v0.2.8.0 — changelog + version lockstep bump

CHANGELOG.md

@@ -6,6 +6,40 @@ Format: version, date, then grouped by category (Added, Changed, Removed, Fixed,
 
 ---
 
+## v0.2.8.0 (June 2026)
+
+### Added
+- Process explorer: on-demand `/proc` scanning with osquery-parity detail (command line,
+  cwd, environment size, open sockets with inode correlation, capabilities, namespaces),
+  plus a dedicated settings page with lazy route loading.
+- Inventory scanner interface with a Docker inventory path; inventory and security-event
+  report handlers on the server.
+- Self-update capability tokens for the agent, helper, and desktop binaries — binary
+  self-upgrade now flows through the same Ed25519-signed, hash-pinned token gate as
+  package installs.
+- Setup accepts an operator-supplied signing keypair (with validation) instead of only
+  generating one — supports bring-your-own-key deployments.
+- TeeLogger wired through the agent loop, migration executors, and validator: structured
+  dual-output logging (local + server event stream) on previously local-only paths.
+- CI cross-compilation matrix: linux-arm64, windows-amd64, darwin-arm64. Helper skipped
+  on Windows (Unix-only APIs), darwin via cargo-zigbuild, aarch64 linker pinned through
+  `helper/.cargo/config.toml`.
+
+### Fixed
+- `rpmEVRAhead` returned true for equal versions when only an explicit epoch-0 prefix
+  differed (`0:2.0-1` vs `2.0-1`) — packages already at target were perpetually flagged
+  upgradeable on every DNF check.
+- Desktop self-update burned its replay token before install, so a transient failure
+  (disk full, backup error) permanently blocked further desktop updates. Replay check
+  now runs before install; the token is recorded as consumed only after success.
+- Orchestrator constructor could carry a nil logger on the Windows service scan path;
+  it now defaults to a log-only TeeLogger.
+- `/proc/stat` field index bug and ProcessCaps data-collection limits; process scan
+  dedup; NaN guards and safe parsing in the process explorer UI.
+- Security event insert path corrected; `GetAgentByID` signature mismatch.
+
+---
+
 ## v0.2.7.1 (June 2026)
 
 ### Added

README.md

@@ -2,7 +2,7 @@
 
 **Self-hosted update management for operators who own their stack.**
 
-`v0.2.6.8` — June 2026 · MIT License
+`v0.2.8.0` — June 2026 · MIT License
 
 > **You're early — over 1,000 of you cloned this before it was announced.**
 > A stable release is coming soon, bringing Windows support back fully gated.
@@ -162,6 +162,9 @@ Before a package is installed: the agent fetches the expected SHA-256 from the s
 - Metadata pipeline: CVE details, upstream intelligence, package provenance
 - Auto-discovery bridge (Repology, container registry, exact match)
 - Agent self-update via privileged helper (zero agent sudo)
+- Binary self-update (agent, helper, desktop) through the same signed, hash-pinned capability-token gate as package installs
+- Process explorer: on-demand /proc scanning (sockets, capabilities, namespaces) with inode correlation
+- Setup accepts an operator-supplied signing keypair — bring-your-own-key deployments
 - Reversible token encryption with one-liner restore
 - Real-time heartbeat and rapid polling
 
@@ -251,6 +254,10 @@ I am a Systems Architect with 25 years on the frontier. I build sovereign agent
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history. Recent highlights:
 
+**v0.2.8.0** — Process explorer, self-update capability tokens, BYO signing keypair at setup, cross-compile CI matrix (linux-arm64, windows-amd64, darwin-arm64).
+
+**v0.2.7.1** — CI/CD pipeline on Gitea Actions with release gate and guided release script. Screenshot capability survives self-upgrade.
+
 **v0.2.6.8** — Dark/light tray app theme, desktop tray spine, prototype Tauri desktop app.
 
 **v0.2.6.5** — Windows agent service logs now write to `C:\ProgramData\RedFlag\logs\agent.log`.

docker-compose.yml

@@ -21,7 +21,7 @@ services:
       context: .
       dockerfile: ./server/Dockerfile
       args:
-        BUILD_VERSION: ${BUILD_VERSION:-0.2.7.1}
+        BUILD_VERSION: ${BUILD_VERSION:-0.2.8.0}
     container_name: redflag-server
     volumes:
       - server-config:/app/config

helper/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "redflag-helper"
-version = "0.2.7"
+version = "0.2.8"
 edition = "2021"
 publish = false
 

server/internal/version/versions.go

@@ -15,8 +15,8 @@ import (
 // tag — the release gate enforces this. ldflags may override at build time;
 // the release pipeline injects the tag so binaries and source agree.
 var (
-	AgentVersion    = "0.2.7.1"
-	ConfigVersion   = "0.2.7.1"
+	AgentVersion    = "0.2.8.0"
+	ConfigVersion   = "0.2.8.0"
 	MinAgentVersion = "0.1.22"
 )