| Age | Commit message (Expand) | Author |
|---|
| 6 days | docs(follow-forks): add process-tree-following plan + filter.c reference | Paul Buetow |
| 7 days | feat(parquet): export rename/link oldname + assert oldname capture end-to-end | Paul Buetow |
| 7 days | feat(parquet): surface epoll_ctl op/target-fd/events metadata | Paul Buetow |
| 10 days | fix(classify): assign vmsplice to FamilyNetwork, not Misc | Paul Buetow |
| 12 days | fix(classify): capture timerfd_gettime/settime + splice/tee fd, not KindNull | Paul Buetow |
| 13 days | fix(classify): assign file_setattr to FamilyFS, not Misc | Paul Buetow |
| 13 days | fix(classify): assign file_getattr to FamilyFS, not Misc | Paul Buetow |
| 14 days | fix(classify): assign fanotify_mark to FamilyIPC, not Misc | Paul Buetow |
| 2026-06-02 | fix(close): deregister fd only on successful close (ret==0) | Paul Buetow |
| 2026-06-02 | fix(classify): assign fanotify_init to FamilyIPC, not Misc | Paul Buetow |
| 2026-06-01 | fix(classify): mq_timedsend returns status, not bytes — make ret UNCLASSIFIED | Paul Buetow |
| 2026-06-01 | fix(classify): msgsnd returns status, not bytes — make ret UNCLASSIFIED | Paul Buetow |
| 2026-06-01 | fix(classify): assign alarm to FamilyTime, not Misc | Paul Buetow |
| 2026-06-01 | test(internal): make comm-propagation/filter tests hermetic | Paul Buetow |
| 2026-06-01 | fix(types): fast-decode hot events at padded kernel struct size | Paul Buetow |
| 2026-06-01 | test(generate): remove redundant pure-classification unit tests | Paul Buetow |
| 2026-05-31 | fix(classify): assign adjtimex to FamilyTime, not Misc | Paul Buetow |
| 2026-05-31 | listxattrat: READ-classify return for xattr-list family consistency | Paul Buetow |
| 2026-05-31 | getxattrat: READ-classify return for xattr-get family consistency | Paul Buetow |
| 2026-05-30 | test(generate): lock in semctl handler as KindSysVOp/FamilyIPC | Paul Buetow |
| 2026-05-30 | generate: treat rt_sigreturn as noreturn (suppress dead exit handler) | Paul Buetow |
| 2026-05-30 | test(generate): lock in pwritev WRITE byte-count classification | Paul Buetow |
| 2026-05-30 | test(pipe): lock in pipe/pipe2 IPC classification and fd-pair exit reads | Paul Buetow |
| 2026-05-30 | test(perf_event_open): lock in audit findings | Paul Buetow |
| 2026-05-30 | test(generate): lock in msgctl SysV-op classification | Paul Buetow |
| 2026-05-30 | test(mlockall): lock in KindNull/FamilyMemory classification | Paul Buetow |
| 2026-05-30 | test(dup): lock in fd_event handler captures oldfd (args[0]) | Paul Buetow |
| 2026-05-30 | test(arch_prctl): lock in KindNull/UNCLASSIFIED + FamilyProcess | Paul Buetow |
| 2026-05-30 | test(generate): lock in listen(2) handler classification | Paul Buetow |
| 2026-05-30 | test(kexec_file_load): lock in KindFd/Security/UNCLASSIFIED audit | Paul Buetow |
| 2026-05-30 | test(socketpair): lock in domain-is-not-an-fd invariant (c00) | Paul Buetow |
| 2026-05-30 | test(setsockopt): lock in KindFd enter, UNCLASSIFIED exit, Network family | Paul Buetow |
| 2026-05-30 | test(rmdir): lock in FS family, args[0] pathname capture, UNCLASSIFIED exit | Paul Buetow |
| 2026-05-30 | test(request_key): lock in keyctl kind, security family, and unclassified return | Paul Buetow |
| 2026-05-30 | test(generate): lock in pwrite64 WRITE_CLASSIFIED audit | Paul Buetow |
| 2026-05-30 | test(generate): lock in lseek classification (offset, not byte count) | Paul Buetow |
| 2026-05-30 | kexec_load: classify into Security family with its sibling | Paul Buetow |
| 2026-05-30 | test(generate): lock in io_uring_register classification audit | Paul Buetow |
| 2026-05-30 | test(getsockname): lock in KindFd/FamilyNetwork/UNCLASSIFIED classification | Paul Buetow |
| 2026-05-30 | test(getcwd): lock in KindNull enter + exit-time cwd resolution | Paul Buetow |
| 2026-05-30 | test(kill): lock in KindNull enter and UNCLASSIFIED ret | Paul Buetow |
| 2026-05-30 | test(iopl): lock in KindNull enter and UNCLASSIFIED ret classification | Paul Buetow |
| 2026-05-30 | test(gettid): lock in KindNull/FamilyProcess/UNCLASSIFIED classification | Paul Buetow |
| 2026-05-30 | test(generate): lock in getgid null enter and UNCLASSIFIED ret | Paul Buetow |
| 2026-05-30 | test(finit_module): lock in family and ret classification | Paul Buetow |
| 2026-05-30 | test(generate): lock in bind syscall classification | Paul Buetow |
| 2026-05-30 | test(signalfd4): lock in args[3] flags index for eventfd handler | Paul Buetow |
| 2026-05-30 | test(select): lock in nfds/timeval capture and UNCLASSIFIED exit | Paul Buetow |
| 2026-05-30 | sendfile64: capture out_fd instead of dropping both fds | Paul Buetow |
| 2026-05-30 | test(generate): lock in sched_setparam pid-not-fd classification | Paul Buetow |
