All pull requests

Pull requests

• ci: bump the actions group across 1 directory with 15 updates

  dependenciesgithub_actions
  #271·dependabot[bot] opened Oct 26, 2026Bot·

  ·
  1

• DRAFT landing: v0.4.0-rc.5 preparation (#265–#269 + release-provenance binding + 3 integration commits)

  #270·ErenAri opened Oct 19, 2026Contributor·

  ·
  1

• install.sh: tell gh capability, auth and API failures apart from a refused verification; bind gh-path installs to attested names

  #269·ErenAri opened Oct 18, 2026Contributor·

  ·
  1

• readiness: date the Falco run from its first target; look up the drill, incident and canary runs

  #268·ErenAri opened Oct 18, 2026Contributor·

  ·
  1

• docs: bind manual release verification to the exact tag and mark rc-only behaviour

  #267·ErenAri opened Oct 18, 2026Contributor·

  ·
  1

• release: let the stable PR and tag build pass the stable canary-pin and doc-pin checks

  #266·ErenAri opened Oct 18, 2026Contributor·

  ·
  1

• release: prepare v0.4.0-rc.5 metadata and an offline, AST-based RC preflight (replaces #264)

  #265·ErenAri opened Oct 18, 2026Contributor·

  ·
  1

• release: prepare rc.5 metadata and verify active preflight pins

  #264·ErenAri opened Oct 18, 2026Contributor·

  ·
  1

• docs: add CLAUDE.md with evidence and parallel-work rules for agents (docs only)

  #260·ErenAri opened Oct 16, 2026Contributor·

  ·
  1

• validator: record every program up to an explicit bound of 1024 (stacked on #254)

  #259·ErenAri opened Oct 15, 2026Contributor·

  ·
  1

• pkg/bpfcompat: library attach-accounting parity with the CLI (stacked on #254)

  #258·ErenAri opened Oct 15, 2026Contributor·

  ·
  1

• gate: mark runs with no required target as diagnostic, not a satisfied gate (future-targeted)

  #257·ErenAri opened Oct 15, 2026Contributor·

  ·
  1

• first run: built-in VM profiles outside a checkout, bpfcompat doctor with real KVM probe, quickstart --out (post-v0.4.0)

  #256·ErenAri opened Oct 15, 2026Contributor·

  ·
  3

• profiles: stop advertising kernel lockdown the lockdown profiles do not run with (future-targeted)

  #255·ErenAri opened Oct 15, 2026Contributor·

  ·
  1

• attach truth: account for every program; required attach is never a partial pass (v0.5)

  #254·ErenAri opened Oct 15, 2026Contributor·

  ·
  1

• release: pin the validator builder's apt to a fixed Ubuntu snapshot (stacked on #250)

  #253·ErenAri opened Oct 15, 2026Contributor·

  ·
  1

• evidence: controlled v0.4.0-rc.4 KubeArmor corrective-run package (stacked on #249; run needs operator approval)

  #252·ErenAri opened Oct 15, 2026Contributor·

  ·
  1

• external canary: bind every consumer lane to the checked-out release's validator (future-targeted, frozen workflow)

  #249·ErenAri opened Oct 15, 2026Contributor·

  ·
  1

• validator: enforce the functional timeout, no shell for bpftool, log-dir handling (v0.4.1 ONLY)

  #247·ErenAri opened Oct 15, 2026Contributor·

  ·
  1

• classifier: don't let program names forge or erase log evidence (stacked on #200, v0.4.1)

  #246·ErenAri opened Oct 15, 2026Contributor·

  ·
  1

• history: opt-in head/record-count pin against rollback (SIGN-3 option A, operator decision, v0.4.1)

  #245·ErenAri opened Oct 15, 2026Contributor·

  ·
  1

• registry: an env trust anchor overrides workdir signing keys (SIGN-1 option A, operator decision, v0.4.1)

  #244·ErenAri opened Oct 15, 2026Contributor·

  ·
  1

• registry: rate-limit audit writes for unauthenticated denials (stacked on #241)

  #243·ErenAri opened Oct 15, 2026Contributor·

  ·
  1

• registry: grants and identities without a tenant authorize nothing; audit needs a token (v0.4.1, security)

  #241·ErenAri opened Oct 15, 2026Contributor·

  ·
  1

• cli: catch dangling-symlink outputs; history verify fails on a missing workdir (stacked on #233)

  #240·ErenAri opened Oct 15, 2026Contributor·

  ·
  1