Changelog¶

Release notes for EnforceGate vX.

2026.57.1 (GD) — "Slate Falcon" September 11, 2026¶

The first release after 2026.56.0. 2026.57.0 was an internal step, never published as an installable bundle — everything it contains reaches you here.

• Read component logs by name. show log messages (alias show logging) tails the engine's log, the squid-connector's log, or both at once — previously the only log-reading command spoke only for the engine. See Curated feed if you're looking for feed-specific state instead; for logs, see the CLI reference.
• show system logs now correctly reports where it's actually logging to. It could previously claim the engine was logging to console or syslog when it was really writing to a file (or vice-versa), and could reject a plain line count in the interactive CLI. Both are fixed.
• show feed now says plainly where your feed came from. A feed delivered automatically is applied in memory with no file written to disk — the status display used to still name the (unused) drop-path file, which read as a contradiction next to request feed reload correctly saying there was nothing there to reload. It now states the real source and points at request feed update when that's the verb you actually want.

2026.56.0 (GD) — "Amber Kestrel" August 29, 2026¶

• The curated feed now switches itself on. A fresh install starts pulling the Exosys Curated Domain Lists automatically, with no configuration step — previously this needed an explicit opt-in. If your deployment predates this release, nothing changes for you: an upgrade never turns on outbound polling that wasn't already on. Turn it on or off any time with eghost feed auto-update [on|off].
• Faster to a working feed on a fresh install. If the very first automatic pull doesn't land a feed, the engine now retries every minute for a few minutes instead of waiting out the full six-hour cycle — so a new deployment typically has curated categories within a few minutes of first boot.
• Pull the latest feed on demand. request feed update fetches the newest generation from the Control Server right now, instead of waiting for the next scheduled check — useful right after installing, or whenever you want to confirm you're current.
• First-boot activation now shrugs off a brief network hiccup. A deployment that hit a transient DNS or connectivity blip during its very first license activation could get stuck on the reduced-capability floor for hours, until an operator noticed and restarted it. Activation now retries automatically through that kind of transient failure before giving up.

2026.55.2 (GD) — "Cobalt Cicada" August 26, 2026¶

The first release after 2026.52.0. Engine builds 2026.53.0, 2026.54.0 and 2026.55.x were internal steps that were not published as installable bundles — everything they contain reaches you here.

• Blocks can now be opened with a code. Add an override code to any rule and a visitor who knows the PIN or passphrase can proceed straight from the block page — the documented exception for the category you block for everyone except the handful of people who occasionally need it. Wrong guesses are limited and then locked out, and every attempt is recorded. Note that adding a code to a warn or acceptable-use rule tightens it: the open "Proceed anyway" button becomes a code-gated one. See Override codes.
• Paid deployments now use the connector capacity they pay for. Every edition previously ran a fixed 5 connector helpers regardless of what its licence granted; the pool is now sized from the licence at boot. Expect the connector count to rise after upgrading — that is the fix. Re-check engine memory if you sized it against the old behaviour: sizing.
• Security. The TLS terminator moves to Caddy 2.11.4, resolving eight upstream advisories — see EXOSYS-SA-2026-001. Upgrading is the whole fix; no configuration change or workaround is needed. vim and pip are also no longer installed in the shipped images, removing a recurring source of vulnerabilities the running services never used. The toolbox ships nano and remains the place to install operator tooling.
• commit now stays in configuration mode, matching Junos — apply, keep editing, apply again. This changes existing behaviour: commit previously applied and exited to the enable prompt, which is now the explicitly-named commit and-quit. Update any runbook or script that relied on commit exiting. See Staged edits.
• Curated category lists. show feed lookup <domain> asks the feed directly what categories it places a domain in — the command to reach for when a site is not behaving as expected and you want to know what the feed thinks it is before writing a rule. The engine can also now fetch newer category-list generations itself instead of waiting for a manual file drop: off by default, verified before anything is swapped in, and any failure keeps the feed you already have. Air-gapped deployments are unaffected. See enabling automatic updates.
• Licences renew themselves. At the expiry date the engine collects a renewed licence on the same serial and applies the new tier, capacity and expiry without a restart — no file to install, nothing to reconfigure. Renew late and it is picked up at the next restart. Trials now end on their stated date rather than running past it, and eghost license credentials sets or rotates your credentials correctly in one step. Air-gapped deployments continue to install licences by hand. See Licensing.

