Skip to content

Release v0.15.0-rc5

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Oct 10:44
· 60 commits to main since this release
v0.15.0-rc5
This tag was signed with the committer’s verified signature.
OisinKyne Oisín Kyne
SSH Key Fingerprint: kFIvk1BVuGQBCOUSc8koJUxrf04M4KO7iSYIrwK8fzo
Verified
Learn about vigilant mode.
755be52

v0.15.0-rc5 - Getting Lean

A maintenance release candidate: everything brought up to date, the CLI tightened, and the stack made to rebuild itself from what's on disk. If a cluster is deleted and recreated, obol stack up now restores your models, RPCs, pricing, branding, agents and offers from your config directory.

Warning

This software is early alpha, you could lose what you put in. Please use caution when it comes to non-testnet assets. Back up before upgrading: obol stack export --file backup.tar.gz.

Install / Upgrade

# Fresh install
curl -fsSL https://stack.obol.org/v0.15.0-rc5 | bash
obol stack init && obol stack up

# Upgrade an existing stack (installs pinned tools, updates CRDs, then charts)
curl -fsSL https://stack.obol.org/v0.15.0-rc5 | bash
obol upgrade

Release Highlights

The stack rebuilds itself from your config

obol stack up, obol stack import and obol sell resume now share one ordered replay of recorded state: models, local networks, RPC upstreams, the eRPC overlay, x402 pricing, ERC-8004 identity, agent instances, Agent resources, storefront branding, apps, then sell offers. Each step is best-effort and the run ends with a summary. x402 pricing and ERC-8004 identity are now recorded, so they also survive a cluster recreation. Model API keys taken from your environment are recorded as env: references instead of plaintext. obol stack import now does the whole restore in one command, and obol stack purge offers an export first.

obol <tool> behaves like the tool

obol kubectl|helm|helmfile|k9s run the real binary directly: same flags, stdin, TTY, exit codes, signals and tab completion. They always target the stack (pass --kubeconfig to target something else), and commands that don't need a cluster, such as helm template or kubectl version --client, now work before obol stack up. Prefer plain kubectl? eval "$(obol env)" prints the exports; nothing is written to your ~/.kube/config.

obol manages its own toolchain

kubectl, helm, k3d, helmfile, k9s and helm-diff are pinned with per-platform checksums and installed automatically on stack init and stack up. obol update shows their status, and obol upgrade --tools-only updates them. This is groundwork for package-manager installs: Homebrew will follow with a stable release.

Helm 4

obol now installs and drives Helm 4.3.0. Every release is synced with server-side apply, so the Kubernetes API server tracks who owns each field and obol's own writes no longer fight Helm's. Existing Helm 3 releases switch over on their next sync, with no action needed. A repeat obol stack up on an unchanged stack now restarts nothing, and the v0.14 → v0.15 upgrade path has been tested end to end.

Up to date

Go 1.27, k3s v1.35.9, Traefik 39, kube-prometheus-stack 91, eRPC 0.3.0, Hermes v2026.9.24, cloudflared 2026.10.0, refreshed Ethereum clients and Go modules. obol upgrade now applies chart CRDs server-side before syncing, since Helm never upgrades CRDs by itself.

Smaller wins

  • Grouped obol --help - generated from the command tree, with "did you mean" for typos and shell completion (obol completion bash|zsh|fish).
  • Dashboard links - commands that create something print a link to it in the dashboard. The browser opens only on the first stack up and the first offer, never over SSH, in CI or in JSON mode, or with --no-open.
  • obol agent new <name> - pins the cluster's top-ranked model when --model is omitted.
  • Safer secrets - the Hermes dashboard password and the dashboard's auth secrets are now read from Kubernetes Secrets instead of appearing in Deployment specs.
  • eRPC overlays - replacing or resetting an overlay no longer leaves the old upstreams live.
  • Paid agent conversations - the verified payer wallet is injected into the agent's message.
  • k3s backend - stack down cleans up properly, and purge no longer removes a system-wide k3s it doesn't own.
  • Wallet-safe agent delete - deleting an agent that holds a wallet now refuses until you pass --delete-wallet, and points you at the backup command first.
  • Paid streaming - a fix in the seller gateway stops long streamed agent responses from being cut off mid-stream (unexpected EOF).
  • Safe without a terminal - in scripts and CI, destructive commands (app, sell, agent and tunnel delete) now fail and ask for --force instead of silently skipping or proceeding, and nothing waits on a prompt nobody can answer.
  • Upgrading from v0.14 keeps your obol sell pricing settings.
  • Security patches - updated storefront dependencies (next, postcss, sharp) and Go modules.
  • Dashboard - front-end v0.1.29-rc0: renders before wallet code loads, has 404 and error pages, and includes accessibility and mobile fixes.

Breaking changes / Migration notes

  • Flag renames:
    • obol stack export, obol agent wallet backup and obol openclaw wallet backup take --file <path> (was --output, which is now only the global human/json switch).
    • obol domain search takes the query as a positional argument.
    • app list -v and sell info -v are replaced by the global --verbose.
  • Passthrough: obol kubectl … now targets the stack even if KUBECONFIG is exported in your shell. Global obol flags before a tool name (obol -o json kubectl …) are an error. obol hermes only reads --agent as the first argument, or from OBOL_AGENT.
  • Helm 4: obol helm … runs Helm 4, which has some flag changes from Helm 3 (for example, helm list no longer takes -a). Run obol upgrade --tools-only if you installed tools before this release.
  • obol agent delete: needs --delete-wallet for agents that hold a wallet.
  • No terminal, no prompt: without a TTY (or with OBOL_NONINTERACTIVE=true), obol app|sell|agent|tunnel delete need --force. They used to exit 0 without deleting (or, for tunnel delete, delete without asking).
  • Exit codes: unknown commands exit 2 (was 3).
  • Removed:
    • obol sell inference --vm, --tee, --model-hash and --enclave-tag, together with Secure Enclave and TEE attestation. Stored offers that used them are skipped on resume, with a hint to recreate them.
    • The autoresearch skills, which moved to the Obol skills plugin.
  • Deprecated (removed in v0.16): OpenClaw (obol openclaw …, --runtime openclaw), obol domain, and obol tunnel login / tunnel setup --management local. Move an OpenClaw wallet to Hermes with obol agent wallet backup --runtime openclaw <id> --file w.json, then obol agent wallet restore --runtime hermes --input w.json --force. Back up the Hermes wallet first.
  • Existing clusters: the local-path provisioner moved to v0.0.37. stack up and obol upgrade recreate the old local-path StorageClass automatically; existing volumes are unaffected.

Known issues

  • On macOS, a new Hermes agent may restart once or twice on first start (attempt to write a readonly database) before running normally. Agent data lives on a Docker Desktop shared folder; a native-volume layout is being designed.
  • The Hermes dashboard sidecar logs API server rejected invalid API key for /health/detailed every few seconds. This is an upstream Hermes issue, and it's harmless.

What's Changed

Full Changelog: v0.14.0...v0.15.0-rc5

What's Changed

Contributors

OisinKyne
Assets 11
Loading