chore(release): prepare 1.10.0

.github/release-notes/1.10.0.md

@@ -0,0 +1,41 @@
+## Highlights
+
+- **Know when the sensor loses events.**
+  The agent writes an `agent::loss::sensor_events` alert for each event category that dropped events in the last window, with the channel, category, and dropped count.
+  Tune the window with `telemetry.loss_alert_interval_secs` (default 60, `0` disables).
+  Loss alerts bypass deduplication and never reach active response.
+- **Alerts identify their host and agent.**
+  Sigma, YARA, IOC, and correlation alerts carry `host.id`, `host.name`, `agent.id`, `agent.type`, and `agent.version`, identically in the NDJSON file and in webhook bodies.
+  `host.id` is a keyed one-way digest of the OS machine id, so the raw id is never emitted.
+- **More honest `sigma doctor` verdicts.**
+  Fields measured as reliably populated on `process_creation` are reported as caveats instead of degrading a rule, so most process-creation rules now report that they can fire.
+  The command exits `0` when every rule can fire, with or without caveats, and `--json` gains `summary.can_fire_with_caveats`.
+- **Fewer silent gaps on every platform.**
+  On Linux, file events are no longer lost on every CPU but CPU 0 on kernels with the perf syscall tracing backport (Ubuntu `7.0.0-38` and 7.1 from 7.1.6).
+  On Windows, a lost Event Log subscription recovers per channel and a channel missing at startup is retried instead of stopping the sensor, a service restart waits for a pending stop, NT device paths convert correctly on component boundaries and network shares, and written-file identity no longer slows process-image resolution.
+  On macOS, exec identities are retired on exit and startup processes are seeded.
+- **Lower overhead under load.**
+  YARA reuses one scanner per thread, artifact I/O runs on long-lived workers behind a bounded completion channel, pooled scanners are released after a rule reload, and correlation buffering and Linux `/proc` enrichment do less work.
+  Windows release binaries are now signed through SignPath.
+
+## Upgrade notes
+
+- **Restart after upgrading:** restart the service after replacing the binary, then run `rustinel doctor` and verify a known detection.
+- **Sensor loss alerts are on by default.**
+  Expect an `agent::loss::sensor_events` alert whenever a category drops events, plus a final one at shutdown.
+  The count is a per-window delta, not a total.
+  Route or filter on `event.dataset: "edr.agent"` in downstream pipelines, or set `telemetry.loss_alert_interval_secs = 0` to disable.
+- **New alert fields and a new state file.**
+  Alerts add the `host.*` and `agent.*` fields above.
+  `agent.id` is a random UUID persisted owner-only in `<agent.directory>/agent-id`, set with the new `[agent] directory` option, and managed layouts use a `state` directory.
+  If it cannot be persisted, `agent.id` is omitted.
+  Cloned or imaged hosts must not copy this file, or they will share an identity.
+- **`sigma doctor` exit codes change.**
+  The command used to exit `1` for almost any ruleset on `process_creation`.
+  It now exits `0` when every rule can fire, so scripts that treated the old exit code as normal should be reviewed.
+- **`rustinel doctor` judges drops as a loss rate.**
+  The telemetry counters are lifetime totals, so one shed event among millions used to keep a check at WARN until restart.
+  Pipeline queues and the artifact resolver now warn from 0.01% loss and pass below it, and alert loss fails from 0.1%.
+- **Linux file descriptors:** the sensor raises its soft `RLIMIT_NOFILE` to the hard limit at start, because the per-CPU tracepoint fix opens one descriptor per hooked tracepoint per CPU.
+  If it cannot open them, `rustinel doctor` reports the feature as degraded.
+- **Rule engine:** `rsigma` is updated to 0.24, and `rustls` to 0.23.46 for RUSTSEC-2026-0346 to 0349.

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "rustinel"
-version = "1.10.0-rc.1"
+version = "1.10.0"
 edition = "2021"
 authors = []
 description = "Open-source EDR for Windows, Linux, and macOS with Sigma, YARA, and IOC detection"