v0.1.0

v0.1.0 — 2026-10-21

Added

• docs: Move docs to Docusaurus and add a product page (#20) (8460693)
• repo: Add the Radxa CM3 IO (RK3566) board (#13) (40e6316)
• repo: Name the WAN and LAN interfaces wan and lan on every board (#19) (451530e)
• scripts: Export configuration bundles through a root worker (#11) (f5f5168)
• nix: Consume Nixstasis fleet bootstrap profile (8ff2dca)
• modules: Enforce fleet bootstrap transport boundary (879eb27)
• nix: Extend build policy for fleet transport (fc2f46e)
• repo: Reconcile watchdog enforcement (a5760ee)
• modules: Warn when watchdog hardware is unavailable (08d8d6a)
• tooling: Apply local build policy overrides (0202e64)
• nix: Apply immutable build policy (45b9726)
• nix: Add build configuration schema (68b221e)
• tooling: Add bundle vm root debug flag (fba8d2a)
• modules: Separate provisioning apply privileges (6b8e3e8)
• modules: Add opt-in watchdog enforcement (134c9b9)
• modules: Add nixstasis client module (f3cf5a5)
• scripts: Add async first-boot htmx ui (2c9c2df)
• scripts: Add typed partial provisioning API (47fa62a)
• scripts: Apply activation policy runtime (7c4bb43)
• scripts: Validate activation policy config (41babfe)
• modules: Apply extended network config (77a1516)
• scripts: Validate extended network config (5ee93b4)
• modules: Harden rauc ota verification (4837730)
• scripts: Harden provisioned runtime activation (aeec1e6)
• modules: Enforce bootstrap exposure lifecycle (917f776)
• modules: Package and run provisioning service (6a7ae71)
• scripts: Add provisioning package foundation (9cccca3)
• modules: Convert bootstrap web console to socket activation (9974172)
• modules: Configure NTP servers from config (119939d)
• modules: Add activation rollback on re-apply failure (4fac47b)
• modules: Implement atomic candidate apply with rollback (9d1e49f)
• modules: Add re-apply authentication via SSH signatures (c0e00f6)
• modules: Add runtime user-apply service (93b1344)
• modules: Implement canonical config schema and parser (72f6209)
• repo: Polish Caddy OIDC Cockpit UI (3ba110d)
• scripts: Support build Quadlet units in config.toml (d9a9906)
• scripts: Support network and volume Quadlet units in config.toml (d6b931a)
• tooling: Support compressed images in flash task (ffafc46)
• repo: Keep provisioning recoverable after first boot (7e4ab78)
• modules: Support rock64 rtl8153 usb nic firmware (01b3fee)
• scripts: Validate provisioned config against schema (dbceab7)
• modules: Support optional restrictive LAN firewall (994dfcd)
• Add provisioned LAN gateway config (d6951ab)
• scripts: Complete local first-boot provisioning flow (ff96939)
• scripts: Local first-boot provisioning flow (c5fc9f9)
• modules: Add durable log batching (5d89cd0)
• modules: Bounded forensic boot logging (0c71c33)
• docs: Mermaid diagram expand modal (cd5d009)
• docs: MdBook mermaid support (a2be31c)
• scripts: --bg flag to serial:capture for background/agent use (7ab3ff3)
• tooling: --lima flag to build tasks for Lima VM builds (2d9086f)
• docs: Cobalt branding theme overrides for mdBook (2145245)
• docs: MdBook-lint as hk pre-commit hook for docs (57f54ae)
• docs: MdBook documentation site with GitHub Pages deployment (4a219bf)
• tests: E2E test performance benchmarks: macOS apple-virt vs Linux (80b4a49)
• tests: Add cross-platform E2E selection (16ecb23)
• tests: Aarch64-darwin checks for native macOS test execution (8632fcc)
• tests: Watchdog + boot-count rollback E2E test (task 16.6) (923cf33)
• tests: Add power and network E2E tests (2327896)
• tests: Mise tasks for running and debugging E2E tests (5ffa498)
• tests: Os-verification confirmation E2E test (task 16.3) (12378b7)
• tests: RAUC rollback E2E test (task 16.5) (9093f27)
• tests: RAUC update install E2E test (task 16.2) (f333bd2)
• tests: Custom bootloader backend for QEMU RAUC testing (d3ae048)
• tests: RAUC slot logic NixOS test (task 15.5) (3f4c5cf)
• modules: Add first-boot services (9cf3682)
• modules: Add Traefik reverse proxy (f34a8d1)
• tooling: Cockpit pod service and auth provisioning to emmc task (ea9bcc2)
• modules: Systemd-repart for first-boot persist partition creation (8a98a7c)
• tooling: Mise build tasks and provisioning workflows (02bbd3e)
• nix: Flashable disk image derivation (nix build .#image) (05cdb3d)
• scripts: EMMC provisioning script with A/B partition layout (4d1a9ca)
• modules: Squashfs and RAUC bundle image build derivations (ac365fc)
• modules: Add watchdog and upgrade services (5e4dc6b)
• modules: RAUC slot config, signing certs, U-Boot boot-count script (5821f69)
• modules: Add LAN gateway networking (6770cfb)
• nix: Add NixOS flake targets (b9c5bfe)

