## bcoles/kasld — v0.3.0…v0.4.0

_560+ commits._

### Fixes
- **check-results: fix phys/RAM ground truth on arm64 and a false directmap fail** (08f48e8)

### Backend
- **Bump version to 0.4.0** (6049eec)
- **tests: static-link the hash-parity harness so the release CI can run it** (bb04eff)
- **api: generate the option-section headings from the enum's own list** (21c4baf)
- **tests: read the make rule database independently of the invocation** (e842f9e)
- **mali_timeline: probe both the JM and CSF version-check ioctls** (c6d3e33)
- **tests: announce every guard by the name the docs and lint list use** (2e9a281)
- **components: catch a denied device-tree root in the two memory readers** (a6b2eea)
- **tests: check that a second compiler builds every component** (1ed1753)
- **components: distinguish a denied device tree from an absent one** (857d5e0)
- **components: assert config KASLR-off only on an explicit "not off"** (79eb559)
- **components: write inline asm in the syntax the compiler substitutes** (7c8d9af)
- **components: name the full gate set in the last two perf denials** (2237deb)
- **components: read the perf ring through one helper** (3fa6767)
- **orchestrator: record why a component did not run** (e4643f0)
- **api: hold every KASLD_ switch to one reading of "set"** (a7e9cc1)
- **components: name seccomp and LSM among perf_event_open denial causes** (7724c78)
- **check-results: keep the RAM-address checks 64-bit-safe on 32-bit shells** (669261f)
- **components: assert config KASLR-off only on the "is not set" token** (e2767c5)
- **components: don't read a denied /sys/firmware/efi as non-EFI** (49c48bf)
- **components: don't declare KASLR off when the FDT seed is unreadable** (42b41df)
- **anonymize-fdt: drop the Android /chosen/config identity node** (1df17e5)
- **s390: correct the uncoupling boundary in comments to v6.10** (e736422)
- **avx_maskload: decline when a masked-off load faults instead of crashing** (a9f5f3a)
- **components: enforce the experimental gate at both ends** (5b6e944)
- **tests: discover the shell scripts to check rather than listing them** (98fa19e)
- **tests: map a captured machine to its target in one table** (bf1cd0e)
- **tests: name the native build the way the build system does** (86f3f4b)
- **extra: give the captured-bundle layout one reader** (cc294ee)
- **tests: scan for every channel that answers for the running kernel** (b854114)
- **api: read a run's fact source once** (91be27b)
- **tests: cover the Xen ELF note reader over a staged binary fixture** (d75a1c8)
- **cli: read every env switch the way KASLD_VERBOSE is read** (2428930)
- **cli: advertise -t only where a component has a budget** (12f036f)
- **components: give every timing probe a debug env var** (2ae5437)
- **render: read window-ness from the model; drop the change-narration** (e26fc6c)
- **engine: narrow the physical KASLR window on every architecture** (2d586e0)
- **sysroot: describe the release override as the precedence it is** (5bae24e)
- **avx_maskload: require the OS to have enabled AVX, not just the CPU** (4d97d33)
- **tests: allowlist the arm64 TLB fault timer as a live probe** (4d0e665)
- **tests: exercise the shared parsers no component test reached** (2b69067)
- **tests/vm: build a cell's binary before booting it** (7da58a0)
- **tests: measure coverage for the architecture the toolchain builds** (75c3aeb)
- **tests/vm: read the residual entropy where the engine reports it** (55c152c)
- **tests: sweep every built target's components under an empty /proc** (ab6aaaa)
- **rules: floor the direct map at the lowest base each paging level admits** (c7ac7d2)
- **components: state the cpuinfo page-offset floor on the constraint channel** (cabedc6)
- **render: report confinement for a capture that cannot be named** (beeadd5)
- **tests: check macro values stated in comments against the arch headers** (7d0ceb1)
- **tests: compare the arch dispatch chain against the headers on disk** (7a28650)
- **tests: read the documented guard set independently of the run set** (f7134a7)
- **tests: hold every arch header to the mandatory axes on any host** (cc3fb89)
- **tests: drive six parsing components over a staged sysroot** (3d1ee16)
- **tests: cover the hardening report's posture and synthesised gates** (fb3642a)
- **tests: cover the wire and text-order vocabularies** (6e2794c)
- **tests: hold every parsing component to a test** (c3b0141)
- **tests: union coverage across translation units and count the renderers** (a971ce0)
- **boot_params: read a build-time field only from a real setup header** (926c35f)
- **meta: give the component declaration reader its own translation unit** (ce0d548)
- **discard: give the ledger its own translation unit** (ebde071)
- **capture: give the evidence store its own translation unit** (ec66bb3)
- **render: emit the physical window on the same terms as the virtual** (9ad35a3)
- **rules: pin the KASLR grain where it is fixed; cap the module base** (1221669)
- **api: declare the fixed-granularity axis and two scalar facts** (cbc18c0)
- **engine: close the alignment lattice from above as well as below** (44d4407)
- **extra: refuse a posture diff across a live and a replayed run** (5e5179e)
- **orchestrator: apply KASLD_UNAME_RELEASE only alongside a capture** (d996772)
- **tests: take the replayed release from the capture alone** (0682dbf)
- **render: state the entropy baseline on the same rule as the count** (b51c428)
- **tests: hold the documented posture columns to the tool's** (159a94b)
- **api: report an unidentified capture's kernel as unknown** (050da19)
- **report: state the baseline as the upper bound it is** (0388299)
- **anonymize-fdt: keep the unscrubbed tree out of the capture bundle** (c505afd)
- **render: drop two redundant report handles** (7b41f0c)
- **render: let each block space itself from what precedes it, and nothing after** (f84fda2)
- **report: state whether a run read its facts from a captured tree** (14cc830)
- **fixtures: carry ground truth in every replayed capture** (e0c4bfa)
- **tests: contain a base the run resolves, not only one it brackets** (9175d77)
- **extra: trim a capture's kallsyms only when the inference does not move** (f180445)
- **collect: replace the hostname only where it stands as a whole name** (a341cb6)
- **tests: compare the set each count is measured against, not just the count** (2f8082c)
- **render: state the set a count is measured against whenever one exists** (6b9ecd3)
- **collect: carry byte order into the fixture id; cover every arch header** (06b165f)
- **tests: guard the evidence sections against drifting apart** (b46d3fd)
- **collect: record the byte order uname -m cannot state** (77aa215)
- **api: take the replayed kernel release and version from the capture** (e359ec3)
- **render: name an evidence group by its edge, not by a span across it** (a4828a1)
- **orchestrator: stop computing counts nothing reads** (bb016db)
- **report: carry an edge's presence, and mark a grain that is only a floor** (41b568d)
- **render: probe every readable source in the snapshot, not at draw time** (11429b9)
- **tests: ask the map-ceiling question in each arch's own terms** (6f05950)
- **render: take the target's facts from the run, not the analysing host** (176e3e7)
- **render: update output banner** (7aaa850)
- **render: disclose the sub-ranges excluded from a window** (f4015af)
- **render: restore the direct map's residual denominator** (233d830)
- **render: delete the summary fields nothing reads** (65c944f)
- **tests: hold renderers to the model as their only source of resolved values** (2356f4c)
- **tests: compare the counts the readout and json state** (c6a9ccc)
- **render: take every resolved value from the report model** (461ca3d)
- **tests: fuzz the report model** (6312729)
- **render: put the evidence list in a table** (e2e32a3)
- **render: colour the proven answer, and drop the hue from the evidence list** (f4fe20a)
- **render: report every quantity the machine has, including the paging level** (728db11)
- **render: build the json kaslr regions from the report model** (51f609b)
- **render: spell the compile-time default the way the table spells addresses** (690330c)
- **render: draw the Layout table from the report model** (f4b0679)
- **report: build one model of a run, from the engine** (82e8cd1)
- **render: draw the shared row model in every posture; guard it by content** (1743a6c)
- **avx_maskload: give the sweep cap the type of the counts it bounds** (f4dcdb0)
- **components: locate the kernel image from AVX masked-load timing** (c1cc4d0)
- **render: label the component method; drop it from the leak rows** (4af8605)
- **clang-format** (a84fee5)
- **components: recover the arm64 image base from fault-path timing** (1557129)
- **orchestrator: warn when elevated privileges discard the environment** (dbca4df)
- **api: drop KASLD_* on a privilege-gaining exec** (eb0c940)
- **api: fail a fact read that does not fit under the sysroot** (a734207)
- **tests: clear the warnings the drivers emit on a full rebuild** (30034bc)
- **proc_config: decompress without a shell, and without naming the file twice** (508764b)
- **orchestrator: bound the stdout one component may retain under --verbose** (17d5b9d)
- **check-results: validate the resolved image-base windows against truth** (9a6dfd3)
- **orchestrator: reject wire text that would reach the terminal as an escape** (a9dc616)
- **rules: stop converting page-frame numbers with an assumed page size** (32cd635)
- **arch: make the page size an axis, so a PFN is never converted with a guess** (85d166f)
- **tests: hold the component metadata vocabulary to one list** (5efd4a5)
- **syslog: size the log mapping so the caller can terminate it** (a93503b)
- **tests: report a compiler diagnostic from a passing cross build** (a3d4d75)

