v0.11.0

To install or upgrade, see Releases and upgrades.

Upgrade notes

• Idle sessions from 0.10.0 lose their running processes on resume. The swap drive of a
  guest is now a chunked NBD disk, and each snapshot contains it. A memory snapshot from
  0.10.0 has no swap manifest, so 0.11.0 does not restore it. An Idle session with such a
  snapshot resumes by a disk-only cold boot: its files stay, its running processes stop, and
  the session shows a "resumed from disk" marker. You do not have to migrate data.
  (#1601, #1603, #1613)
• You cannot roll back to 0.10.0. Coordinator migration 0124 removes a column that 0.10.0
  reads. Back up the coordinator and orchestrator databases before you upgrade.
• Upgrade the coordinator and all hosts together. The host wire version changes from 28
  to 37, and the coordinator accepts only an exact match. During the roll, the coordinator
  does not place sessions on old hosts, so sessions wait for upgraded hosts.
• Recreate the host nodes. In the engram-host-fleet chart, the defaults of
  nbd.nbdsMax and nbd.warmSlots change from 64 to 128, because a guest with swap uses two
  NBD devices. The kernel reads nbds_max only when it loads the module, so the new value
  applies only to new nodes. If you set these values, set them to two times the number of
  guests on a node, or more. (#1607)
• Upgrade the host-fleet operator when no scale-down wave runs. The operator now marks a
  victim node with the annotation fleet.engram.io/victim and does not read the old
  scaledown-victim annotation. (#1588)
• operator.scaler must be noop, gke, or asg. An unknown value now stops the
  operator at startup. A gke or asg scaler that cannot start also stops the operator; in
  0.10.0 it changed to a no-op scaler that continued to cordon and delete hosts. noop now
  only calculates and logs plans. (#1583)
• Remove these chart values. They have no effect now:
  • firecracker.freshRestoreMode (engram-host-fleet): a fresh create always restores from
    the image memory file. (#1596)
  • operator.autoscaling.maxConcurrentDrains (engram-host-fleet): maxShedPerWave is the
    only limit. (#1588)
  • orchestrator.killSwitches (engram): the legacy Slack thread engine is gone. (#1575)
• Stored model selections change to model families. Orchestrator migrations 0095 and
  0096 change the model ids in profiles, tasks, and automation session blocks to family ids.
  Claude: opus (default), fable, sonnet, haiku. Codex: sol (default), astra,
  luna. If you set a model id in a script or an API call, use a family id. (#1608)
• API changes. On the coordinator, TeleportSession replaces EvacuateSession, and the
  SnapshotWait RPC is gone. On the orchestrator, ReviewService no longer has
  ListEnrollments, UpsertEnrollment, or DeleteEnrollment; the repos input of the PR
  review automation controls enrollment. The ENGRAM_LIVE_TELEPORT and
  ORCHESTRATOR_SLACK_AUTOMATION_DISABLED environment variables are gone.
  (#1591, #1599, #1574, #1575)
• The Terraform modules did not change.

Added

• Durable session teleport. TeleportSession moves a session to a different host. A state
  machine in Postgres controls the move, so a coordinator restart does not stop it.
  RetireHost moves the sessions off a host and gives a retirement grant only when the host
  is empty. The operator removes a node only after the coordinator gives the grant.
  (#1582, #1585, #1588, #1590, #1591)
• Harness continuity across a move. The harness sequences its events, and the host
  acknowledges an event only after the coordinator stores it. A harness that continues after
  a snapshot attaches again at the new binding generation and finishes its run.
  (#1586, #1587, #1589)
• Live moves of guests with swap. Post-copy now moves the swap disk too. (#1605)
• Faster post-copy. A demand fault fetches a window of chunks (ENGRAM_UFFD_FAULT_AROUND,
  default 8). Each post-copy source sends a hot set from the kernel idle-page bits, so the
  destination fetches the pages that the guest uses first. (#1611, #1612)
• NBD slots in placement. Hosts report their NBD slots, and placement does not put a
  session on a host that has too few. (#1607)
• Retention policy. Admins set how long to keep run details (7 to 365 days, default 30) in
  Settings → Retention. The sweep deletes old run step details and finished DBOS
  workflows. (#1578)
• decide and list_profiles automation blocks. decide asks typed questions through
  the OpenRouter Decisions API and returns calibrated answers. Without an OpenRouter key, it
  returns decided: false. (#1617)
• Smart profile routing in Slack. Set the routing input of the Slack automation to
  smart, and a new thread goes to the profile that matches the request. When the model is
  not sure, it asks the person to choose. Channel overrides always apply first. (#1619)
• CONTRIBUTING.md, SECURITY.md, and a CLA check on pull requests. (#1471, #1581)

