2.1.1

aleph-vm 2.1.1 is 2.1.0 plus one agent fix: after a restart, the agent now rebuilds its registry record for running V-PROGRAMs. Every 2.1.0 node should take it, and a node still on 2.0.x can upgrade straight to 2.1.1.

What 2.1.0 changed

aleph-vm 2.1 extends support for confidential computing, changes how a node takes work and how it gives space back.

• Experimental: V-PROGRAMs can attach NVIDIA GPUs in confidential-computing mode to their SEV-SNP guest.
• The scheduler now hands a node a plan and gets a per-VM verdict at once, with the node converging in the background
• A deleted VM now has its disks reclaimed immediately
• The Intel TDX message schema and quote verifier are in the tree as groundwork
• The Python supervisor daemon is gone, the Rust daemon and controller are now the only implementation.

⚠️ Upgrade notes

• A payment shortfall now purges the VM's volumes under the default VOLUME_RETENTION=reap: a stopped payment means the VM is gone for good. 1.x and 2.0 kept the disks for a later top-up and never reclaimed them. A node that wants to offer a re-paying owner a grace period sets ALEPH_VM_VOLUME_RETENTION=keep before upgrading: retained directories then carry a .reclaimable marker with the owner's address, are capped per pool by VOLUME_RETENTION_BUDGET (10%), and a re-created VM adopts its data. See Reclaiming VM storage. In doubt, set ALEPH_VM_VOLUME_RETENTION=keep in your supervisor.env file before upgrading.
• A VM its owner stopped stays stopped. The allocation loop and a scheduler push no longer restart a VM that was stopped through the operator API or shut down from inside the guest (#1217); it keeps counting against the node's capacity until the owner starts it again through the new POST /control/machine/{ref}/start (#1245), owner-authenticated like stop, or the scheduler drops it from the plan. Tooling that relied on the next push to bring a stopped VM back must call the start route.
• The Python supervisor daemon and VM controller are removed (#1170). ALEPH_VM_SUPERVISOR_IMPL no longer exists; a leftover line in /etc/aleph-vm/supervisor.env is ignored. A node that still ran 2.0.x with ALEPH_VM_SUPERVISOR_IMPL=python switches to the Rust daemon on this upgrade, and its running QEMU and confidential VMs are re-adopted by the new daemon, the same path the 2.0.1 switch used. There is no Python implementation to roll back to any more. Downgrading to 1.x remains unsupported.
• The first storage pass reclaims what older releases leaked. The agent now runs a storage reconciler at startup and every hour (#1155). Its first pass on an upgraded node removes directories on a volume pool that belong to no VM, interrupted downloads, stale staging and session directories, empty mount points and expired backups, then brings each download cache under CACHE_BUDGET (20% of its filesystem by default). Under the default policy it logs a preview of what it is about to remove, as a total and per pool, before removing it; that log explains a large jump in free space right after the upgrade. Running VMs and anything younger than VOLUME_CREATE_GUARD (10 minutes) are never touched.
• Nodes advertise the allocation protocol they speak in /status/config (api.allocations, #1242), and scheduler 0.2.2 pushes v2 plans to nodes that do. A node governed by a v2 plan refuses a legacy POST /control/allocations push with 409 (#1232): a node runs one mode, not both. /control/allocation/notify is unchanged.
• V-PROGRAM publishers: launch measurements moved again. The measured guest image changed (newer LTS kernel from a whitelist configuration, content-only initrd, rebuilt attestation agent, a new GPU flavor), and runtimes are now measured for EPYC-Genoa first with EPYC-v4 as the fallback (#1238). Rebuild runtime bundles and manifests from the 2.1 image outputs, republish them, and repoint V-PROGRAM messages at the new runtime.ref; a client verifying against a measurement recorded for an older bundle will not match a 2.1 launch.
• Confidential NVIDIA GPUs are experimental and Intel TDX is groundwork only. A GPU V-PROGRAM is provisioned and billed but no released client can yet verify the card inside the guest, and nothing has run on CC hardware; see the GPU section for the exact limits. A TDX instance message is refused up front, before any download (#1185); the verifier in the tree has no caller. Neither changes anything for a node without the hardware.
• New package dependency: pciutils. The daemon calls lspci for its GPU inventory and refuses to start without it when ENABLE_GPU_SUPPORT is on; apt install pulls it in. The deb ships aleph-message 1.5 (#1249), which the V-PROGRAM launch path needs: the 2.0.x packages carried 1.3.1 in their bundled site-packages.
• New settings (all ALEPH_VM_-prefixed in supervisor.env, defaults are fine for most nodes): VOLUME_RETENTION, VOLUME_RETENTION_BUDGET, VOLUME_RECONCILE_INTERVAL, VOLUME_CREATE_GUARD, CACHE_BUDGET, UNKNOWN_LENGTH_RESERVE, MAX_RUNTIME_ARCHIVE_SIZE (100 GiB cap on a runtime or base image download), ALLOCATION_RECONCILE_INTERVAL, ALLOCATION_RETRY_BASE_INTERVAL, ALLOCATION_RETRY_MAX_INTERVAL, ALLOCATION_DOWNLOAD_CONCURRENCY. The two budget settings are validated at startup, so a typo fails the agent immediately rather than at the first pass.
• Coming from 1.15: read the 2.0.0 breaking changes first (Firecracker-based instances are not re-adopted, legacy X-Auth-Signature scheduler authentication is removed), then the 2.0.1 notes for the QEMU >= 9.1 requirement on SEV-SNP hosts.

