[mostafa]

Bump the workspace and all inter-crate version pins from 0.23.0 to 0.24.0, sync the workspace, fuzz, and wasm-smoke lockfiles, bump OCSF golden metadata.product.version pins and the rstix README install examples, promote all unreleased docs version tags, and finalize the CHANGELOG with the v0.24.0 TL;DR, compare link, and release reference link.

Once merged, publishing the signed v0.24.0 GitHub Release triggers the crates.io, binary, and Docker workflows.

TL;DR

RSigma v0.24.0 is the "conformance, reliability, and stability" release: Sigma rules now fail early when their semantics are invalid; modifiers, keywords, selectors, filters, correlations, and processing pipelines align more closely with Sigma and pySigma; and native backend queries are verified against real PostgreSQL, LynxDB, and Fibratus engines.

• Conformance: parse-time semantic validation rejects unusable logsources, invalid modifier/value combinations, malformed regexes and CIDRs, empty detections, and unresolved condition selectors before compilation (Validate rule semantics at parse time #543).
• Sigma semantics: value modifiers, keywords, selectors, filters, temporal and chained correlations, and processing pipelines now follow the Sigma specification and pySigma more closely (fix: require every referenced rule when a temporal condition is omitted #524, fix(eval): interpret value modifiers as the Sigma specification defines #531, fix: keywords and condition selectors follow the Sigma specification #532, fix: align correlation behavior with Sigma semantics #534, fix(eval): conform filter selector and target semantics #537, fix: align processing pipelines with pySigma semantics #539, Fix filter selector overlap, hidden filter items, and title-based tune targets #540, fix: correlation chain output, replay defaults, and reference identity follow-ups #541).
• Conversion and reliability: native backends preserve condition precedence, encoding variants, regex flags, typed values, negation, filters, and ordered temporal correlations, with regression tests in PostgreSQL, LynxDB, Fibratus, and pySigma (test(convert): run backend queries in the real engines #528, Group converted conditions by operator precedence #530, fix(convert): converted queries match what the engine evaluates #542).
• Breaking: parser errors move earlier, HIR_SCHEMA_VERSION is 3, processing-pipeline and correlation APIs change, and the PostgreSQL case_sensitive_re option is removed. See the migration notes in the changelog.
• Platform and docs: Rust 1.96.0 is pinned across development and release builds; deployment, tutorial, troubleshooting, version-tag, architecture, and visual documentation are refreshed; CI, release publishing, dependency, performance, and container scanning workflows are hardened (fix(ci): publish rstix before the crates that depend on it #516 through docs(assets): redraw the logo and add a favicon set #521, ci: limit the performance gate to evaluator changes #533, Refresh Grype scans on the default branch #538, chore(deps): batch dependency updates (Oct 2026) #544, ci: pin Rust 1.96.0 across development and release workflows #545, chore(deps): follow-up Dependabot updates for #544 #550).

Test plan

• scripts/check-toolchain-version.sh
• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
• RUSTDOCFLAGS='-D warnings -D rustdoc::broken-intra-doc-links' cargo doc --workspace --all-features --locked --no-deps
• cargo test --workspace --all-features --locked
• cargo audit
• cargo metadata --locked for the workspace, fuzz/, and ci/wasm-smoke/
• cargo test -p rsigma-runtime --test ocsf_golden --locked
• python3 scripts/mcp-smoke.py --bin target/debug/rsigma
• python3 scripts/mcp-smoke.py --http --bin target/debug/rsigma
• npm run docs:build and npm run docs:validate