🐛 fix(website): sync live site to shipped v1.4.1 (#132)

* 🐛 fix(website): sync live site to shipped v1.4.1

The production getsockguard.com was stuck showing v1.3.0 as the current
release. Bring every marketing surface up to what actually shipped.

- 🔖 fix(website): hero version badge 1.3.0 → 1.4.1
- 📝 docs(website): roadmap — v1.4.0 released, v1.5.0 now the next milestone
- 📝 docs(website): FAQ — remote-daemon TLS + Tecnativa compat as shipped, not upcoming
- 📝 docs(website): comparison rows + CetusGuard page — remote daemon upstream ships now
- 🧪 test(website): page-data roadmap assertion tracks v1.4.0 released / v1.5.0 next

Excludes the 15→17 preset-count bump (v1.5-only; main ships 15).

* 🧪 test(website): assert v1.5.0 is the next roadmap milestone

Addresses CodeRabbit — the existence check alone still passed if the
status drifted to planned/released. Pin it to next.

Author: scttbnsn

website/src/app/data/comparison-rows.ts

@@ -72,8 +72,7 @@ export const comparisonRows: ComparisonRow[] = [
     wollomatic: "No",
     elevenNotes: "No",
     cetusguard: "Yes",
-    sockguard: "v1.4",
-    planned: true,
+    sockguard: "Yes (active/passive failover)",
   },
   {
     feature: "Read-side visibility / redaction",

website/src/app/data/faq.ts

@@ -17,7 +17,7 @@ export const faqItems: Array<{ question: string; answer: string }> = [
   {
     question: "Can Sockguard listen over TCP, and is remote access secure?",
     answer:
-      "Yes. Sockguard can listen on a TCP port in addition to (or instead of) a unix socket. For any non-loopback TCP listener we require mutual TLS 1.3 by default — plaintext remote TCP needs two explicit insecure acknowledgement flags before we accept it. Client identity on TCP is established via mTLS certificate selectors (CN, DNS/IP/URI SAN, SHA-256 SPKI pin). The upcoming v1.4.0 release (in release-candidate testing now) adds dialing a remote Docker daemon over TCP with mTLS and automatic endpoint failover.",
+      "Yes. Sockguard can listen on a TCP port in addition to (or instead of) a unix socket. For any non-loopback TCP listener we require mutual TLS 1.3 by default — plaintext remote TCP needs two explicit insecure acknowledgement flags before we accept it. Client identity on TCP is established via mTLS certificate selectors (CN, DNS/IP/URI SAN, SHA-256 SPKI pin). Sockguard can also dial a remote Docker daemon over TCP with mTLS and automatic endpoint failover (added in v1.4.0).",
   },
   {
     question: "What are signed policy bundles and container image trust?",
@@ -32,6 +32,6 @@ export const faqItems: Array<{ question: string; answer: string }> = [
   {
     question: "How do I migrate from Tecnativa's docker-socket-proxy?",
     answer:
-      "We match Tecnativa's full environment-variable surface — CONTAINERS, EVENTS, SERVICES, NETWORKS, VOLUMES, TASKS, NODES, CONFIGS, SECRETS, ALLOW_RESTARTS, SOCKET_PATH, LOG_LEVEL, and the full section-variable set. Point DOCKER_HOST at the Sockguard socket instead of Tecnativa's and your existing env config continues to work. The shipped 'tecnativa-compatible' preset covers the same allow surface. Once migrated you can layer on body inspection, per-client profiles, and signed policies incrementally without breaking running workloads — use a profile in warn mode to measure what would have been denied before flipping to enforce.",
+      "We match Tecnativa's full environment-variable surface — CONTAINERS, EVENTS, SERVICES, NETWORKS, VOLUMES, TASKS, NODES, CONFIGS, SECRETS, ALLOW_RESTARTS, SOCKET_PATH, LOG_LEVEL, and the full section-variable set. Point DOCKER_HOST at the Sockguard socket instead of Tecnativa's and your existing env config continues to work. Sockguard's built-in Tecnativa env-var compatibility layer covers the same allow surface. Once migrated you can layer on body inspection, per-client profiles, and signed policies incrementally without breaking running workloads — use a profile in warn mode to measure what would have been denied before flipping to enforce.",
   },
 ];

website/src/app/page-data.test.mjs

@@ -76,16 +76,17 @@ test("website comparison rows live in extracted data modules", () => {
 test("roadmap data is valid and matches expected milestones", () => {
   assert.ok(roadmap.length > 0, "roadmap must be non-empty");
 