How to upgrade

Download and install the package for your OS. The package restarts aleph-vm-supervisor and aleph-vm-agent itself; no manual restart is needed. Running QEMU and confidential VMs are re-adopted automatically.

On Ubuntu 26.04 (Resolute Raccoon), recommended for SEV-SNP hosts:

sudo rm -f /opt/aleph-vm.ubuntu-26.04.deb
sudo wget -P /opt https://github.com/aleph-im/aleph-vm/releases/download/2.1.1/aleph-vm.ubuntu-26.04.deb
sudo apt install /opt/aleph-vm.ubuntu-26.04.deb

On Debian 13 (Trixie):

rm -f /opt/aleph-vm.debian-13.deb
wget -P /opt https://github.com/aleph-im/aleph-vm/releases/download/2.1.1/aleph-vm.debian-13.deb
apt install /opt/aleph-vm.debian-13.deb

On Debian 12 (Bookworm):

rm -f /opt/aleph-vm.debian-12.deb
wget -P /opt https://github.com/aleph-im/aleph-vm/releases/download/2.1.1/aleph-vm.debian-12.deb
apt install /opt/aleph-vm.debian-12.deb

On Ubuntu 24.04 (Noble Numbat):

sudo rm -f /opt/aleph-vm.ubuntu-24.04.deb
sudo wget -P /opt https://github.com/aleph-im/aleph-vm/releases/download/2.1.1/aleph-vm.ubuntu-24.04.deb
sudo apt install /opt/aleph-vm.ubuntu-24.04.deb

On Ubuntu 22.04 (Jammy Jellyfish):

sudo rm -f /opt/aleph-vm.ubuntu-22.04.deb
sudo wget -P /opt https://github.com/aleph-im/aleph-vm/releases/download/2.1.1/aleph-vm.ubuntu-22.04.deb
sudo apt install /opt/aleph-vm.ubuntu-22.04.deb

The crn_upgrade.sh helper now recognises Ubuntu 26.04 but still not Debian 13; use the commands above there.

Verify

systemctl is-active aleph-vm-supervisor aleph-vm-agent
curl -s http://localhost:4020/status/config | jq '.api'        # {"allocations": 2}

The first storage pass logs what it reclaimed; the same figures are available on demand, without stopping anything:

journalctl -u aleph-vm-agent --since '15 minutes ago' | grep -i reclaim
sudo PYTHONPATH=/opt/aleph-vm python3 -m aleph.vm.agent storage status

📡 Scheduler allocations v2

The legacy POST /control/allocations answered only once every VM in the push was created, which made a large push slow and a partly failing one opaque. Two new scheduler-only endpoints, authenticated the same way (Aleph-EIP191-V1), answer immediately and converge in the background. Operator documentation: Scheduler allocations (v2).

