v1.7.0

Two opt-in features and a forward-only schema bump. The binary arrives behaviour-neutral: both features are default-off, so an upgrade changes nothing until the flags are set fleet-wide.

Schema

v50 → v51, forward-only. Upgrade every host in one lv host upgrade invocation — it pre-stages the schema cluster-wide before rolling any node. A binary downgrade onto a migrated database will refuse to start, by design.

NetBox as external IPAM (opt-in: netbox.enabled)

A litevirt network can be bound to a NetBox prefix (lv network create --netbox-prefix-id). VM NIC addresses are then claimed from and released to NetBox under a per-incarnation identity, instead of from the builtin allocator. An orphan sweep reclaims addresses nothing references, gated on whole-cluster proof that no host still claims them.

An inventory mirror is a second, narrower opt-in (netbox.mirror_inventory): with it off, NetBox holds addresses carrying this cluster's identity and nothing else.

Both are gated on capability latches (netbox_ipam_v1, netbox_mirror_v1) advertised only while the corresponding flag is on, so a latch requires config uniformity rather than merely a uniform build.

lv cutover as one guarded transition (opt-in: enforcement.vm_replace)

Giving a replacement VM the name a replaced VM still holds used to fail — destructively — whenever the replaced VM actually existed: its tombstone still occupies the primary key, and the rename ran after the original's disks and firmware were already gone.

It is now a single guarded transition that a receiver applies whole or not at all, carrying the replacement's incarnation and authority above both inputs. The destruction that has to follow it is driven from a journaled, immutable manifest whose authorizing step is committed in the same batch as the transition, so a crash anywhere leaves the operation resumable rather than half-applied. Addresses move with the transition and the replaced VM's own are released afterwards, ownership-checked on both the local row and the external object.

A running replacement is briefly interrupted — libvirt cannot rename a live domain — and the CLI says so before it starts.

Requires enforcement.operation_protocol alongside enforcement.vm_replace; lv cutover refuses until both have latched, before stopping a domain or writing to either VM.

Upgrading

lv host upgrade --binary <path to v1.7.0> -y

Run it with every host. Features stay off until you set the flags on every node and the latches form; see docs/configuration.md and docs/diagnostics.md.

v1.6.2

What's Changed

• ci: make the release step idempotent so a pre-existing tag does not fail it by @colonelpanik in #147
• fix(lxc): parse cgroup2-native limit forms, not just our own emission by @livingstaccato in #144
• Fix three verified doc-vs-code mismatches in a single docs-only chang... by @colonelpanik in #153
• Extract the repeated dnsmasq pidfile path literals in internal/networ... by @colonelpanik in #148
• Replace the duplicated withinDir path-containment helpers in internal... by @colonelpanik in #149
• Fix internal/corrosion/vms.go's scanVMRow (used by ListVMs/ListVMsPag... by @colonelpanik in #150
• Implement Fake.FireEvent(domainName string, event libvirt.DomainEvent... by @colonelpanik in #151
• Export a NotFound-classifying helper from internal/libvirt (generaliz... by @colonelpanik in #152
• Replace the seven duplicated 8-byte-hex random ID generators (interna... by @colonelpanik in #154
• fix(health): a pre-epoch newborn VM is not an owner-epoch violation by @livingstaccato in #145
• fix(deps): bump modernc.org/sqlite to v1.58.0 to stop a WAL checkpoint stall by @colonelpanik in #159

Full Changelog: v1.6.1...v1.6.2

v1.6.1 — host certificate rotation no longer locks a cluster out of itself

Schema v50, unchanged from v1.6.0. No migration.

Fixes

• A reissued host certificate left the serial recorded in its host row
  stale, and peer trust binds a live row to that serial. Nothing wrote the
  column on rotation, so every daemon refused every peer ("replication RPC
  requires peer mTLS") and replication stopped cluster-wide, with the
  split-brain detector blind for the same reason while workloads kept
  running. A node now re-records its own serial at startup from the
  certificate installed on its own disk, so a rotation converges by
  ordinary replication.
• An unreadable certificate never overwrites a good recorded serial: a
  local file-permission problem must not become a cluster-wide trust
  downgrade.

Added

• auth.trust_rotated_peer_certs (default false) — the recovery switch for
  a cluster ALREADY locked out by stale recorded serials, where the
  correction cannot replicate because replication is what is refused. Set
  it on every node, let the re-recorded serials replicate, then set it
  back to false. It relaxes the serial comparison only: a removed host
  stays removed, and a distributable client certificate still cannot act
  as a peer. Revocation is unaffected — the CRL is verified at the TLS
  handshake.

Upgrading

• Schema-neutral, so this rolls like any ordinary binary upgrade. Running
  domains survive the daemon re-exec. Clusters whose recorded serials are
  already stale need the recovery switch on for one roll, then off.

v1.6.0 — capacity admission, reservation-safe integration, unified cluster health

Schema v42 → v50. Forward-only: there is no downgrade path once a node has
migrated.

Capacity and quota

• Host capacity, project quota and explicit overcommit are now decided by a
  serialized reserve-then-verify admission carrying a commit fence, rather than
  read-only checks that could not see a concurrent request's in-flight claim.
• Host CPU/memory overcommit ratios and explicit reserves; container memory
  counts toward host capacity; storage-pool free space is admitted.
• Explicit overcommit is gated behind its own authorization verb.
• Project quota covers all four bounded dimensions — vCPU, memory, disk and
  NICs — on every path that lands a workload: create, clone, restore and
  import, for VMs and containers alike.
• One bytes-to-GiB rule for disk everywhere it is measured, so a charge made at
  admission is a number the accounting can observe as paid.

Cluster health

• The fragmented health APIs are replaced by one durable model.

Platform

• OTLP logging and distributed tracing.
• Darwin client builds and Homebrew packaging.
• Explicit, documented multi-homed host advertisement.

Correctness

• A host-less container operation whose name matches containers on more than
  one host is refused, naming the candidates, instead of acting on whichever
  matched first.

Upgrading

• Run the host upgrade with ALL hosts named, so the schema pre-stages
  cluster-wide before any node rolls. Upgrading a single node against older
  peers strands the majority on a schema it cannot accept.
• Running domains survive the daemon re-exec.

v1.5.2

What's Changed

• feat(ui): set a static IP + pick a network when creating a VM by @colonelpanik in #124

Full Changelog: v1.5.1...v1.5.2

v1.5.1

What's Changed

• feat(ui): VM hardware tab UX rework — modal add flows, scan-populated PCI picker, disk resize by @colonelpanik in #123

Full Changelog: v1.5.0...v1.5.1

v1.5.0

What's Changed

• feat: VM hardware foundation (hardware_v2, default-off) by @colonelpanik in #122

Full Changelog: v1.4.3...v1.5.0

v1.4.3

What's Changed

• fix(ui): attach htmx event listeners to document, not document.body (bulk-select auto-deselect) by @colonelpanik in #121

Full Changelog: v1.4.2...v1.4.3

v1.4.2

What's Changed

• fix(corrosion): order-invariant equality short-circuit in resolveTie (tie-tracker false positives) by @colonelpanik in #120

Full Changelog: v1.4.1...v1.4.2

v1.4.1

What's Changed

• fix(corrosion): apply replicated INSERTs to tables without an updated_at column by @colonelpanik in #119

Full Changelog: v1.4.0...v1.4.1