What shipped, newest first.

Housekeeping release: the workspace moved from Rust edition 2021 to 2024 (adopting stable let-chains where clippy now suggests them; no behavior change), and the packaging metadata (Cargo.toml, debian/control, debian/copyright, debian/changelog) was corrected to Etminan's own dedicated project identity instead of the shared monorepo-wide one it had been carrying by oversight.

Every alarm finding now carries a stable, machine-matchable kind field (e.g. pcr-mismatch, sla-exceeded) alongside the existing free-form text — so a PagerDuty/Slack/webhook rule can route or filter on category without parsing prose. Paired with new per-channel message formatting (ETMINAN_NOTIFY_<CHANNEL>_FORMAT): reshape one channel's message text purely via config, no plugin script edit needed. New Notification channels page covering the full contract.

The headline change: change-source (ticket-system) correlation moved from an in-process HTTP client to an external, allowlisted, hash-verified plugin process — the same model now formalized as the Etminan Plugin API, which also covers the new PagerDuty/Slack/generic-webhook notification channels introduced this release. Operators using change-source correlation need to install the plugin and allowlist its pinned hash — see Change-source correlation for the full walkthrough.

• etminan-verifier no longer depends on tss-esapi at build time — it now cross-compiles cleanly to a static musl binary.
• New rotate-tls command re-pins a host's TLS certificate fingerprint after its agent's keypair is regenerated, without a full re-enrollment.
• Package-manager correlation deepened: baseline review now also reports install/upgrade transaction timing and trust-store verification.

Every trust-changing action is now signed and recorded in a new self-contained, hash-chained audit log — no external tool or key required. enroll, baseline reject, and baseline exclude revoke now require --key/--reason, which they previously didn't take at all.

• etminan-agent now watches every configured path with unprivileged fanotify and sweeps a changed file the instant a write completes, instead of waiting for the next hourly cycle.
• New centralized profile registry: etminan-verifier assign-profile pushes a watched-path profile selection to a host, instead of requiring an operator to edit that host's own config directly.