• POST /v2/control/allocations takes a plan and answers 202 with every hash sorted into accepted, pending, unchanged, removing, rejected (with a machine code) or retained (with the reason an allocation may not stop it) (#1172, #1202, #1237). A refused hash is never torn down by its own push (#1209); only a hash the plan never named is treated as taken away.
• POST /v2/control/capacity/check judges the same body with no side effects, so a scheduler can ask several nodes before committing to one (#1159).
• Messages embedded in the plan are verified locally (signature and item hash) so the node can size a VM without fetching anything; an entry the node cannot verify degrades to the fetch path (#1158).
• A background reconciler converges the node on the plan: bounded-parallel downloads outside the supervisor's creation lock, exponential retry with backoff, and one create at a time per VM so two pushes cannot build the same VM and have the second's failure delete the first's work (#1173, #1222, #1234).
• A crashed guest is rebuilt out of its own reservation, not re-admitted against today's headroom, and a crash loop backs off instead of rebuilding at boot speed (#1214, #1239). A VM that died across a daemon restart is reported failed and rebuilt rather than stranded stopped forever (#1233, #1246).
• GET /v2/about/executions/list reports the supervisor's state and the agent's allocation phase as two disjoint fields, with a closed set of failure codes and no exception text on the public surface (#1203, #1229). A push is told the truth about a VM whose teardown is still running (#1225).
• The plan is held in memory only: after an agent restart the node has no plan and deletes nothing until the scheduler's next push.

💾 Storage reclamation

Before 2.1 nothing on a node gave disk space back. Operator documentation: Reclaiming VM storage.

• One retire path with a reason (recreate, gone, erase, failed create) decides what happens to a VM's volumes; only a VM that is gone for good (message forgotten, payment stopped, deallocated, migrated away) has them reclaimed, under VOLUME_RETENTION=reap|keep with a per-pool budget for retained data (#1155, #1216).
• VMs are admitted against disk, memory and vCPUs from their message before anything is downloaded, and retained space counts as free (#1156, #1211).
• Loop and device-mapper devices are torn down when a VM is retired, and orphaned ones when nothing owns them (#1160).
• Download caches are bounded: LRU eviction under CACHE_BUDGET, pre-write admission, a reserve for downloads without a Content-Length, and a 100 GiB cap on a runtime or base image (#1161).
• aleph-vm storage status | list | reclaim | reconcile inspects and drives reclamation by hand, without a running agent, and refuses to purge behind one (#1162, #1210, #1215, #1224). status and list are read-only in the literal sense: they create no database, no directory and adopt no pool.
• Namespace names are validated with ItemHash's rules before any delete (#1206), and a pool whose size or free space cannot be read is skipped rather than mistaken for a full or empty one (#1219).

🎛 Confidential NVIDIA GPUs for V-PROGRAMs (experimental)

A CRN with an NVIDIA card in confidential-computing (CC) mode can attach it to a V-PROGRAM's SEV-SNP guest, so the model weights and the inference run inside the same attested boundary. The whole host and guest chain is in this release; the client half is not, which is why the feature is labelled experimental below. Operator runbook: Operating confidential GPUs; trust model: Confidential computing, "Confidential GPUs".

What a CRN needs. An NVIDIA RTX PRO 6000 Blackwell Server Edition (the Workstation and Max-Q editions have no CC mode) on an EPYC Genoa or newer host that already launches SEV-SNP guests; IOMMU, above-4G decoding and resizable BAR enabled in the BIOS; the card bound to vfio-pci at boot with no NVIDIA driver on the host; CC mode switched on once with NVIDIA's gpu-admin-tools (it persists across reboots); and ENABLE_GPU_SUPPORT=true in supervisor.env. Nothing else changes for a node without such a card.

How a workload asks for one. A V-PROGRAM message declares gpu: {vendor: nvidia, arch: blackwell, count: 1, mode: cc} on its content (aleph-message 1.5, aleph-rs #397); the generic requirements.gpu block is refused on V-PROGRAMs, since a confidential card is not the same resource as a pass-through one (#1200). The runtime's manifest must declare a matching gpu block and the guest needs at least 2 GiB of memory for the bounce buffers.

