Changelog

1.2.0 - 2026-08-31

• Added a ConfigManager-style F3 administrator panel with signed mod lists, administrators, bans, admission policy, runtime integrity, and graduated enforcement controls.
• Added server-side backend-account authorization on every panel read and mutation; ordinary players receive no policy document and cannot invoke reports, maps, backups, or signing.
• Added one-time server-console bootstrap and a server-managed RSA-3072 key kept under the non-package server-private directory; the key is never returned to the client panel.
• Added panel actions for bounded support reports, administrator-only production/portal maps, and immediate verified Runic Safety world backups.
• Made the high/very-high escalation counts and rolling enforcement window effective server settings.
• Preserved Runic Sentinel as a standalone plugin: no Runic Core or Runic Persistence package, project, manifest, or assembly dependency. The F3 channel uses Valheim's routed networking and exact current Steam/PlayFab peer identity.

1.1.0 - 2026-08-31

• Kept the first-run Optional/monitor-only workflow usable when no signed passport exists yet; transition backup enforcement now fails closed only when Raven's Gate admission is Required.
• Added explicit player explanations for expired passports and protected transition-backup failures.
• Added a crash-surviving bounded security flight recorder with one 512 KiB current file and one 512 KiB previous file; recorder I/O is isolated from request blocking and gameplay.
• Hardened the standalone routed profile comparison and Required-mode disconnection behavior.
• Added signed v3 plugin lists, administrators, and banned identities.
• Added runtime integrity monitoring, automatic request enforcement, support reports, clear denial UI, offline Forge tooling, current-profile export, and verified transition backups.
• Added an authoritative-server-only, on-demand bounded portal and production topology snapshot.

1.0.0 - 2026-08-22

• Added a private bounded standalone compatibility exchange with explicit Disabled, Optional-default, and Required outcomes. Required enforces the server's verified signed policy digest/sequence/profile; all client snapshot/hash/disposition values remain explicitly self-reported compatibility evidence.

• Added timestamp freshness, bounded current-peer validation, and replay/equivocation/rollback detection without a remote-administration claim.

• Replaced the forgeable same-process HMAC design with strict RSA-3072/SHA-256 PKCS#1 v1.5 verification of exact RUNIC-SENTINEL/2 bytes. Sentinel loads only a public key whose exact canonical-file SHA-256 is pinned in configuration.

• Added strict public-key and signature-file canonicalization, policy sequence/issue/expiry fields, and in-process rollback/equivocation rejection.

• Kept attestation, admission, and evidence contracts private to Runic Sentinel and corrected the canonical capability from security.attestation to security.attest.

• Renamed the public nonce digest to an unauthenticated nonce binding and explicitly reports that it is neither client-authenticity proof nor an authoritative transport.

• Added exact local-lease evidence-provider registration, per-provider fair queues, immutable reads, requested/effective action, policy sequence, and saturating accepted/drop counters.

• Made worker publication generation-safe, cancellation-gated, platform-path-correct, and deduplicated so multiple plugin descriptors sharing one path hash that file only once.

• Made Enabled = false startup-inert: no worker, network handler, or service is created.

0.1.0

• Hardened plugin and signed-policy input reads against size-check/read races: hashing consumes the exact admitted length through one reusable bounded buffer, and policy/signature/key streams must remain byte-exact and metadata-stable through EOF before verification.

• Added bounded signed-policy parsing and HMAC-SHA256 verification with fail-closed monitor-only fallback.

• Added deterministic loaded-plugin attestation, fresh-nonce response, admission policy, and a 256-entry evidence ledger.

• Published security.attestation, security.admission, and security.evidence protocol 1.0 services.

• Deliberately deferred connection enforcement until an authenticated server/client transport exists.