Release Notes: September 2026 Release

Release Date: September 17, 2026 Target Audience: Enterprise Administrators, SREs, and CISOs

This release covers all changes shipped between the StateWarden 1.2.0 agent release (July 13, 2026) and September 17, 2026. The headline capability is Ransomware Protection (Active Defense): agents now detect ransomware-class write patterns during backups and execute a configurable response policy autonomously, up to and including network lockdown of the affected host. The release also adds the Audit Pack evidence report for NIS2/KSC/BSIG audits, a Realm Overview cockpit page, key-epoch propagation across the backup chain, strict backup failure reporting, and a set of fleet-wide Vigil scan fixes.

Availability notes for staged rollouts are listed at the end of this document; not every component version is generally available at the time of writing.

Ransomware Protection (Active Defense)

Autonomous Ransomware Response (Agent 1.5.0, September 8)

Entropy-based detection at the backup pipeline: Changed chunks are analyzed for high-entropy write patterns during the backup run. Detection thresholds are configurable: minimum changed chunks (default 50, roughly 50 MB), entropy ceiling (default 7.8 on the 0–8 scale), and changed-data ratio (default 0.90 - 90% of changed data must match the pattern).
Response executor: On detection the agent executes the configured policy immediately, without waiting for control-plane input. Agent 1.5.0 implements two actions: Quarantine Backup (the backup completes but is flagged) and Alert Only (the backup is aborted and reported as failed with a corresponding reason).
Audit trail: Every detection is recorded in the audit log with the configured action and its execution result. Backups completed under quarantine are flagged as possibly infected and marked accordingly in the Dashboard, including a warning in the restore dialog.
The Dashboard gates response-policy management by agent version.

Network Lockdown and Power Off (Agent 1.6.0, September 9)

Network Lockdown: A default-deny network policy applied at the host. The lockdown preserves only the Artemis control channel and the active Driad storage target, plus DNS (udp/53) and NTP (udp/123) - this keeps the management channel alive, which is what makes the lockdown remotely reversible. On Linux the agent uses nftables (dedicated inet statewarden_lockdown table) with an iptables fallback; existing user rules are never flushed. On Windows it sets the firewall profile policy to block inbound/outbound and adds deterministic allow rules. The lockdown state is persisted on disk and reapplied at startup, so it survives a hard reset.
Power Off: Initiates a delayed (20 s) system poweroff. The delay guarantees that audit events and the final task report are flushed before the machine goes down.
Reversal: A locked-down host can be restored to normal networking from the Dashboard. The action is protected by an MFA challenge and is recorded in the audit log.
These two actions require agent 1.6.0 or newer. Older agents (1.5.0) that receive a lockdown or power-off policy degrade safely to Alert Only and record the degradation in the audit log.

Response Policy Management (WebAPI 0.7.0 / 0.8.0, September 9)

Realm defaults and per-device overrides: Response policies are managed per Realm with per-device overrides. All policy changes require MFA confirmation and are recorded in the realm audit log.
Effective-policy push: The effective policy (device override, else realm default, else built-in defaults) is computed server-side and pushed to agents automatically. Agents never resolve inheritance themselves. Virtual machines are covered by the policy of their parent hypervisor's agent - one agent enforces one policy.
Built-in default: Realms with no saved policy are still protected: the built-in default raises an alert and quarantines the backup, using the standard thresholds. Clearing a policy returns to this default rather than disabling protection.

Dashboard: Ransomware Protection Page

A new Ransomware Protection page (/active-defense) manages the realm default: response-action selection (Quarantine Backup / Alert Only / Network Lockdown / Power Off), entropy thresholds with in-line examples, and detection methods.
A per-device override tab in the device details dialog shows each field with an INHERITED or CUSTOM badge and one-click reset to inheritance.
Network Lockdown and Power Off are selectable only for devices running agent 1.6.0 or newer; devices on older agents are labeled accordingly and degrade to Alert Only.
Devices under an active lockdown show a NETWORK LOCKDOWN badge with a Restore Network action. Infected backups show a POSSIBLY INFECTED chip in backup lists and a warning banner in the restore flow.