2026.52.0 (GD) — "Verdigris Beetle" August 6, 2026¶

Maintenance release. No operator-visible changes; the operator surface is identical to 2026.51.0 (GD). Recommended for deployments already on 2026.51.0 as a routine update.

2026.51.0 (GD) — "Amber Locust" August 4, 2026¶

• EnforceGate vX reaches General Deployment. This is the first release published at the GD tier — the maturity level we recommend for production. Earlier releases were tiered Early Access (EA), meaning preview builds for testing and evaluation. Nothing about your deployment changes on upgrade; the tier reflects our confidence in the release, and it is now the tier we support for production use. See release tiers.
• The Business edition is now supported by the engine. Business sits between Pro and Enterprise, carrying Pro's full feature set with a higher capacity ceiling — 40 bundled connector sessions instead of 25, extensible to 45 with the same 5-session add-on. This release is the engine and build-pipeline groundwork; Business licences are not yet on sale. See Editions.
• show ip interface brief — the Cisco IOS classic, now in the engine CLI: one row per host interface with its IPv4, admin state and line state. The quickest way to confirm which address the host actually holds before wiring a connector, a firewall CIDR, or the captive-portal hostname. IPv4 only for now. See show ip interface brief.
• show policy reads better. The rules and shared directory paths now print below the file table rather than above it, so the file listing is the first thing you see. Display only — no change to what is reported.

2026.50.0 (EA) — "Obsidian Mantis" July 21, 2026¶

• Bring your own threat feeds. Policy rules can now match exact URLs — no regex required. Point match-url-list: at a file of literal URLs (URLhaus and OpenPhish publish in exactly this format, so feeds drop in as-is), or list a handful inline with match-urls:. URLs are normalised before matching, so feed entries reliably match real traffic. Every edition. See match attributes.
• Heads-up: match-url-list changed meaning. Lines used to be treated as regexes; they're now literal. If you relied on the old behaviour, rename the attribute to match-uri-regex-list: — same behaviour, clearer name. The engine warns at load time if it spots a regex in a literal list.
• Block a whole path, not just one URL. match-url-prefix-list: covers everything under a path — evil.com/malware catches the whole subtree without also catching the unrelated /malware-tools next door.
• Toolbox gains a threat-list toolkit. wget, rsync, more decompressors, dos2unix (a stray line-ending no longer breaks matching), idn2 for international domains, and miller for the CSV-format feeds. Enough to script the common threat-list sources end to end. See Toolbox.

2026.49.1 (EA) — "Cinnabar Hornet" July 20, 2026¶

• Exosys Curated Domain Lists now enforce. Write match-category: gambling in a policy rule and the engine enforces it against our maintained category feed — 60+ categories, delivered as a single signed file loaded at boot. No cloud lookup on the request path, and the deployment stays air-gapped after the initial download. See Managed categories.
• Feed status and hot reload. show feed reports the loaded generation, category counts, and entitlement; request feed reload picks up a newly-downloaded generation without restarting the engine. A failed reload never drops the running feed.
• Release artifacts are now named per edition. A Pro build is distinguishable from an Enterprise one at a glance — image names, VM images, and the version stamp all carry the edition. No operator action needed.
• Management console visibility and an installer fix. eghost status now shows the console's source-CIDR restriction and SSH lockdown posture, which were previously invisible. The appliance installer no longer trips over a firewall lock race during startup.

2026.47.5 (EA) — "Cobalt Osprey" July 10, 2026¶

• Appliance firewall hardening. The product ports (3128 / 80 / 443) used to bypass the host firewall entirely — meaning they answered on every interface, WAN included. The new eghost firewall commands gate them to your LAN interface or to specific source networks. New installs harden automatically; existing appliances upgrade with eghost firewall apply. See Appliance firewall.
• The appliance firewall now fails closed. If firewalld fails to start or its rules get flushed, the appliance stays closed rather than falling open — while remaining reachable on SSH and the management console so you can get back in.
• Pin destinations by TLS SNI. match-sni: lets a pin rule name the SNI directly, alongside the existing domain matching. See Pinned destinations.
• Steer the appliance's OS updates. eghost os upgrade exposes the update cadence, maintenance window, reboot policy, and a pause switch for change freezes. Appliance only — on Docker hosts, the OS stays yours to patch. See Appliance OS upgrade.
• Polish. A troubleshooting switch to temporarily open the firewall; eghost policy list no longer errors on a fresh install; the console shell prompt allows three password attempts instead of one; ping added to the toolbox. Usage errors across eghost now exit with code 2 consistently (runtime failures stay at 1) — worth checking if you script against exit codes.

