Changelog

0.5.0

• add string rule packs plus rat pack, custom packs load free
• add local sha blocklist via intel add and import
• add entropy jump flags in verify and check
• add profiles home, server, uploads, paranoid
• add config lint, per path entropy lines, allowlist
• guard spares allowlisted and signed binaries
• add vault history with keep count, rollback restores pre hit
• add baseline seal with tamper warn
• add bench, policy, prune, incident, service, intel commands
• add systemd unit, launchd plist, windows task docs
• watch counts health, doctor shows it

• ci runs ubuntu, windows, macos

• add response tiers warn, auto, paranoid to watch

• auto kills writer and jails binary, paranoid freezes rest
• add binquar with sha index plus quar list and resume
• add harden one pass: canaries, autostart, net, drift
• add persist scan for Run keys, Startup, cron, autostart
• add netscan for odd ports and odd bins
• add five decoy canaries on init and watch
• add win-task logon task plus windows guide
• popups on windows via box, toast with plyer

• human pass over new code and docs

• add check with risk clean/warn/high plus json and sarif

• add why to explain one file score
• add diff using vault copies
• add protect vault fill and restore clean
• add update fast rehash
• add learn to suggest burst
• add timeline, serve with /json, config-init, doctor
• add watch --daemon, rename and delete storm rules
• store entropy at baseline time
• add mail alerts, sarif output
• add mkdocs site plus pages and ci workflows
• human pass over all code and docs

0.2.0

• add scan, report, events, snaps, restore, status, clean
• add yaml config plus .sentinelignore
• add ransom note and ext scoring
• add json logs and html report
• add webhook, desktop note, optional kill
• add docs folder and examples
• threaded baseline

0.1.0

• first cut: init, verify, watch, demo
• burst plus entropy plus canary