Host side.

• CC mode is probed from the card's BAR0 register, with no driver on the host, and cards in mode on are advertised as tee.nvidia_cc.devices on /about/capability and /about/usage/system, only alongside a working SNP launch capability (#1197). A card in NVIDIA's devtools mode is a valid mode for driver work but lifts the confidentiality guarantees, so it is never advertised or attached. The probe resumes a suspended card first and caches its answer (#1218); the mode is read from hardware again at every create and start, never from the cache, so a stale on never hands a guest a card it cannot trust (#1240).
• The card is passed into the SEV-SNP guest through a BAR-sized 64-bit MMIO window delivered by firmware configuration, which is not a measurement input, so attaching a card does not move the launch measurement (#1198, #1227). The swiotlb size the guest needs is part of the measured command line instead, through a sidecar with a closed allowlist.
• The agent resolves cards by family and count and refuses a manifest whose gpu block disagrees with the message (#1200, #1241). The LUKS-encrypted SNP instance arm refuses GPUs outright: a card never rides on an opaque command line.
• Scheduler 0.2.2 places GPU V-PROGRAMs on nodes advertising enough cards of the requested family (scheduler #210).

Guest side.

• gpuImage, a runtime flavor with fail-closed GPU verification at boot (#1199): the NVIDIA open kernel modules, the driver userland, GSP firmware and NVIDIA's local attestation verifier, all built offline under Nix with their own golden launch measurement checked in CI. At boot the init loads the driver, runs NVIDIA's attestation against the card's RIM and OCSP services, requires every measurement to pass and the card's ready state to read back, and powers the VM off on any failure.
• GPU evidence is served over the attested channel by the in-guest attest agent at /.well-known/attestation/gpu, bound to a nonce derived from the served TLS key so it cannot be replayed from another guest (#1196). The route holds its lock inside the collection, so a client disconnect no longer releases the guard while the collector is still running (#1221).

Why experimental, and what is not in this release.

• No client verifies the GPU yet. The aleph-rs SDK and the aleph CLI verify the SNP report and the TLS binding, then stop: they do not fetch or check the GPU evidence, do not compare the reported card or driver with the manifest, and their manifest parser drops the gpu block. A gpuImage guest that boots with no card attached carries the same launch measurement as one with a verified card, so a successful aleph vprogram call is not evidence of a confidential GPU. Until the verifier lands in aleph-rs, the guarantee holds against everyone except the CRN operator.
• Nothing has run on CC hardware yet. Everything up to the QEMU command line is covered by unit tests and conformance fixtures, and the gpuImage boots under QEMU in CI without a card; the driver load, the NVIDIA attestation flow and the ready-state handshake are unexercised outside those.
• One card per VM. The schema and the scheduler accept a count up to eight, but the supervisor refuses a spec with more than one card until a multi-card guest has been exercised; such a message is placed, then refused at create time.
• Confidential cards are not held by /control/reserve_resources and the capability advertisement is not hold-aware, so two requests racing for the same card are both admitted by simulation and the loser is refused at create.
• The network has to catch up before a GPU V-PROGRAM can be published. The gpu block is aleph-message 1.5; pyaleph 0.11.2 validates against 1.3.1 and rejects such a message as schema-invalid, and only the Rust SDK and aleph CLI can build one today (the Python SDK accepts it through aleph-message 1.5, its helper has no gpu parameter yet; the TypeScript SDK has no gpu field on V-PROGRAM content).

🔷 Intel TDX groundwork

2.1 lands the protocol seams and the verification library for Intel TDX, so they are fixed before they become expensive to change. It is not a launch path: no CRN can run a TDX guest and no client can verify one. SEV-SNP remains the only measured confidential mode a node can launch.

