[github-actions]

🤖 I have created a release beep boop

0.1.0 (2026-10-13)

⚠ BREAKING CHANGES

• Compose requires POSTGRES_SUPERUSER_PASSWORD, SHOC_DB_PASSWORD, SHOC_APP_DB_PASSWORD and SHOC_AGENT_DB_PASSWORD in .env. An install that ran on the old defaults sets them to postgres, shoc, shoc_app and shoc_agent. Migrations 056-067 run on upgrade.

Features

• agents: the Hunter wakes for each backlog item and closes in code what no source can show (DET-8, AGT-3, D159) (7e35fd9)
• agents: wake agents on the events that concern them (AGT-1, AGT-3, DET-3, ING-2, RFC 0034, D146) (0db13b5)
• cases: a case closed without its containment waits for a person (RSP-3, D152) (b3eb413)
• console: Coverage is a Detection tab, and /coverage redirects to it (e820146)
• console: every list table sorts from its column heads (c9dd1da)
• console: indent raw records that arrive as JSON text, keeping 64-bit IDs exact (a9a692a)
• content: 86 rules and 4 hunt packs from public rule sets, with their upstreams credited in NOTICE (DET-2, ING-3, D156) (1e9915e)
• deploy: build the image with a warehouse extra and pass Databricks settings through Compose (STO-3, D131) (2ef860c)
• detect: Stripe's security actions and a payout to a new destination fire, and the payouts read at install never do (ING-1, DET-1, DET-2, D157) (f669772)
• fix the pre-go-live audit findings and add engineering guidelines (67448bd)
• ingest: a poll starts at the newest event read and waits out the vendor's documented lag (ING-1, ING-3, STO-3, D150, D154) (09fff1d)
• intel: gate the content pipeline on what the tenant can act on, page an uncontained malicious case, and label sources by licence (DET-2, DET-4, DET-7, DET-8, AGT-3, AGT-13, AGT-14, RSP-4, ING-1, D137-D144) (7e168d8)
• shoc 0.0.1, the headless agentic SOC kernel (690f534)
• worker: one 15-minute cycle on every backend (DET-3, ING-1, D71, D151, D153) (eb3f237)

Bug fixes

• agents: Sentinel no longer defers a finding (AGT-13, D145) (74facc3)
• console: know the ATT&CK techniques the new rules and hunts cite (API-1) (ab594da)
• contract: add the hunt.item event to the v1 snapshot (DET-8) (33535e2)
• detect: read the event store only where a load can have changed something (DET-3, DET-4, DET-8, D149) (03fdcc7)
• ingest: a row the last poll already stored never reaches the store (ING-1, ING-3, STO-3, D71, D150) (082069d)
• ingest: GitLab audit events page by keyset and follow the next link as given (ING-1, D70, D155, D158) (477f5f1)
• ingest: GitLab group mode reads every group and project below the group (ING-1, D70, D155) (2bc7697)
• ingest: the Stripe key asks for read on charges and early fraud warnings, unverified (ING-1) (6588d1f)
• ops: source quality charges no actor gap to vendor automation and no lateness to a first backfill (OPS-1) (9c1cd84)
• store: read Databricks timestamps as UTC and quote the qualified events table for SQLGlot (STO-3) (4d3c4f8)
• worker: a source polls a warehouse once a cycle whenever it was configured (ING-1, DET-3, STO-3, D71, D151) (74d8e11)
• worker: a sync wakes detection instead of running it, and the queue cannot outgrow the worker (DET-3, D71, RFC 0034, D147) (b979be8)
• worker: start without the event store, and give a Databricks statement a deadline (DET-3, STO-3, D148) (7dbbd8c)

Performance

• store: a load is read once, and status reads stay in Postgres (DET-3, OPS-1, STO-1, D160-D163) (7f6210b)

Documentation

• confirm Apache 2.0 for the kernel (D12) (4080017)
• drop the length of the Databricks deployment run (STO-3) (246b9a8)
• mark each event store tested, in test or untested (STO-1 to STO-6) (4cb4d04)
• prd: record the Phase 0 repository settings and the green release dry run (aab8285)
• prd: ship each release when its exit criteria are met, and move design partners after v1.0 (dacd372)

---

This PR was generated with Release Please. See documentation.