What we shipped, when.

1. v0.1.x · 2026-06-24 polish sprint

   2026-06-24 shipping

   Cyber Guild hub redesign, plain-English CYCON explainer, notification reliability, Herald narrative sanitizer.

   • · New /ai-agents Cyber Guild hub. Wired-agent count strip + org chart matching the marketing-site Guild card style (Sovereign + Regent always rendered at the top with a 'Not attached' hint when no federation is configured). 8 chapter columns, Marshal-first in Command, italic class titles, mono uppercase chip labels. Click any agent → personnel file with prompt + per-role provider configuration.
   • · Plain-English 'Why CYCON N?' card on /overview + /cycon. Translates the deescalation state into one sentence ('CYCON 5 · Steady Watch — Quiet window met, queue cleared') with an inline countdown badge. The full /cycon variant has an expandable disclosure with the raw engine note + queue gates + drop policy for trust-but-verify.
   • · Per-model report card on each agent profile. Real comparison of API vs Local lane on the SAME workload (24h window): invocations, p50 + p95 latency, error rate, cost per call. Backed by a SQLite-backed cross-process invocation ledger so the syslog-ingest path and the dashboard Test button feed the same surface — the ledger now survives engine restarts.
   • · Notification reliability — dispatcher now short-circuits its retry loop when the upstream returns HTTP 429 (rate-limited). Pre-fix a single ntfy.sh free-tier quota exhaustion logged 2,469 hammering attempts in one day; post-fix it lands one failed row and waits. Retry-After is captured for the v1.x cross-dispatch circuit breaker.
   • · Herald narrative sanitizer. The local Herald GGUF sometimes emits decision-packet JSON instead of the layman 'what happened, why it matters' paragraph the CYCON Activity feed needs. The sanitizer detects JSON-shape output and replaces it with a deterministic 2-sentence summary built from validated Digest fields ('Detected high-severity event: …; recommended action is isolate_host; confidence 82%'). Empty narratives are preserved so the existing 'Herald couldn't summarize' affordance still triggers.
   • · Zero-streak deescalation accelerator. When 3 consecutive signals don't raise CYCON, the timer to the next step-down attempt drops from 4 hours to 30 minutes. The active-risk-zero window gets the same treatment. Operators in a quiet system see CYCON return to peacetime faster.
   • · Queue severity gate. INFO-passthrough events no longer clog the operator inbox — the queue now filters by status + severity ≥ medium. Operator-decided signals (watching → MONITORING wire status) clear from the queue immediately instead of showing as 'AI-triaged' alongside truly-undetermined rows.
   • · Polish: idempotent case-close (close on a CLOSED case is now a no-op, not an error), Investigate verdict now actually creates a case via the real lifecycle promotion path, /cases/$id navigation no longer 404s on parent-layout missing Outlet, sticky-footer save bars on every dashboard modal.
   Full release notes + asset manifest →

2. v0.1.x · 2026-06-20 sprint

   2026-06-20 shipping

   Architecture program — human-first triage, per-connector fairness, AI lane admission control.

   • · Human-first triage: every signal row in the dashboard has Ignore / Monitor / Investigate buttons that fire instantly, without waiting on AI. Operator decisions overrule AI for CYCON math the moment they land. Every decision writes a labeled TriageDecision row that the v1.5 local Warden trains on — your operator's calibration becomes your model's calibration.
   • · Per-connector bounded queue + round-robin drain in the syslog substrate. A noisy connector (Suricata under a port scan) now saturates its own 10K-frame queue and sheds to dead-letter — UniFi / Wazuh queues are unaffected. Replaces the pre-fix single shared FIFO that allowed head-of-line blocking.
   • · Bounded Warden admission control. The AI lane caps active+waiting inference at 3 (default; CYBERCLI_WARDEN_MAX_INFLIGHT overrides). Past the cap, new arrivals route to the passthrough lane immediately — no 14-min queue join under firehose load. The signal still lands at raw severity; only the AI narrative is skipped.
   • · Herald severity floor — skip the layman-narrative pass on medium events by default. Warden's structured digest still runs at every medium+; the AI work cost drops ~33% on a typical SOC mix. Operators with AI budget can lower via CYBERCLI_HERALD_MIN_SEVERITY.
   • · GET /v1/system/ingest-health endpoint + dashboard health badge. Surfaces systemd state, per-connector queue depth, drop counters, Warden bypass count, and a derived pressure label (ok / throttled / critical / failed / unknown).
   • · Cgroup safety net: MemoryHigh=3G / MemoryMax=4G + StartLimitBurst=3 / StartLimitIntervalSec=300 on cybercli-syslog-ingest.service. A runaway connector can't OOM the host; a sustained failure surfaces as `systemctl status` (no silent restart loop).
   • · Suricata VRL severity honesty: pre-fix every alert hardcoded to MEDIUM, regardless of Suricata's actual alert.severity. Now maps sev=1 to CRITICAL, sev=2 to HIGH, sev=3 to MEDIUM, sev>=4 / unknown to INFO+passthrough. ET scan noise routes to passthrough instead of burying real signal.
   • · Dashboard fixes: SSE hello-event datetime crash (signals_stream.py), CSRF marker port-conflict guard with engine + webui port probes hoisted out of the spawn-success branch (catches the orphan-host.mjs scenario buyers hit on Suppress).
   Full release notes + asset manifest →

3. v0.1.0

   2026-06-10 shipping

   First public release.

   • · Single-binary install for macOS (Intel + Apple Silicon) and Linux (amd64 + arm64). Windows ships alongside.
   • · Two live Cyber Guild roles routed end-to-end in v1: Warden (triage) + Herald (notification). Knight, Marshal, Paladin, and Scribe have published charters and are configured in guild_doctrine.json but are NOT invoked until v1.1 multi-pass orchestration ships — per src/cybercli/digest/pipeline.py the runtime only invokes 'triage' (Warden) and 'gate' purposes today.
   • · Hash-chained audit log under $CYBERCLI_DATA_DIR/audit.db — `cybercli audit verify` recomputes every entry from genesis.
   • · Trust Ladder L0-L7 with default ceilings per tier; every action gated by signed entitlements.
   • · Free tier covers 10 endpoints + every OSS connector. Founder Pro locks $299/yr lifetime for the first 10,000 sign-ups or anyone before January 1, 2028 — whichever comes first.
   Full release notes + asset manifest →

Stay current

// patch notes · every operator should read these.