Backup Reliability and Key Management

Key-Epoch Propagation (Agent 1.3.0, September 3)

Key rotation previously left gaps that could produce silently unrestorable backups (mixed old/new-key manifests) or report backups written with a revoked key as completed. Key epochs now propagate end-to-end:

Stale-key pre-flight block: When the server's key epoch is newer than the agent's, the backup is aborted before any data is written, with an explicit failure reason, instead of producing an invalid backup.
CBT epoch validation: Incremental tracking state tied to a previous key epoch is discarded and re-baselined on both Linux and Windows; the next backup after a rotation is automatically a full baseline.
Forced full backups: A full baseline is forced automatically whenever the chain requires it - on manual trigger, on an empty backup chain, or on a key-epoch change. Every backup records the key epoch it was written under.
Dashboard: Backups written under a previous key epoch show a STALE KEY state, and Backup Now offers a "force full backup" path.

Backup Failure Resilience (Agent 1.4.0, September 6)

Honest failure reporting: Scheduled backups and all Proxmox code paths now report Failed instead of silently dropping errors; a VM backup no longer reports Completed when the manifest upload failed.
Hung-task detection: Artemis detects backups that show no progress for 30 minutes. Agents that stopped mid-backup are detected via an on-disk in-flight journal and via a final status report sent on clean shutdown.
Consequences are visible: Failed backups receive a structured failure reason, are purged from storage (backup artifacts only - chunks shared with healthy backups are never touched), appear in the UI with a localized reason, and trigger an email notification to realm members.
Progress reporting: Backup progress is now reported as a real percentage in addition to byte counters.

Security UX Improvements (Dashboard 0.6.0 / WebAPI 0.9.0, September 14)

PRIORITY DEVICES panel on the Threat Landscape page ranks the fleet by critical findings, active findings, and risk score, with deep links into triage.
Vulnerability triage: per-device filter with counts, group-by-device view, deep links (?device=<uuid>), clickable rows with a finding-details dialog, and bulk triage decisions for up to 500 findings at once.
Exports and reports: CSV export honoring active filters, and per-device or per-realm PDF reports generated on demand, including an optional ruled notes section for paper workflows.
Finding responses now include the device name/hostname, and history search matches device names.
NO DATA badge: Devices that have never been scanned (e.g. agentless VMs) no longer show a green "Secure" badge - they show a neutral NO DATA state until the first scan completes.

Vigil Scan Fixes (Agent 1.6.2, September 14)

Three independent cross-platform bugs had stacked and silently disabled scheduled security scanning on much of the fleet:

Filesystem scans broken fleet-wide since April: A defect in the scan report upload caused every malware scan report to be rejected as unauthorized. Fixed; the first successful fleet-wide filesystem scan since 2026-04-24 was recorded the same night.
Missing default scan schedule: Agents that had never received a configuration push had no security schedule at all. The scheduler now falls back to built-in defaults (inventory every 1440 min, malware scan every 720 min) and self-heals on the next run - affected devices recover without manual intervention as they update.
Zero-file scheduled scans: The manual scan trigger could leak into scheduled scan paths, producing zero-file scans. This is now prevented agent-side.
Failure visibility: Scan failures are now recorded as audit events (Artemis 0.6.1) visible in device logs and notifications, and scan completion times are recorded correctly.

Audit Pack (WebAPI 0.10.0 / Dashboard 0.7.0, September 14)

Audit Evidence Reports

Audit evidence dataset: The Audit Pack produces a structured audit-evidence dataset for a selectable period (default 90 days, maximum 400) and jurisdiction profile. Access requires the realm.view_audit_logs permission; every report generation is itself audit-logged.
The new /audit-pack Dashboard page renders an on-demand PDF for NIS2 audits with jurisdiction profiles for the EU baseline, Poland (KSC), Germany (BSIG/NIS2UmsuCG), and France (ReCyF - clearly marked as pending promulgation).
The report backbone is a requirements coverage matrix mapping each legal requirement to its evidence (covered / partially covered / not covered), plus evidence annexes (members, sessions, authentication events, change audit, backup posture, restore history, security posture, infrastructure, versions).
Organizational requirements that software cannot evidence (training, risk policy, supply chain, HR, physical security) are covered by a customer attestation checklist printed as CUSTOMER DECLARATIONS.