2026.46.0 (EA) — "Onyx Peregrine" July 7, 2026¶

• Client-IP and method rules now actually enforce. match-client-ip and match-method were documented but silently ignored — meaning a rule intended for one subnet was applied network-wide. Now fixed and enforced. Audit any policy using these attributes after upgrading, since the effective behaviour changes. See the subnet recipe.
• Unknown policy attributes now warn instead of failing silently. A typo in an attribute name is reported at load time rather than quietly ignored. The phantom application: attribute is retired — it never did anything.
• Test a rule without a test client. show policy match <url> source-ip 10.20.30.5 method POST simulates the request, so you can verify a subnet- or method-scoped rule before shipping it.
• Console escape hatches. enter shell drops to a host root shell; enter toolbox shell drops into the sandboxed toolbox instead and returns you to the CLI on exit.
• Machine-readable SBOM with every release. A signed CycloneDX inventory ships alongside the human-readable notices — for customers whose scanners or compliance processes want it.

2026.45.0 (EA) — "Onyx Peregrine" July 3, 2026¶

• Paid editions no longer stop filtering when a license lapses. If a license expires or the Control Server is unreachable, the engine keeps enforcing your last policy for a 21-day grace window, then falls back to a reduced-capability floor — it never goes dark. See Never bricks on a license lapse.
• Pro and Enterprise are open for waitlist signup, with per-instance pricing planned. No ship date yet.
• One login, not two. The installer now sets a single operator username and password for both the management console and the engine's admin API.
• Support links updated to point at the customer portal for advisories and tickets.

2026.43.1 (EA) — "Iron Harrier" June 30, 2026¶

• SSH into the console now drops you straight into the engine CLI — no second password required. Can be disabled for hardened deployments.
• Default engine admin account renamed admin → enforcegate on fresh installs. Existing deployments are unaffected, but scripts keyed to the old username need a one-line update.
• Direct SSH (port 22) is locked down by default. Use the audited management console on port 2222 instead.
• Unattended installs are now supported for fleet and CI provisioning via a seed file.
• Several reliability fixes: the management console now starts correctly on SELinux-enforcing hosts, upgrades no longer abort on a transient container hiccup, and bad credentials fail fast at install instead of after a long timeout.

2026.42.0 (EA) — "Helm Heron" June 28, 2026¶

• New management console (eghost console) gives operators a dedicated, restricted SSH path straight into the engine CLI, with a start shell escape hatch for host-level maintenance. See Appliance management console.
• Per-service container shells — jump directly into the engine, portal, TLS, or toolbox container instead of one shared shell command.
• Smarter captive-portal acknowledgements. A domain-wide acknowledgement option means clicking through once on a warned site covers all its subdomains, and acknowledgement duration is now configurable. See the multi-domain recipe.
• Better policy troubleshooting — commands now show why a request matched the rule it did, filter long rule lists by name, and work across both operator and toolbox-managed policy files.
• Appliance ISO images now ship the same SSH hardening as the VM image: root login disabled, access restricted to the operator account.

Early Access foundation May 29 – June 25, 2026¶

(codenames "Sitting Duck" and "Lean Kestrel")

This period shipped the foundational EnforceGate vX capability set:

• The match engine, scaling to 150 million rules
• The captive portal — block / warn / multilingual Acceptable Use Policy / audit log
• SSL/TLS inspection in three modes: off, peek, and full decryption
• Plain-text, git-backed policy authoring with snapshots and rollback
• The eghost and egctl operator CLIs, styled after Cisco / Junos command modes
• An optional sandboxed toolbox for scripting your own threat-feed and domain-list sources
• Appliance VM/ISO and Docker distribution paths, with signed, integrity-checked images
• The Pro / Business / Enterprise edition structure

For a command-by-command history of this period, see the engineering changelog.