# Changelog

All notable changes to Warlock's Stave (`stave-core` crate) will be documented in this file.

## [7.0.0] - 2026-07-04

### Added
- Core engine with hexagonal heatmap timeline (axial coordinates, f64 pixel raycasting)
- Predictive branch evaluator (iced-x86 1.21.0, 15-byte safe decoder bounds)
- Dictionary scanner with default threat-hunting library (6 rules)
- Pluggable signature database engine with `ExternalScannerProvider` trait
- Mirror Illusion section-aware binary diff engine
- Tri-Tier Scope Engine (Global, Local, Micro)
- State Decay System for mutation highlight fadeout
- Shellcode Sentinel (memory permission transition monitor via `/proc/<pid>/maps`)
- Self-assembling IPC: Unix sockets, TCP loopback, named-pipe translation
- Thread-safe core via `Arc<Mutex<HexHeatmapEngine>>`
- C-FFI boundary layer (4 public functions with `#[no_mangle]`)
- JNI extension for Java-based host integration
- egui 0.27.0 4-quarter workspace UI
- Linux eBPF kernel tracing (aya 0.11.0, kprobe on `sys_enter_connect`)
- Windows ETW real-time telemetry session
- Polymorphic IPC evasion detection with Shannon entropy analysis
- UEFI NVRAM and ACPI table firmware analysis
- Pre-flight environment validator binary
- Evasion telemetry simulation binary
- Cross-compilation support for Wine plugin bridge (MinGW)
- Comprehensive unit test suite (14 tests)
- `rustdoc` examples on all FFI functions

### Design Decisions
- Engine is permanent; UI is disposable (Unix Philosophy)
- Host environments are untrusted; core has zero UI toolkit dependencies
- All IPC and FFI communication uses stateless JSON-Lines protocol
- Error paths return static data-segment strings to prevent host memory leaks
- `setcap` is never called inside the build script; printed as optional post-build step