v4.2.0

What's Changed

• refactor: consume shared agent SDK by @kalijerry in #2
• chore: merge maintenance branches into dev_new by @kalijerry in #3
• feat(sdk): take the Agent contract from Control's SDK module by @kalijerry in #4
• feat(machine-telemetry): accept systemd_services config and collect systemd unit usage (systemd panel 3/7) by @kalijerry in #5
• feat(agent): A2 capability negotiation on the Control SDK (AG-1) by @kalijerry in #6
• feat(agent): mTLS identity — enroll, store, renew, no API key once enrolled (AG-2) by @kalijerry in #7
• feat(agent): configuration from the control stream (AG-3) by @kalijerry in #8
• feat(agent): users from the control stream (AG-4) by @kalijerry in #9
• feat(agent): reports and package reports on the control stream, with spool (AG-5) by @kalijerry in #10
• feat(agent): maintenance, alive list, mTLS artifacts and ack codes on the control stream (AG-5b) by @kalijerry in #11
• feat(forward): Agent forward component — drivers, persisted state, health loop, reports (F3b) by @kalijerry in #12
• feat(agent): O1 installer layout — credential-only config, anixops paths, non-root, gost and signatures in releases by @kalijerry in #13
• feat(agent): agent.diagnostic executor and forward diagnostic checks (F3c) by @kalijerry in #14
• feat(agent): staged upgrades — verify, hand off to the updater, apply with rollback (O4) by @kalijerry in #15
• fix(node): restore the previous node on a failed reload; skip reloads for unchanged configuration by @kalijerry in #16
• chore(release): prepare v4.2.0-rc.1 by @kalijerry in #17
• fix: alive-list race in the node controller; uninstall matches the O1 layout by @kalijerry in #18
• chore(release): fold the Unreleased fixes into v4.2.0-rc.1 by @kalijerry in #19
• test(node): fix the flaky TestCredentialOnlyProxyNodeWaitsForItsCredential by @kalijerry in #20
• test(node): wait for the controller to see maintenance.v1 before the single monitor run by @kalijerry in #21
• release: replace the official signing key (public root) by @kalijerry in #22
• ci: Signing Key Check, a manual workflow that proves the key pair works by @kalijerry in #23
• fix(scripts): the root manager's uninstall keeps data/ and removes gost by @kalijerry in #24
• fix(cmd): uninstall keeps the root install's data/ without --purge by @kalijerry in #25
• chore(release): prepare v4.2.0-rc.2 by @kalijerry in #26
• feat(forward): the experimental anixops relay and its wiring (A3, off by default) by @kalijerry in #27
• chore(release): prepare v4.2.0-rc.3 by @kalijerry in #28
• build: move Agent to Go 1.26.9 and bump x/net to v0.60.0 by @kalijerry in #29
• chore(release): prepare v4.2.0-rc.4 by @kalijerry in #30
• fix(deps): bump circl and utls to clear GO-2026-4550 and GO-2026-4512 by @kalijerry in #31
• ci: pin runners to ubuntu-24.04 by @kalijerry in #32
• chore(release): prepare v4.2.0 by @kalijerry in #33
• test(agent): wait for the issued certificate before asserting it by @kalijerry in #35

New Contributors

• @kalijerry made their first contribution in #2

Full Changelog: v2.5.0...v4.2.0