Expanded Audit Logging

A new account audit log records authentication, MFA, session, registration, and account-settings events with IP address and user agent.
Realm-log coverage was extended across IAM membership changes, backup-policy changes, pairing-code lifecycle, suppression rules, and vulnerability triage decisions.
Artemis 0.7.0 adds audit events for the full pairing lifecycle: device pairing, recovery pairing, and rejected pairing attempts.

Agent 1.7.0: Verified Updates and Restore/Update Audit Events

OTA update verification (dual mode): The updater verifies the SHA256 hash of update payloads. A well-formed hash is enforced fail-closed (mismatch = update rejected); payloads without a well-formed hash use the legacy path, escalate the update-started event to WARNING, and mark all update events as not hash-verified. TLS against the distribution server is now strict (publicly trusted certificate required). Hash enforcement becomes mandatory in a future release once the fleet runs the new updater.
New audit events: agent startup, update lifecycle, backup start, and bare-metal restore outcomes are now recorded.
Truthful restore outcomes: Proxmox restores that partially fail are now reported as failed instead of completed, and no longer auto-start the VM after a partial failure. Successful restores report chunk and byte counts.

Realm Overview (WebAPI 0.11.0 / Dashboard 0.8.0, September 16)

A new /overview cockpit answers "what is happening in my realm right now" from a single server-computed overview.
KPI tiles: fleet status (online/offline, 7-day protection coverage), backups in the last 24 h (including transferred bytes), security posture, the effective Active Defense action protecting the realm (with a DEFAULT/CUSTOM indicator), storage quota with threshold coloring, deduplication ratio with a three-stage breakdown (restore size → deduplicated data size → backups + metadata physically stored), and backup reliability (30-day success rate, restore-point count, oldest restore point).
Charts: 30-day backup activity (per-day segmented columns, completed vs. failed) and a protected-data-flow chart (logical vs. transferred bytes per day).
Attention Required: a server-computed list of failed backups, possibly-infected backups, critical findings, offline devices, and devices without a backup policy, each with a deep link to the relevant page. A recent-activity feed rounds out the page.
Per-section permissions: each section is gated by the same permission that guards its dedicated page; sections the user may not see are omitted entirely rather than shown grayed out. The page refreshes every 30 seconds.

Platform and Agent Maintenance

Agent 1.2.2: Log rotation - daily rolling logs with automatic cleanup of files older than 7 days on Linux and Windows.
Agent 1.2.3: iSCSI unmount fix.
Agent 1.2.7: Cascade-crypto integration.
Agent 1.2.11: Windows CBT (USN journal) incremental backup fixes.
Agents 1.3.1–1.3.4: iSCSI Instant Mount fixes on Windows - randomized MBR disk signatures to eliminate signature collisions between mounted backup disks, and a fix for the Partmgr persisted OFFLINE attribute that poisoned the reused PnP disk instance and forced every mount after the first unmount to come up offline.
Agent 1.6.1: QMP read-buffer fix - Proxmox VM backups failed on VMs whose QMP responses exceeded the agent's 4 KiB line buffer (hardware-configuration dependent, e.g. multi-disk VMs).
WebAPI 0.8.1: Pairing codes are now generated uppercase-only (A-Z0-9) with case-insensitive entry, revoke, and pairing; restore-size reporting fixed (historical completed backups display correct restore sizes without any data migration).
Windows MSI installer: Fixed a failure on fresh Windows 10 installations. The MSI previously packaged an MSVC-built binary requiring the VC++ Redistributable; it now ships the same GNU-toolchain build as every other Windows artifact, and CI rejects any Windows binary that imports VCRUNTIME140/MSVCP140.

Availability

Agents 1.3.x–1.6.2 are generally available and have been rolling out to the fleet via OTA.
Agent 1.7.0 (OTA hash verification, new audit events, truthful restore outcomes) is available on the test channel only as of September 17; fleet-wide rollout follows test-channel validation.
Realm Overview (WebAPI 0.11.0 / Dashboard 0.8.0) is rolling out progressively, WebAPI before Dashboard. Until the rollout completes, the Overview page may be unavailable or show partial data.

Component Versions

Core Agent (sw): 1.7.0 (test channel; general fleet remains on 1.6.2)
WebAPI: 0.11.0
Dashboard: 0.8.0
Artemis: 0.7.0
Vigil: 1.4.0
Driad: 0.7.0
Hermes: 0.2.0