WasmKeep v0.2.0

The installable release. With 0.1.0 the SDKs were used from a clone of
the repository; from this release each comes from where its language
expects it, and trying WasmKeep needs no toolchain. Still a pre-alpha
pre-release: for trying WasmKeep, side projects and staging, not
production. The interface between an actor and the host is unchanged
(wasmkeep:actor@0.2.0, a version of its own), so a component built for
0.1.0 runs as it is. See the roadmap for what comes next.

What is new

• The SDKs install from their registries, each at the server's
  version, 0.2.0:

  Language	Install	Then
  Rust	cargo add wasmkeep-sdk	crate, tutorial
  TypeScript	npm install @wasmkeep/sdk	npx wasmkeep-ts build (package)
  Python	pip install wasmkeep	python -m wasmkeep build, new in this release (package)
  Go (TinyGo)	go get github.com/wasmkeep/wasmkeep/sdks/go@v0.2.0	module
  C, Zig	wasmkeep-c-sdk-0.2.0.tar.gz and wasmkeep-zig-sdk-0.2.0.tar.gz, attached to this release	C, Zig

  The crate, the npm package and the wheel are published from this
  release's tag once a maintainer approves each, so a registry can be a
  little behind this page. The server and every SDK carry one version;
  use an SDK with the server of the same version
  (versions).

• Prebuilt components: the release carries counter.wasm, kv.wasm,
  queue.wasm, workflows-orders.wasm and workflows-ledger.wasm, built
  from the examples and signed like its other files. The
  quickstart is now a download and one command,
  and the callers of the key-value, queue and
  workflow classes in other
  languages need no Rust toolchain. The notices of the libraries compiled
  into them are in THIRD_PARTY_NOTICES-components.txt. The binary's
  tarball has a short README of its own.

• The C and Zig SDKs as archives, signed like the other files: each
  SDK with the C bindings already generated, the WIT and the componentize
  script, and a README whose build command works in the extracted
  directory, without a clone or wit-bindgen. WASMKEEP_SDK_VERSION (C)
  and wk.version (Zig) carry the version.

• A durable write on a cluster node is no longer synced to the local
  disk as well as uploaded. exec-durable answers once the bucket holds
  the write, as it was documented to: one disk sync less on every durable
  write. The bucket is the only durable copy of such a write, and a node
  trusts a local file again only after checking it against the bucket. For
  whoever runs a cluster: start a node again on the same bucket and
  prefix, since after a crash or a power loss its local files may lack
  writes the bucket has (replication). A
  node without a bucket still syncs to its disk.

• Languages: Go through TinyGo moves from experimental to supported,
  with a full Go SDK and its counter, chat room and jobs app. D
  and MoonBit are experimental, each with an SDK, a counter and a chat
  room; a C# counter (componentize-dotnet) and a standard-Go counter
  (componentize-go) pass the shared tests.
  Tiers and numbers.

• Compared with celld: the same counter on one node and on three, a
  node killed under writes, with a check for lost writes that gives every
  write a token of its own, repeats the takeovers with the killed node's
  disk removed, and includes a run that must lose writes
  (WasmKeep and celld,
  benchmarks).

• How releases are made: a tag's release waits for CI to pass on the
  tagged commit (0.1.0 was tagged before its run had finished), and a
  version's image tag is written once. Publishing the release publishes
  the SDKs to crates.io, npm and PyPI from its tag, without stored tokens,
  each after a maintainer's approval (releasing).

Upgrading from 0.1.0

• Upgrade every node of a cluster together, as before
  (upgrading). The formats in the
  bucket and the command line are unchanged.
• Components built for 0.1.0 need no rebuild. To move an actor's source
  to a published SDK, replace the path into a clone with the registry's
  package at 0.2.0.
• The Go module's v0.1.0 has only the key-value, queue and workflow
  clients; the wasmkeep package (hooks, storage, alarms) starts at
  v0.2.0.

Known limits

The limits listed for 0.1.0 still hold:

• Not production-ready: soaked against Cloudflare R2 and OVHcloud Object
  Storage with nodes killed under load, nothing lost, but not yet carrying
  real users' traffic, and not run against AWS S3
  (measured).
• Nodes of different versions are not supported in one cluster; one
  tenant per process (security); no
  independent third-party security audit yet
  (security).
• Binaries are for Linux; on macOS and Windows, use the image or build
  from source. The Zig SDK is an archive, not yet a package zig fetch
  resolves; D and MoonBit are used from the source.

Install and verify

Install downloads a binary or runs the image.
Single node shows the
cosign check, the same for every file of the release;
Compose checks the image.