• Message schema (aleph-message 1.5, aleph-rs types): an instance can declare mode: "tdx" with a {mrtd, rtmr1, rtmr2, mrconfigid} register set. rtmr0 and rtmr3 are deliberately absent from the pinnable set (firmware-owned and launch-TCB respectively), policy must stay at its default in TDX mode, and measured modes are credit-only, as SNP already is. The registers field is discriminated on the platform, so an SNP register set on a TDX message is a schema error, not a silent mismatch.
• A from-scratch DCAP quote verifier in aleph-tee (#1186, #1194, #1195, #1207, #1212), with no third-party verifier in the trust path: quote versions 4 and 5 (TD report 1.0 and 1.5); the PCK certificate chain pinned byte-exact to Intel's SGX Provisioning Root CA, with CRL checks on both levels; the quoting-enclave report signature and its binding to the attestation key; Intel-signed TCB Info and QE Identity appraised through their SVN ladders, including the second TCB vector a 1.5 report carries; the TD-debuggable and SEAM-module identity gates; and an acceptance policy that admits UpToDate and SWHardeningNeeded by default, carries an advisory denylist, and can never be told to accept Revoked. The clock is a parameter and the verifier never touches the network. It is tested against three genuine production quotes and two complete Intel-signed collateral sets, not synthetic ones.
• A node refuses a TDX instance message before any download (#1185): tdx instances are not supported by this CRN, answered as a failed allocation, and no node advertises TDX in its capability block.
• Still to build for a launch path, in rough order: the guest-side TdxBackend (ConfigFS-TSM quote request), a reproducible TDVF firmware build, a TDX guest runtime with its own golden measurement, the MRCONFIGID deployment binding and its QEMU plumbing, the controller's argv builder, a host probe that requires both KVM TDX and a reachable quote-generation service, the client-side verifier and collateral fetcher in aleph-rs, and the tee_min_tcb floor in the settings aggregate. None of it is started, and the daemon's tdx_supported field stays false on every host.

🔐 SEV-SNP

• The SNP instance unlock authority is bound to the message sender (#1190).
• A reboot recreates the SNP per-tap DHCP server with an empty lease database (#1201).
• aleph_insecure_unattested=1, a guest image cmdline token that boots the V-PROGRAM image without a TEE and serves the attest agent over plain HTTP (#1188). It is the guest half of a local development mode; the CLI half (aleph vprogram run) has not landed, so there is no developer-facing "run locally" workflow yet. The token cannot be set by a message or a node setting, and no client verb accepts an unattested endpoint.
• Runtimes are measured for EPYC-Genoa first, EPYC-v4 as fallback (#1238), and the example confidential image keeps its encrypted root readable by the OVMF's GRUB (#1204).

🦀 Supervisor daemon

• The Python supervisor daemon is removed (#1170); the deb's units exec the Rust binaries directly and the launcher scripts are gone. The Python tree the deb ships is the agent and the gRPC client it dials the daemon with.
• A guest that died on its own is reported FAILED, not STOPPED (#1233), and adoption after a daemon restart tells a failed unit from an inactive one (#1246).
• Typed GPU probe errors and deduplicated device walks (#1236).

🐛 Fixes

• A log viewer hanging up mid-stream is the end of the stream, not a 500 with a traceback (#1251).
• Convergence reconciles no longer converge on the SSH-only port-forward fallback when the manifest cannot be read (#1191).
• The deb ships the aleph-message release the code is written against, with a test that fails on any drift between pyproject.toml and the packaging pin (#1249).
• Unused Python dependencies pruned from the deb and CI package lists (#1208).
• The runtime build scripts fall back to the umu.se mirror hosts when cloud.debian.org's redirect target is broken (#1251).

📚 Documentation and internals

• Operator documentation for storage reclamation, scheduler allocations v2 and confidential GPUs, linked from the README (#1230); architecture docs updated for the Python supervisor removal (#1228); plan documents dropped from the tree (#1205).
• The 2.1 series' comments trimmed to the reason they carry (#1244), duplicated code and test doubles consolidated (#1247, #1248), storage hooks installed as one object (#1235), storage CLI on the reconciler's API names (#1243), TEE crate sharing its ECDSA and validity helpers (#1220).
• CI triggers on any dev* branch (#1174).

