feat: Rampart v0.9.10 — reliability, security, UX, docs

[peg]

Rampart v0.9.10

Polished minor release. All blockers resolved, security audit clean, e2e 45/45, all packages pass with -race on Linux/macOS/Windows.

---

OpenClaw Plugin Integration

The headline feature of this release. Rampart previously intercepted tool calls by patching OpenClaw's dist files — fragile, broke on every upgrade. v0.9.10 replaces that with a native OpenClaw plugin using the official before_tool_call hook API.

How it works:

AI agent → OpenClaw → before_tool_call hook → Rampart plugin
                                                     ↓
                                         POST localhost:9090/v1/check
                                                     ↓
                                         allow / deny / ask / watch

1. rampart setup --plugin installs the plugin via openclaw plugins install, sets tools.exec.ask: off (Rampart owns all decisions), and copies the openclaw.yaml policy profile
2. On every tool call, the plugin fires before_tool_call and checks Rampart's proxy
3. Rampart evaluates against policies → returns a verdict
4. If ask, the plugin surfaces an approval UI in OpenClaw and polls until resolved
5. "Always Allow" clicks call POST /v1/rules/learn to write a permanent allow rule back into user-overrides.yaml

Requires: OpenClaw >= 2026.3.28 (introduces before_tool_call hook)

---

Security Fixes

• BuildAllowPattern hardened — high-risk command prefixes no longer generate trailing wildcard globs:

  • docker run nginx → exact match (not docker run *)
  • sudo docker run nginx → exact match (wrapper prefix stripping: sudo/env/nice/nohup/etc. are stripped before dangerous prefix check)
  • kubectl apply/exec/delete, curl <external-url>, rm, dd, mkfs, chmod/chown on sensitive paths all kept exact
  • Package installs (apt install, npm install, brew install) continue to glob last arg as before
  • 27 test cases covering all cases including bypass attempts

• Path traversal fix in isSensitivePathToken — path.Clean() now resolves .. and . before matching sensitive roots. /tmp/../etc/shadow and /./etc/passwd now correctly trigger exact-match mode.

• policyWriteMu added to Server — handleLearnRule and handleDeleteAutoAllowed serialize the read-modify-write cycle on policy YAML files, eliminating the TOCTOU race under concurrent admin requests.

---

Reliability

• Approval store persistence — pending approvals survive rampart serve restarts (JSONL at ~/.rampart/pending-approvals.jsonl, atomic writes, graceful on missing file, 4 new tests)
• rampart doctor checks ask: on-miss — the most common silent failure now produces a clear warning with the exact fix
• Name-based rule deletion — DELETE /v1/rules/auto-allowed/{name} replaces fragile index-based deletion
• MCP configurable agent identity — --agent-id and --session-id flags on rampart mcp

---

UX / Bug Fixes

• Smart Always Allow globs — sudo apt-get install nmap writes sudo apt-get install * instead of exact match; dangerous prefixes excluded (see Security above)
• setup panic fixed — strings.Fields(version)[0] now guarded against empty slice; no crash on malformed openclaw --version output
• e2e.yaml updated — require_approval → ask (renamed in v0.9.9); suite now 45/45 clean
• toolList YAML unmarshaler — user override rules accept both tool: exec (scalar) and tool: [exec] (sequence)
• GoReleaser — reverted homebrew_casks → brews; Homebrew auto-update now works

---

Docs

• Approval timeout corrected: 1h/5m → 2 minutes (README + cli-commands reference)
• require_approval removed from API-REFERENCE; ask noted as replacement
• action: log deprecation noted in guides (renamed to action: watch)
• 9 previously unpublished guides now live: Windows, CI/headless, Wazuh, project policies, community policies, OpenClaw, Codex, benchmarking, native-ask
• v0.9.9 migration notes added to README (3 breaking changes with before/after)
• Snare cross-links added: "Rampart blocks. Snare catches."

---

Test Status

go test -race ./...   → 24 packages, 0 failures (Linux, macOS, Windows)
rampart test e2e.yaml → 45/45 passed
goreleaser snapshot   → cross-platform build ✓