Skip to content

v0.0.9

Choose a tag to compare

View all tags
@AndrewGrachov AndrewGrachov released this 24 Oct 21:35
· 137 commits to main since this release
v0.0.9
ce4828a

Highlights

  • Task-owned runners. Setup, gates and declared services run in the task pod (#772, #773). Each root thread gets its own task volume and checkout. Each attempt's tree and session are checkpointed at finalize, a lost volume is restored from its checkpoint, and the reaper retires volumes using board thread facts (#775). The internal reviewer runs in the task pod and claims its review in-band (#774).
  • Infrastructure loss interrupts a task instead of losing it. Driver takeover works on both executors (#829). An expired lease is recovered as an interruption and keeps its session (#822). Every run's end goes through one termination policy (#824). Settle receipts and a storage-enforced job status graph are in place (#821). Supervisor reports are acknowledged and step invocations are kept separate (#823). Docker and kubernetes now follow one executor contract (#828, #869).
  • Shared admission. Running-task budgets (total, per org, per repo) are enforced in the claim across every driver and replica (#831). The cross-org claim scan is ordered the same on every replica. Board and driver expose Prometheus metrics. PRs are followed on an interval, so a lost webhook never strands a wait.
  • Replica-safe API. Migrations are serialized under one advisory lock, workspace clone and purge rows are owned by token, and artifacts are pinned across two API replicas (#830).
  • Security.
    • The agent's tool commands run under their own uid (#814).
    • The runner's GitHub token renews through a lease-authenticated endpoint, so long runs outlive the 1 h App token (#807).
    • Publication evidence is bound to its content, and log completeness is reported accurately (#825).
    • The transcript exporter has its own export-only control token (#827).
  • The API server no longer keeps a filesystem workspace or per-member repo selection (#777, #778).

Fixes

  • Supervised steps are released when the runner group ends mid-step (#967).
  • An agent container that ended without agent.exit is read as lost within seconds, on both executors (#920).
  • The pre-agent setup outcome carries to an adopting or taking-over holder (#917).
  • A takeover's rebind wait ends once the earlier group is confirmed finished (#928).
  • Block-helper effects are reconciled across claims with stable effect ids and receipts (#826).
  • Flaky executor tests are order- and load-independent (#905, #946).
  • Release pipeline: every image pull goes through mirror.gcr.io instead of ECR Public, whose per-IP data limit refused shared runner IPs. The executors' npm is bumped to 11.21.1.

Upgrade notes

  • Migrations 070–084 apply on boot, serialized under an advisory lock. 084 enforces the job status transition graph with a trigger.
  • Chart: the RWX workspaces volume is gone. Remove workspaces.* and dashboard.workspaceRoot from your values. Runners use one per-thread taskVolume instead (accessMode: ReadWriteOncePod, size: 20Gi, ttlMs, boundMs), so the cluster needs a StorageClass that provides RWOP volumes. EFS is no longer needed.
  • Chart: artifacts.backend defaults to s3. artifacts.s3.bucket and artifacts.s3.region (or endpoint) are required. Set artifacts.backend=filesystem only for a single-replica development install.
  • Chart: new values.
    • dashboard.admission.maxRunning / maxRunningPerOrg / maxRunningPerRepo (empty means unlimited).
    • dashboard.serviceAccount.
    • The driver gets metricsPort (9464), rebindGraceMs, orphanMinMs, stepWaitMs, repoCloneBase and artifactFlush.*.
  • Env.
    • ORG_WORKSPACE_ROOT is removed.
    • New: ADMISSION_MAX_RUNNING, ADMISSION_MAX_RUNNING_PER_ORG, ADMISSION_MAX_RUNNING_PER_REPO, TASK_VOLUME_TTL_MS, TASK_VOLUME_BOUND_MS, DRIVER_HANDOVER_MS, DRIVER_METRICS_PORT. All are optional.
  • CLI: @bellows-ai/bellows-cli@0.0.9 publishes under latest.

Validation

  • CI green on the release commit. Identical runtime code to v0.0.9-rc-4: the only commit after it removes marketing sources.
  • v0.0.9-rc-4 deployed to a no-EFS EKS stage install with per-thread EBS task volumes, running tasks end to end. The EKS failure-matrix walk was recorded on that stage (#779, #968).
  • Kind lane 536/0 and test:jobs 342/0 on main for #905.

Known limits

  • CVE-2026-109869 (undici, inside npm's own vendored tree in the executor images, not reachable at runtime) is in .trivyignore until an npm release vendors undici 6.29.1. Revisit 2026-11-24.
  • The dashboard stays at one replica (#913).
  • A workflow wait's re-entry can drop activity that arrived during the previous continuation (#937).
  • Kind-lane exit cleanup can hang on an API stall (#948).
  • Load-sensitive timeouts remain in npm test (#972).
  • Close-time session readouts still run as aux Jobs (#882).
  • The Atlassian CLI is not yet mirrored and pinned (#384).
Assets 2
Loading