What's Changed

• fix(agent): parse V-PROGRAM contents when rebuilding the registry by @odesenfans in #1261
• fix(daemon): reboot recreates the SNP per-tap DHCP server with an empty lease db by @odesenfans in #1201
• feat(nix): aleph_insecure_unattested=1 mode with a plain-HTTP attest agent by @odesenfans in #1188
• feat(agent): bind SNP instance unlock authority to the message sender by @odesenfans in #1190
• fix(agent): convergence reconciles must not converge on the SSH-only fallback by @odesenfans in #1191
• fix(vprogram): measure runtimes for EPYC-Genoa first, EPYC-v4 as fallback by @odesenfans in #1238
• ci: trigger on any dev* branch, not a single hardcoded name by @odesenfans in #1174
• refactor(supervisor)!: remove the Python supervisor daemon by @odesenfans in #1170
• feat(agent): aleph-message 1.4.0, reject TDX instances before any I/O by @odesenfans in #1185
• feat(tee): TDX quote parsing, versions 4 and 5 by @odesenfans in #1186
• feat(tee): TDX certificate-chain and signature verification by @odesenfans in #1194
• refactor(agent): extract the allocation teardown and its removability rule by @odesenfans in #1157
• feat(agent): verify messages the scheduler embeds in a plan by @odesenfans in #1158
• feat(agent): batch, release-aware capacity simulation by @odesenfans in #1159
• feat(agent)!: one retire path with a reason, volume retention and a storage reconciler by @odesenfans in #1155
• feat(agent): admit disk, memory and vCPUs from the message before allocating by @odesenfans in #1156
• feat(agent): tear down loop and device-mapper devices when a VM is retired by @odesenfans in #1160
• feat(tee): TDX TCB appraisal, platform gates and acceptance policy by @odesenfans in #1195
• feat(agent): build a plan from a push and answer it immediately by @odesenfans in #1172
• feat(agent): bounded download caches with LRU eviction and pre-write admission by @odesenfans in #1161
• feat(attest-agent): GPU evidence route, nonce-bound NVIDIA CC evidence over the attested channel by @odesenfans in #1196
• feat(cli): aleph-vm storage status, list, reclaim and reconcile (2.1, PR E) by @odesenfans in #1162
• feat(agent): background reconciler for scheduler allocations by @odesenfans in #1173
• feat(daemon): probe NVIDIA CC mode from BAR0 and advertise CC-mode cards as tee.nvidia_cc by @odesenfans in #1197
• feat(agent): the v2 allocation endpoints, answering now and converging later by @odesenfans in #1202
• feat(daemon,controller): pass a confidential GPU into an SEV-SNP guest through a BAR-sized MMIO window by @odesenfans in #1198
• fix(examples): keep the confidential image's encrypted root readable by the OVMF's GRUB by @odesenfans in #1204
• feat(agent): report allocation state in the v2 executions list by @odesenfans in #1203
• feat(nix): gpuImage, the confidential-GPU runtime flavor with fail-closed GPU verification at boot by @odesenfans in #1199
• feat(agent,vprogram): confidential GPUs for V-PROGRAMs, resolved by family and count by @odesenfans in #1200
• docs: drop plan documents from the tree by @odesenfans in #1205
• fix(agent): validate a namespace with ItemHash's rules before any delete by @odesenfans in #1206
• fix(tee): appraise the TD report 1.5 second TCB vector by @odesenfans in #1207
• chore: prune unused Python deps, fix deb and CI package lists by @odesenfans in #1208
• fix(cli): give aleph-vm storage its config, logs and database by @odesenfans in #1210
• fix(agent): keep a refused VM out of the reconciler's teardown set by @odesenfans in #1209
• fix(agent): hold a reserve, not the whole budget, for an unmeasured download by @odesenfans in #1211
• test(tee): pin the TDX acceptance policy against real Intel collateral by @odesenfans in #1212
• fix(agent): drop a retired VM from the live set the retire forgets it by @odesenfans in #1213
• fix(agent): back off when a guest crash-loops after it reached RUNNING by @odesenfans in #1214
• fix(cli): keep aleph-vm storage from purging behind a running agent by @odesenfans in #1215
• docs: fix architecture docs left stale by the Python supervisor removal by @odesenfans in #1228
• refactor(tee): share the ECDSA and validity helpers, keep openssl out of the API by @odesenfans in #1220
