1.7.0 (2026-04-25)
Features
- 08-01: implement HTTP L7 extraction primitives (70a3e97)
- 08-02: wire HTTP L7 codegen into BuildPolicy (HTTP-01, HTTP-04) (d3724cb)
- 08-03: pipeline L7 codegen + VIS-01 warning + evidence L7Ref (92eded4)
- cli: plumb --l7 + --no-l7-preflight (no-op codegen, Phase 8 lights up) (3d7bee9)
- evidence: bump schema v1 to v2 with optional L7Ref (EVID2-01) (2389793)
- explain: --http-method, --http-path, --dns-pattern filters (L7CLI-02) (546af15)
- explain: render L7 attribution in text/JSON/YAML (L7CLI-03) (595b584)
- hubble: aggregator DNS counter + evidence DNS branch (DNS-01, VIS-01 gate) (fef0971)
- k8s: L7 preflight checks for cilium-config + cilium-envoy with warn-and-proceed (VIS-04, VIS-05) (5ab5556)
- policy: extractDNSQuery + kube-dns companion injector (DNS-01, DNS-02) (1013f6f)
- policy: wire DNS L7 codegen into BuildPolicy with companion injector (DNS-01, DNS-02, DNS-03) (a71f908)
Bug Fixes
- policy: preserve Rules in mergePortRules + sort L7 lists in normalizeRule + L7 discriminator on RuleKey (EVID2-02, EVID2-03, EVID2-04) (615e527)