# Changelog

All notable changes to Sorcery-Go are documented here. The format follows
[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project
adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]

### Added
- **BTC 0.4.0 multi-arch cross-compilation support** (`pkg/toolchain/btc.go`)
  - `BTCManifest` struct for structured manifest JSON parsing
  - `BTCForge` extended with `CrossMode`, `TargetID`, `TargetTriple`,
    `TargetMarch`, `CLib`, `Family`, `Manifest` fields
  - `loadManifest()` reads `{SYS_LABEL}-manifest.json` sidecars
  - `ListTargets()` enumerates all available golden images with manifest data
  - `BuildEnv()` uses manifest CFLAGS/triple when available; falls back to
    legacy derivation. Handles musl targets, cross-compiler naming
    (`{triple}-gcc`), and `--sysroot` rewriting for extracted toolchains
  - `rewriteSysroot()` helper replaces build-time sysroot paths with
    the actual extraction path
  - `StampBinary()` uses cross-assembler (`{triple}-as`) when available
  - ISA flag table for AVX512, AVX2, SSE4_2, NEON, MIPS32, TILE
  - SSE4_2 ISA tier added for Intel Atom and AMD APU targets that lack AVX
  - 19 cross-compilation targets: Intel HEDT/Server (5), AMD Ryzen/EPYC (4),
    AMD APU (4: apu-zn1 through apu-zn4), Intel Atom (4: silvermont, goldmont,
    tremont, sierraforest), embedded (mipselr2, armv7, tilegx)
  - New env vars: `BTC_TARGET_ID`, `BTC_CROSS`, `BTC_CLIB`, `BTC_TARGET_TRIPLE`
- **Shared CAS client** (`pkg/cas/`) — content-addressable store client
  for the sorcery-go <-> Fester shared artifact cache
  - `CheckArtifact` — DAG-aware cache check before build dispatch
  - `PushFile` / `PushArtifact` — store .svb bundles and build outputs
  - `RetrieveArtifact` / `RetrieveArtifactToFile` — fetch cached artifacts
  - `Stats` — cache hit rate, utilization, artifact count
  - Auto-initialized when Fester integration is active
- **BTC.sh toolchain integration** (`pkg/toolchain/btc.go`)
  - `Probe()` — detect BTC.sh golden images at /opt/BTC
  - `BuildEnv()` — return BTC-aware CC/CXX/CFLAGS/LDFLAGS
  - `VerifyStamp()` — read .note.BTC ELF note and xattr stamps
  - `StampBinary()` — apply forensic stamps (ELF note, xattr, debug symbols)
  - Pipe-delimited format matching BTC.sh and Fester
- **Cauldron.BundleAndCache** — one-call bundle + CAS push method
- **Scheduler.Dispatch now CAS-aware** — checks shared CAS before
  dispatching to Fester; skips builds for cached artifacts
- **FesterClient.CAS field** — shared CAS client embedded in the
  Fester HTTP client, available to all cluster operations
- **Deterministic task IDs** — replaced `crypto/rand` with atomic counter +
  nanosecond timestamp (`sync/atomic` + `time.Now().UnixNano()`). No
  cryptographic randomness dependency remains in the codebase.

### Changed
- **Security model**: Firewall-first architecture replaces mTLS. Transport
  security delegated to network boundary (OPNsense / IPFire). No application-
  layer TLS certificates, key management, or CRL propagation required.
- **eBPF security** replaces AppArmor as primary enforcement mechanism
  - `tomb_guard.bpf.c` — LSM hooks for file/inode protection
  - `sorcery_filter.bpf.c` — cgroup filters for device/network whitelisting
  - AppArmor profiles retained as fallback
- **License** changed from GPL-3.0 to AGPL-3.0-or-later
- **Fester cluster integration** — full delegation of distributed build
  scheduling, node telemetry, and build dispatch to Fester
- **NVD API v2 client** with SQLite WAL cache replaces hardcoded CVE data
- **Sovereign Bundle (.svb)** format with ed25519 signatures and
  per-file SHA-256 MANIFEST.txt
- **Port**: Fester default port changed from 8080 to 8181 to resolve conflict
  with sorcery-go.

### Removed
- **All `crypto/rand` usage** — removed from `pkg/web/server.go` and
  `cmd/sorcery/commands.go`. Zero active `crypto/rand`, `crypto/tls`, or
  `crypto/x509` code paths remain in default builds.
- **`pkg/warding/keys.go`** — dead code gated behind `//go:build mtls`
  build tag. Contained CA key generation logic that is no longer used.
- **`FesterTLS` config field** and `SORCERY_GO_FESTER_TLS` env var — no
  longer needed with firewall-first model.
- **`TLSConfig()` method** on the Fester client — transport security is
  now handled by the network boundary.

### Fixed
- Added missing `bytes` import to `state.go` (compile failure).
- Added `defer` mutex unlock in `Banish()` (deadlock on panic).
- Fixed BTC.sh SHA-256 checksum ordering (was computed before tarball creation).
- Added cycle detection to dependency solver (stack overflow on circular graphs).
- Fixed ELF note type mismatch in BTC stamp format (7 -> 1, now matches
  BTC.sh NT_VERSION).

## [1.0.0] — 2026-03-17 — "The Sovereign Coven"

### Added
- **The Cauldron** — Go build engine with OverlayFS sandbox isolation
- **The Tablet** — ACID BoltDB journal for y/n configuration persistence
- **The Tomb** — content-addressable Merkle-tree storage for Essences
- **The Warding** — security layer with eBPF + OpenSnitch/Portmaster integration
- **The Coven** — firewall-isolated cluster with Fester-scheduled builds
- **Gaze** — reverse-path inventory query engine
- **Legal Sentinel** — license compliance with three posture templates
- **ICE** — Interactive Configuration Engine preserving the y/n query UX
- **Cauldron Portable Bin** — static ELF generation for standalone tools
- **Emergency Kit** — curated static bundle (busybox, gdisk, e2fsck, etc.)
- **Coven Mirror WebUI** — Cockpit-integrated dashboard
- **Bubble Tea TUI** — tmux-style build dashboard
- **Multi-arch support** — `--target x86_64|aarch64` and `--matrix`
- **Sub-Depends solver** — feature-aware DAG with Re-Forge triggers
- **Disaster Recovery Tome** — restore the entire Coven from backup
- **Toolchain Validator** — smoke-tests GCC/LLVM for SSP, PIE, LTO