### Tests
- **test: Add check-fail-closed** (0e5b835)

### Docs
- **docs: update docs** (7c14b9e)
- **docs: correct the KASLR-disabled dmesg strings and lint-guard count** (1f7b3ef)
- **docs: update docs** (e774dc8)
- **docs: distinguish the architectural minimum from the KASLR grain** (9468722)
- **docs: bind the documented readouts to a command that reproduces them** (09e3628)
- **docs: revert verboes output sample** (9a1b726)
- **docs: replay the verbose example instead of curating it** (84f50a4)
- **docs: state which captures the containment gate selects** (f28d5ec)
- **docs: update docs** (4e24663)
- **docs: update docs** (5aa8724)
- **docs: add data structure by layer diagram** (efad7dd)
- **docs: update docs** (38cb534)
- **docs: add CHANGELOG.md** (59a68ed)

### Chore
- **ci: strip the release binaries, preserving their metadata sections** (9d6014e)
- **ci: move the cache and artifact actions to their Node 24 releases** (38bbc4f)
- **build: restore the trailing newlines; build the clang guard as CI does** (0f4fe7c)
- **build: make the compiler fail on what it was only mentioning** (42de9a6)
- **build: ship a stripped tree without losing component metadata** (3e51c59)
- **build: declare the sources a test binary includes, and guard it** (461ff3d)
- **build: link the report builder into the fuzz harnesses, and fix what they depend on** (9fb4b99)
- **build: verify the zlib tarball before it lands, and mirror the fetch** (3fa3fdf)
- **build: link a pinned static zlib into the cross and release builds** (3c2fbdb)
- **build: fail when a component does not compile** (91e6357)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/bcoles/kasld?utm_source=github-action)._