-  // Latest released milestone must be v1.3.0
+  // Latest released milestone must be v1.4.0 (v1.4.0/v1.4.1 shipped 2026-07-10)
   const releasedMilestones = roadmap.filter((m) => m.status === "released");
   assert.ok(releasedMilestones.length > 0, "must have at least one released milestone");
   const latestReleased = releasedMilestones[releasedMilestones.length - 1];
-  assert.equal(latestReleased.version, "v1.3.0", "latest released milestone must be v1.3.0");
+  assert.equal(latestReleased.version, "v1.4.0", "latest released milestone must be v1.4.0");
   assert.equal(latestReleased.status, "released");
 
-  // Must reference v1.4.0
-  const v140 = roadmap.find((m) => m.version === "v1.4.0");
-  assert.ok(v140, "roadmap must include a v1.4.0 milestone");
+  // Must reference the current in-progress milestone v1.5.0
+  const v150 = roadmap.find((m) => m.version === "v1.5.0");
+  assert.ok(v150, "roadmap must include a v1.5.0 milestone");
+  assert.equal(v150.status, "next", "v1.5.0 must be the next milestone");
 
   // Every milestone must have a non-empty items array
   for (const milestone of roadmap) {

website/src/lib/comparison-route-data/cetusguard.tsx

@@ -7,7 +7,7 @@ export const cetusguardComparisonRouteData = {
 Method + path filtering|Yes (regex)|Yes|tie
 Remote TCP mTLS listener|Yes|Yes (TLS 1.3)|tie
 Regex path rules|Yes|Yes|tie
-Remote daemon upstream (TLS)|Yes (in production)|Planned (v1.4)|competitor
+Remote daemon upstream (TLS)|Yes (in production)|Yes (active/passive failover)|self
 Config simplicity|Compact rule files|Full YAML config|competitor
 Request body inspection|No|Yes (12+ resource types)|self
 Per-client policies|No|CIDR + labels + cert selectors + SPKI + unix peer|self
@@ -60,7 +60,8 @@ layers|Rollout Modes|Sockguard's per-profile rollout modes (enforce / warn / aud
         request body inspection, per-client certificate selectors, signed policy bundles, and
         Prometheus metrics
       </strong>
-      . Remote daemon TLS is on the v1.4 roadmap — CetusGuard ships it today.
+      . Sockguard now ships remote daemon TLS too — with health-checked active/passive failover
+      across redundant endpoints, which CetusGuard doesn't have.
     </p>
   ),
   migrationTitle: "Coming from CetusGuard?",

website/src/lib/site-config.ts

@@ -15,7 +15,7 @@ export const SITE_CONFIG = {
   /** Brand name shown in the header, footer, and metadata. */
   name: "Sockguard",
   /** Current release version shown in the hero badge. */
-  version: "1.3.0",
+  version: "1.4.1",
   /** Short product tagline used in page titles and OG metadata. */
   tagline: "Control what gets through",
   /** Default meta / OpenGraph / Twitter description. */

website/src/lib/site-content.ts

@@ -71,7 +71,7 @@ export const roadmap: Milestone[] = [
     version: "v1.4.0",
     title: "Remote Upstreams & Fleet Presets",
     emoji: "🌐",
-    status: "next",
+    status: "released",
     items: [
       "Remote Docker daemon over TCP with mutual TLS and active/passive failover",
       "Ordered endpoint failover — connect failure instantly promotes next endpoint without retry",
@@ -84,13 +84,18 @@ export const roadmap: Milestone[] = [
   },
   {
     version: "v1.5.0",
-    title: "Policy Management & Developer Experience",
+    title: "Safer Defaults & Namespace Hardening",
     emoji: "🔧",
-    status: "planned",
+    status: "next",
     items: [
-      "Policy diff: validate a candidate config against the running policy without a hot-reload",
-      "OpenTelemetry / OTLP trace export (W3C traceparent already wired; exporter planned)",
-      "Additional bundled presets and ready-to-run compose examples",
+      "upstream.request_timeout now defaults to 60s (was unlimited); 'off' restores unlimited",
+      "ownership.allow_cross_owner_namespace_sharing defaults to false — cross-owner container:<id> namespace joins denied by default when ownership.owner is set",
+      "Namespace-sharing gate: restrict_namespace_sharing + allowed_namespace_sharing_containers gate container:<id> joins across NetworkMode/PidMode/IpcMode/UsernsMode; deny_namespace_path_mode blocks raw ns:<path> on NetworkMode only",
+      "require_cpu_limit_hard — opt-in hard CPU-time cap (NanoCpus/CpuQuota), independent of require_cpu_limit",
+      "Exec Env allow/denylisting — request_body.exec.allowed_env_vars/denied_env_vars, denylist wins",
+      "New presets: portwing-with-compose.yaml, drydock-with-compose.yaml, plus a tri-tool compose example",
+      "Helm chart: pod-level podSecurityContext",
+      "Config Viper-default registration generated by reflection off Defaults()",
     ],
   },
 ];