Three stale surfaces refreshed after the v0.7.1 cut + arm64 release:
README.md — Status section was 'v0.6.0 cut 2026-05-23'; updated to
v0.7.1 with the new prebuilt-binary inventory (4 artifacts: x86_64 +
arm64, each dynamic + static-musl) and the CI hardening additions
(ASan/UBSan + clang-tidy).
docs/index.html — hero eyebrow chip and footer meta both showed v0.6.0;
both bumped to v0.7.1.
ROADMAP.md — entire v0.7.x phase added as 'Phase 9 — Empirical
verification + operator briefing (DONE 2026-05-23, v0.7.1)'. Captures
everything since Phase 7+/8 (which were the v0.5–v0.6 era): the VM
verifier, mainline kernel fetch, 22 of 26 CVEs verified, --explain
mode, OPSEC notes, CVE metadata pipeline (CISA KEV + NVD CWE), 119
detection rules, 88-test harness, arm64-static binary, arch_support
field, marketing site. Plus an explicit 'open follow-ups' list (arm64
verification sweep, SIEM query templates, install.sh smoke test,
PackageKit provisioner, custom <=4.4 kernel image for dirty_cow, 9
deferred drift findings) and the 'wait-for-upstream blockers' list
(vmwgfx, dirtydecrypt, fragnesia).
leviathan
4af82b82d9