Fixed

• tooling: Drop breaking labels from pre-v1 release notes (#27) (f202056)
• ci: Publish the site from official releases (#25) (d51068e)
• docs: Patch vulnerable deps, move to pnpm, and add Renovate (#23) (916dd81)
• tooling: Require --board for every build task (#21) (ae93e7b)
• modules: Reboot 10 seconds after a kernel panic (#18) (2cbcafc)
• scripts: Keep healthy RAUC slots confirmed across reboots (#17) (0e81336)
• scripts: Make a failed first provisioning apply recoverable (#16) (70f33a8)
• scripts: Commit staged applies after activation and recover safely (#10) (71406cc)
• scripts: Verify provisioning authorization in the root worker (#9) (4a59c1c)
• scripts: Enforce managed-file and Podman boundaries (#8) (6ca1ba1)
• tests: Add defaults to VM packages (bdc30b4)
• nix: Derive local DNS domain (86aa81a)
• nix: Close fleet bootstrap review gaps (6430032)
• tooling: Bound target validation scope (cbb20d9)
• tests: Scope boot hardware diagnostics (f5a1129)
• modules: Enable kernel function tracing (c941def)
• tooling: Validate all flake systems (cc76413)
• modules: Virtual kernel security diagnostics (b153d01)
• modules: VM security and remote access (f461e29)
• modules: Provide wireless probe path to dispatcher (a63c040)
• tests: Reset first-boot fixture marker (2a2994b)
• tests: Wait for firewall VM interfaces (e3cf894)
• modules: Preserve service D-Bus policies in virtual machines (53a9247)
• docs: Clarify provider migration wording (d1c8227)
• tooling: Exclude migrated documents from lint inputs (fc91961)
• tooling: Align documentation tool versions (ec17a4b)
• docs: Clarify intentional example values (89c9ca2)
• docs: Use semantic headings in image design (c639904)
• scripts: Allow package metadata in TOML lint (a4c8d38)
• nix: Silence wireless probes in virtual checks (12f2956)
• nix: Use simple container grouping in VM test (10c7728)
• modules: Skip hardware diagnostics in virtual images (78afb9b)
• nix: Disable VM clock trimming (95fbd2f)
• modules: Provide conversion data at boot (2cb5815)
• modules: Deduplicate VM service paths (2317d6b)
• modules: Omit unavailable VM kernel setting (d6c46ff)
• modules: Disable unavailable performance counters (2d87a4f)
• docs: Disable false list indentation warnings (ce53fcf)
• modules: Include storage probe in early boot (528eb57)
• modules: Define test time-service identity (010942f)
• modules: Remove duplicate runtime directory rules (5630296)
• nix: Disable the old VM firewall (7c531e0)
• nix: Use fixed strings in VM assertions (66e6e5e)
• nix: Keep VM root settings unambiguous (4b9b1a0)
• nix: Use supported VM boot path (c0e2654)
• nix: Stabilize health regression VM timing (178c5b2)
• modules: Gate boot-count helper to update profiles (de5de10)
• tooling: Preserve build override identity (017ec11)
• modules: Harden staged apply worker with no new privileges (88808a4)
• repo: Close privilege separation gaps (c7565f3)
• repo: Address staged review findings (7edef57)
• repo: Harden staged privilege boundary (ecadc6b)
• scripts: Harden staged job lifecycle (1c7ff08)
• scripts: Preserve staged queue ordering (7d908bb)
• scripts: Escape embedded config script payloads (e9a1580)
• scripts: Support config-only staged bundles (400f4bc)
• modules: Align bootstrap socket lifecycle (2f4d55a)
• repo: Align bootstrap provisioning with socket activation (a1c51e9)
• modules: Accept persisted boot ui terminal markers (a3581b4)
• modules: Tolerate malformed staged control paths (9a95baf)
• modules: Stop staged drain after systemic errors (1867b3b)
• modules: Mark cancelled jobs terminal (36808ac)
• modules: Hide malformed boot ui job routes (3ae3342)
• modules: Bind staged snapshot to verified manifest (8e65b94)
• modules: Finish staged submit work after cancellation (8ebde1c)
• modules: Refresh staged reservations while preparing (30b3167)
• modules: Migrate config read grants on recovery (b2f971b)
• modules: Expose active staged jobs to monitor (abe1e25)
• modules: Discard rejected staged partial jobs (ea1bbff)
• modules: Verify staged source before snapshot copy (fe54af4)
• nix: Update crun ldflags overlay for 26.05 (fdf0eba)
• modules: Derive release codename metadata (7aa5fe2)
• scripts: Harden boot ui closeout edges (187a1fd)
• scripts: Reject unknown partial request keys (7293415)
• workflow: Make implement feature more explicit (a984d0d)
• scripts: Correct provisioning auth header names...