Changed

• The harness model options are model families, so a new model release does not change the
  option ids. The bundled Claude Code CLI is 2.1.285 and the Codex CLI is 0.161.0. (#1608)
• The listener of a parked session stops until the session resumes. (#1579)
• A PR review keeps one status comment for each pull request, and it posts a GitHub review
  only when it has findings. (#1577)
• The repos input of the PR review automation is the only record of enrolled
  repositories. (#1574)
• Snapshot metadata is stored as JSON. (#1601)
• A host uses one NBD device for each role of each sandbox. (#1602)
• Updates to the OpenTelemetry, AWS SDK, React, and other dependencies, including
  framer-motion 14.

Removed

• The C1 stop-and-copy migration path. Each live move uses post-copy. (#1599)
• The legacy Slack thread engine, its LLM profile picker, and the slack_session
  table. (#1575)
• The review_enrollment table. (#1574)
• The raw sparse swap file and the swap disarm steps before a capture. (#1603)

Fixed

• A memory image that a host cannot restore now causes a disk-only cold boot. Before, the
  session became Dead after five failed resumes. (#1613)
• A guest that stops before the agent is ready now fails at once and shows the end of the
  console log. Before, it waited 180 seconds. (#1610)
• A Slack thread has no time limit for a turn. When a run reaches its limit, it pauses and
  does not fail. (#1568)
• The session of a Slack thread gets the Slack system prompt again, so answers use Slack
  formatting. (#1576)
• The operator no longer decreases the cloud target size of a node pool when it adds
  nodes. (#1583)
• The host-agent keeps all dirty data and sandbox state through seal, restore, teardown, and
  capture. (#1584)
• A live move no longer stops when the source is a File-mode fresh create, and the attach
  step continues when the harness event arrives. (#1596, #1597)
• The contrast of the accent color in light mode. (#1604)
• The Nix dev shell builds jemalloc again. (#1614)

Artifacts

Release 0.11.0 at f4612d892d85

Artifact	Tag	Built from	Digest
coordinator	0.11.0	850e8a452c69	sha256:828d9c0567a805b1bca36f0c7e81b4ab0212e3d11c4601ab0224e0008d22b001
host-agent	0.11.0	850e8a452c69	sha256:50d1a86ea69e17bd12b13e62e1a6bcb8a5c2c237e837d7f9ef45fb41c3555679
host-operator	0.11.0	850e8a452c69	sha256:fce4fca4a7776dd3385209b44afaf12c0accaaa980db3c46c9c1b5f08a652bfd
web	0.11.0	292843bd44a3	sha256:78597929605f7d2fd5ab0d4b4fa5b52edb0dcdd8ca55edd31d82896d45cfa375
orchestrator	0.11.0	f41f514f1b83	sha256:dbbcc86540272f4e661b8de8cc0db89c83ccc95b183cae23aee88c6c6d314ac1
node-assets	0.11.0	9a5decf61685	sha256:ebe64ad828aa899622d2479e3550976374506b51e3a3d80735f2d0260e8965f5
cli-tools	0.11.0	69bfa6af6571	sha256:5d32a76ba3c9b06b8afcbce433f69982cb8e00357444989eb88a098a7f1ad9b1