H7 v3.0.7 / v3.0.8: two new detection channels, speculative containment — and a fix we publish instead of hiding

What shipped in July

Two releases landed this month: v3.0.7 (July 8) and v3.0.8 (July 18). Together they extend the detection surface from five to seven public channels, introduce the first piece of a new reaction architecture, and — in keeping with the discipline this product is built on — fix a detection gap that we are documenting publicly rather than quietly patching.

L6: privilege-escalation intercept, in Ring 0

H7 now hooks the kernel's credential-commit path (commit_creds) directly. When a monitored process transitions to root — via a setuid binary, a kernel exploit, or a container escape — the escalation is captured at the exact kernel function that applies it. There is no time-of-check/time-of-use window for an attacker to race: the signal is emitted by the same code path that grants the credentials.

The alert carries the previous UID and the capability delta, and feeds the kill-chain correlator as a PRIVESC signal — one of the strongest single indicators the brain consumes, because it is kernel-authoritative and unambiguous.

L7: sensitive-file access, scoped by contract

A new openat tracepoint probe watches file access from monitored namespaces against the sensitive paths declared in the workload's contract profile — credential stores, shadow files, cloud key material, SSH private keys. A workload reading files outside its declared operating contract raises SENSITIVE_FILE_ACCESS.

Two design choices worth noting. First, the probe records the access event only — never file contents. Second, it is scoped by design: namespaces without a contract profile see zero runtime effect. Honest status: this rule was built and validated against our internal Breach Lab scenarios; end-to-end validation against a real-world exploit chain is still on the roadmap, and until then we treat it as lab-grade. Unit-green is not detection.

Degrade: speculative containment (v3.0.7)

Detection without a reaction path is telemetry. The existing reaction primitives are binary — the Muraille LSM veto blocks an exec outright, the dead-man's switch reverts enforcement when the control plane goes blind. Degrade adds a continuous dial between those extremes: a cgroup cpu.max throttle driven by the same deny-rate counters the dead-man's switch already reads. A workload that starts tripping enforcement denials can be slowed to a crawl — buying an operator minutes instead of milliseconds — without being killed.

Status, stated plainly: opt-in, fail-closed by default, proven in the VM harness. It has not yet run on a production host.

The fix we publish: network-egress calibration

v3.0.8 fixes a real detection gap. The network-egress detector (UNKNOWN_DESTINATION / NET_EGRESS_BURST) requires a calibration baseline before it can fire — and the calibration bootstrap was only ever invoked from the test harness, never from the production namespace-registration path. In deployed environments the detector sat permanently in its pre-calibration state: structurally present, effectively dormant.

It is now bootstrapped automatically when a namespace is registered — loading a saved baseline when one exists, opening a calibration window when one does not. We found this ourselves, we fixed it in the same release that extended the surface, and we are writing it here because the alternative — a changelog entry nobody reads — is not the standard this product claims to hold. If your risk assessment relied on egress detection before v3.0.8, re-run your validation scenario against the current release.

Also in these releases

• Durable content identity for enforcement — the BPF-LSM exec veto now resolves its allow-list to (device, inode) pairs, collapsing the path-alias attack surface (symlinks, bind-mounts, binary swaps at an allow-listed path).
• argv capture socket — a new bounded-argv probe feeds interactive-shell classification over a dedicated socket, correctly provisioned under /run/h7/ in all packaged installs.
• Packaging — the one-line installer verifies the Ed25519 release signature and SHA-256 checksums against release v3.0.8 assets; native deploys get the argv socket wiring automatically.

Where the proof lives

Every claim above maps to a changelog entry, a sealed ADR, or a signed evidence file in the product repository. Pilot customers receive the full chain of custody — including the sealed DARPA TC E5 (THEIA) validation manifest: TPR 1.00, measured FPR 0.58% (Wilson 95% CI), and the documented operating envelope that says where not to deploy H7 v1.