ci): stop paths-ignore from permanently blocking required checks on doc-only PRs
• #1326 | fix(ci): reset checkout's actual persisted extraheader before the automated patch-tag push
• #1321 | fix(ci): skip build/test/scan jobs on metadata-only PR events
• #1319 | fix(ci): add real ntp full-setup-deep-validation coverage (3 of 3)
• #1306 | docs(governance): move CLAUDE.md's rule content into AGENTS.md
• #1316 | fix(ci): escape $G in full-setup compose's nats.conf comment (benign interpolation warning)
• #1305 | fix(ci): ensure dhcp/dhcp-proxy staging images for the deep-validate syslog simulation
• #1293 | docs(governance): add AG-CI-019, master-sync gate for CI/governance changes
• #1280 | ci: bump GitHub Actions pins to current latest tags
• #1286 | fix(security): patch golang.org/x/text CVE and suppress non-exploitable docker/docker findings in build-tools
• #1279 | ci(governance): auto-assign Dependabot PR milestones instead of exempting AG-GH-8
• #1289 | docs(governance): clarify AG-GOV-001's AGENTS.md/CLAUDE.md is authoritative on current_dev
• #1291 | docs(governance): add AG-CI-018, schedule triggers only fire from the default branch
• #1285 | fix(ci): services/ui Docker build touches only main.rs, leaving stale lib.rs mtime (E0432 on every PR)
• #1275 | ci(deps): stop Dependabot scanning the frozen v0.2.0 branch
• #1274 | fix(ci): wire PR_AUTHOR into pr-tracking-metadata-check-hosted job
• #1249 | feat(docker): add real healthchecks to dhcp-proxy, netdata, ntp, docker-socket-proxy
• #1266 | fix(ci): stop referencing matrix.language in codeql.yml's job-level if (unbreaks every PR)
• #1262 | ci: gate CodeQL rust analysis on Rust-file changes to stop redundant heavy-runner scans
• #1256 | ci(scripts): add setup.sh/simulation-script prompt drift guard
• #1251 | ci: harden runner resource lifecycle + move nightly to a green-gated daily build (Q2)
• #1258 | fix(ci): force-kill actionlint with an inner SIGKILL timeout (standalone extraction from #1251)
• #1260 | ci(build-tools): narrow image-rebuild trigger to real image-content paths (standalone extraction from #1251)
• #1244 | fix(ci): correct build_retry/docker_buildx_retry's broken pipe-status capture
• #1241 | fix(ci): tear down buildx builders to stop self-hosted runner disk leak
• #1235 | feat: forward fluent-bit self-log to syslog-ng and add dhcp/dhcp-proxy E2E logging coverage
• #1238 | ci: apply AG-CI-013 retry wrapper to build-push.yml container-scan
• #1233 | ci: add language-policy guard enforcing AG-GOV-003 (no banned-language source files)
• #1240 | fix(ci): retry build-tools.yml's local amd64 image build only on the transient BuildKit layer-lock signature
• #1237 | fix(ci): authenticate validate-compose's build-tools image pull to GHCR
• #1230 | fix: clear checkout's Authorization extraheader before the automated patch-tag push (#819)
• #1220 | chore: retire deploy/dev/ and config/dev/ entirely (#766)
• #1218 | ci(build-push): add data-driven timeout-minutes to all 34 jobs
• #1209 | ci: add dnsmasq-relay.conf.template to build-tools.yml path filters
• #1205 | docs: add repeatable release-validation test plan + validation-state tracking
• #1179 | chore(rust): bump all three crates from edition 2021 to edition 2024
• #1172 | feat(nats): actively disconnect a secondary's live NATS connection on removal/rotation
• #1204 | ci: trigger-level paths-ignore for docs-only PRs
• #1152 | feat(dns): implement dns/pdns target for setup.sh reset-to-last-known-good-config
• #1117 | feat(dhcp): add a real dnsmasq DHCP-relay mode alongside ProxyDHCP
• #1199 | test: guard against migrate_env_for_update() key drift vs. its own idempotence fixture
• #1194 | ci: generate per-release SBOMs and publish an OpenVEX document
• #1190 | ci: narrow build-tools job permissions and harden build-tools-image input handling
• #1195 | ci: add current_dev to release-drafter.yml push trigger
• #1202 | ci(build-tools): narrow service-directory wildcards in build-tools.yml's path filter
• #1157 | ci: auto-close linked issues on current_dev merges
• #1144 | fix(dhcp): actionable error + convergence fold for never-provisioned DHCP container (#1068 item 6)
• #1177 | fix(ci): answer the LanCache-NG-NTP wizard prompt in expect simulations
• #1173 | fix(tests): retarget healthcheck_service_lists.bats and quickstart_compose_lock.bats at post-#1112 topology
• #1110 | ci: add current_dev to hardcoded v0.2.0 branch-trigger lists
• #1159 | chore: rewrite pxe-client-probe from Python/scapy to Rust
• #1082 | feat: LanCache-NG-NTP -- chrony NTP server with Admin UI + DHCP auto-populate
• #1120 | fix(setup): pre-1.0 channel default, install-requirements commands, actionable no-stack message (#1068)
• #1129 | ci(build-push): path-scope the four redundant Rust jobs on push
• #1112 | ci: full-setup shared jobs -> reusable workflow + composite actions
• #1097 | docs(ci): correct stale #504 reference in rust_coverage threshold comment
• #1143 | fix(ci): resolve full-setup-client-simulation.sh's leading-dot domain probe
• #1151 | fix(build-tools): bust apt-get cache layer so security fixes land
• #1142 | ci(release): master publishes latest, current_dev publishes nightly, retire dev channel
• #1107 | test(dhcp): E2E simulation for the Admin UI Kea rollback route (#837)
• #1133 | chore(ci): migrate release-drafter.yml to unified category schema
• #1094 | ci: add scheduled channel-install smoke check for setup.sh
• #1126 | docs: privileged-vs-unprivileged LXC runner guidance (#1068)
• #1134 | fix(ci): move Kea sim work_dir out of the git tree so leftovers can't poison checkout
• #1090 | ci: group Dependabot updates to cut merge-burst runner saturation
• #1121 | test: fix disabled-entry test bugs blocking build-tools CI
• #1124 | fix(ci): reset kea-data ownership in dhcp-kea-ctrl-agent-mutation-simulation.sh cleanup
• #1109 | ci: opt-in GitHub-hosted overflow fallback for image build/scan/publish
• #1114 | docs(governance): add Conventional-Commit PR-title rule and lint
• #1060 | chore: rename edge release channel to nightly + daily 02:00 CET refresh
• #1064 | fix(ci): exempt dependabot[bot] from PR template/tracking-metadata checks (current_dev)
• #1058 | fix(ci): trigger build-push.yml on current_dev pushes/PRs (#1057)
• #1034 | Sync v0.2.0 into master (v0.2.0 release)
• #974 | ci: backport 2 missing required-check jobs into master's build-push.yml
• #823 | docs: require active issue/PR comment maintenance, not just a body