• fix(agent): put the retained marker back when a create does not commit by @odesenfans in #1216
• fix(cli): make aleph-vm storage status and list truly read-only by @odesenfans in #1224
• fix(agent): leave a VM its owner stopped alone; a push acknowledges it, never restarts it by @odesenfans in #1217
• fix(daemon): resume a suspended GPU before the CC probe and cache the answer by @odesenfans in #1218
• fix(agent): serialise the starts of one VM so one does not delete the other by @odesenfans in #1222
• fix(agent): skip a pool whose size or free space cannot be read by @odesenfans in #1219
• fix(agent): hold the GPU lock inside the collection, not in the handler by @odesenfans in #1221
• fix(daemon): cap a confidential VM at one GPU and name the card it refuses by @odesenfans in #1223
• fix(agent): tell a push the truth about a VM whose teardown is running by @odesenfans in #1225
• refactor(agent): storage code quality: enums, shared helpers, honest comments by @odesenfans in #1231
• fix(daemon): bound the GPU MMIO window sizing and its address budget by @odesenfans in #1227
• fix(agent): publish a failure code, not the exception, on the public list by @odesenfans in #1229
• docs: operator documentation for what 2.1 adds by @odesenfans in #1230
• fix(agent): refuse a v1 allocation push once a plan governs the node by @odesenfans in #1232
• refactor(agent): install the storage hooks as one object, not three globals by @odesenfans in #1235
• feat(agent): attach as many confidential GPUs as the V-PROGRAM names by @odesenfans in #1241
• refactor(agent): point the storage CLI at the reconciler's API names by @odesenfans in #1243
• fix(daemon): report a guest that died on its own as FAILED by @odesenfans in #1233
• fix(agent): verify a plan's entries in a worker thread, not on the loop by @odesenfans in #1234
• refactor(daemon): typed GPU probe errors, deduped walks, and comments that state their reason by @odesenfans in #1236
• refactor(agent): one refusal type, one retention rule, and the allocation dead surface by @odesenfans in #1237
• feat(agent): advertise the allocation protocol version in /status/config by @odesenfans in #1242
• fix(agent): rebuild a crashed VM without re-admitting it against today's headroom by @odesenfans in #1239
• fix(daemon): read a confidential VM's cards again before starting it by @odesenfans in #1240
• docs: trim the 2.1 series' comments to the reason they carry by @odesenfans in #1244
• feat(agent): give the owner a route to start a VM they stopped by @odesenfans in #1245
• fix(packaging): ship the aleph-message the code is written against by @odesenfans in #1249
• test: prove each 2.1 rule once, and share the test doubles the series retyped by @odesenfans in #1248
• fix(daemon): adopt a VM whose unit failed as a death, not as a stop by @odesenfans in #1246
• refactor: code duplication by @odesenfans in #1247
• fix(agent): a log viewer hanging up is the end of the stream, not a 500 by @odesenfans in #1251

Full Changelog: 2.0.2...2.1.1

What's Changed

• fix(daemon): reboot recreates the SNP per-tap DHCP server with an empty lease db by @odesenfans in #1201
• feat(nix): aleph_insecure_unattested=1 mode with a plain-HTTP attest agent by @odesenfans in #1188
• feat(agent): bind SNP instance unlock authority to the message sender by @odesenfans in #1190
• fix(agent): convergence reconciles must not converge on the SSH-only fallback by @odesenfans in #1191
• fix(vprogram): measure runtimes for EPYC-Genoa first, EPYC-v4 as fallback by @odesenfans in #1238
• fix(agent): a log viewer hanging up is the end of the stream, not a 500 by @odesenfans in #1251
• docs: point the install instructions at the 2.1.0 release by @odesenfans in #1252
• fix(agent): retire a VM for payment only after consecutive sweeps agree by @odesenfans in #1253
• fix(agent): the migration reaper only deletes export files by @odesenfans in #1254
• fix(agent): refuse at admission what the node's settings rule out by @odesenfans in #1255

Full Changelog: 2.0.2...2.1.1

What's Changed

• fix(agent): parse V-PROGRAM contents when rebuilding the registry by @odesenfans in #1261

Full Changelog: 2.1.0...2.1.1