sorcery-go/CHANGELOG.md

Changelog

All notable changes to Sorcery-Go are documented here. The format follows Keep a Changelog, and the project adheres to Semantic Versioning.

[1.1.0] — 2026-07-12

Added

• BTC 0.4.0 multi-arch cross-compilation support (pkg/toolchain/btc.go)
  • BTCManifest struct for structured manifest JSON parsing
  • BTCForge extended with CrossMode, TargetID, TargetTriple, TargetMarch, CLib, Family, Manifest fields
  • loadManifest() reads {SYS_LABEL}-manifest.json sidecars
  • ListTargets() enumerates all available golden images with manifest data
  • BuildEnv() uses manifest CFLAGS/triple when available; falls back to legacy derivation. Handles musl targets, cross-compiler naming ({triple}-gcc), and --sysroot rewriting for extracted toolchains
  • rewriteSysroot() helper replaces build-time sysroot paths with the actual extraction path
  • StampBinary() uses cross-assembler ({triple}-as) when available
  • ISA flag table for AVX512, AVX2, SSE4_2, NEON, MIPS32, TILE
  • SSE4_2 ISA tier added for Intel Atom and AMD APU targets that lack AVX
  • 19 cross-compilation targets: Intel HEDT/Server (5), AMD Ryzen/EPYC (4), AMD APU (4: apu-zn1 through apu-zn4), Intel Atom (4: silvermont, goldmont, tremont, sierraforest), embedded (mipselr2, armv7, tilegx)
  • New env vars: BTC_TARGET_ID, BTC_CROSS, BTC_CLIB, BTC_TARGET_TRIPLE
• Shared CAS client (pkg/cas/) — content-addressable store client for the sorcery-go <-> Fester shared artifact cache
  • CheckArtifact — DAG-aware cache check before build dispatch
  • PushFile / PushArtifact — store .svb bundles and build outputs
  • RetrieveArtifact / RetrieveArtifactToFile — fetch cached artifacts
  • Stats — cache hit rate, utilization, artifact count
  • Auto-initialized when Fester integration is active
• Cauldron.BundleAndCache — one-call bundle + CAS push method
• Scheduler.Dispatch now CAS-aware — checks shared CAS before dispatching to Fester; skips builds for cached artifacts
• FesterClient.CAS field — shared CAS client embedded in the Fester HTTP client, available to all cluster operations
• Deterministic task IDs — replaced crypto/rand with atomic counter + nanosecond timestamp (sync/atomic + time.Now().UnixNano()). No cryptographic randomness dependency remains in the codebase.

Changed

• Security model: Firewall-first architecture replaces mTLS. Transport security delegated to network boundary (OPNsense / IPFire). No application- layer TLS certificates, key management, or CRL propagation required.
• eBPF security replaces AppArmor as primary enforcement mechanism
  • tomb_guard.bpf.c — LSM hooks for file/inode protection
  • sorcery_filter.bpf.c — cgroup filters for device/network whitelisting
• License changed from GPL-3.0 to AGPL-3.0-or-later
• Fester cluster integration — full delegation of distributed build scheduling, node telemetry, and build dispatch to Fester
• NVD API v2 client with SQLite WAL cache replaces hardcoded CVE data
• Sovereign Bundle (.svb) format with ed25519 signatures and per-file SHA-256 MANIFEST.txt
• Port: Fester default port changed from 8080 to 8181 to resolve conflict with sorcery-go.

Removed

• All crypto/rand usage — removed from pkg/web/server.go and cmd/sorcery/commands.go. Zero active crypto/rand, crypto/tls, or crypto/x509 code paths remain in default builds.
• pkg/warding/keys.go — dead code gated behind //go:build mtls build tag. Contained CA key generation logic that is no longer used.
• FesterTLS config field and SORCERY_GO_FESTER_TLS env var — no longer needed with firewall-first model.
• TLSConfig() method on the Fester client — transport security is now handled by the network boundary.

Fixed

• Added missing bytes import to state.go (compile failure).
• Added defer mutex unlock in Banish() (deadlock on panic).
• Fixed BTC.sh SHA-256 checksum ordering (was computed before tarball creation).
• Added cycle detection to dependency solver (stack overflow on circular graphs).
• Fixed ELF note type mismatch in BTC stamp format (7 -> 1, now matches BTC.sh NT_VERSION).

[1.0.0] — 2026-03-17 — "The Sovereign Coven"

Added

• The Cauldron — Go build engine with OverlayFS sandbox isolation
• The Tablet — ACID BoltDB journal for y/n configuration persistence
• The Tomb — content-addressable Merkle-tree storage for Essences
• The Warding — security layer with eBPF + OpenSnitch/Portmaster integration
• The Coven — firewall-isolated cluster with Fester-scheduled builds
• Gaze — reverse-path inventory query engine
• Legal Sentinel — license compliance with three posture templates
• ICE — Interactive Configuration Engine preserving the y/n query UX
• Cauldron Portable Bin — static ELF generation for standalone tools
• Emergency Kit — curated static bundle (busybox, gdisk, e2fsck, etc.)
• Coven Mirror WebUI — Cockpit-integrated dashboard
• Bubble Tea TUI — tmux-style build dashboard
• Multi-arch support — --target x86_64|aarch64 and --matrix
• Sub-Depends solver — feature-aware DAG with Re-Forge triggers
• Disaster Recovery Tome — restore the entire Coven from backup
• Toolchain Validator — smoke-tests GCC/LLVM for SSP, PIE, LTO