Updates

src/content/news/0-7-0.html

@@ -52,8 +52,10 @@ og_type: "article"
         <li>Automatic per-user shell dotfile harvesting is only enabled in <code>--dangerous</code> mode.</li>
         <li>Plain directory harvests are frozen into a private temp tree before manifesting, reducing TOCTOU exposure between validation and rendering.</li>
         <li>Remote harvests reject unknown SSH host keys by default.</li>
+	<li>Enroll now implicitly 'validates' a harvest before trying to manifest it to Ansible code.</li>
         <li>Root runs refuse unsafe non-interactive <code>PATH</code> setups unless <code>--assume-safe-path</code> is supplied.</li>
 	<li>Enroll will not want to harvest or manifest to a directory that is writable by others. It will try to make the harvest or manifest readable only by the user that is executing the command. This is in an effort to resist tampering attacks.</li>
+	<li>Enroll's <code>--enforce</code> argument to <code>enroll diff</code> has been removed. Non-interactive application of manifests is considered too dangerous by the maintainer, despite all the additional hardening of the harvesting described above. If you really want to enforce the previous harvest, you can still code up an <code>enroll manifest [...] && ansible-playbook [....]</code> yourself when detecting that <code>enroll diff</code> sees changes between two harvests.</li>
       </ul>
     </article>
   </div>