open-compute 0.2.2

0.2.2 introduces the single-daemon, multi-instance operating model, substantially expands the Cloudflare-compatible management surface, and replaces the early operator UI with a product-oriented Dashboard. It is for self-hosted operators who want to run multiple isolated open-compute accounts on one host or manage supported Workers, storage, queues, workflows, Vectorize, and AI Search resources visually.

What's new

• One daemon, multiple isolated instances. One ocd owns the selected user or system scope, shared listeners, Gateway, registry, and verified runtime cache. Each registered instance owns its explicit compute.toml, data directory, InstanceId, SQLite and object authorities, credentials, products, runtime processes, and lifecycle. The new ocd instance setup|add|start|stop|restart|remove commands manage those registrations without scanning directories or inferring state.
• Expanded Cloudflare-compatible APIs. Queue messages.push and bulkPush, Beta Worker lookup and Version deletion, multipart R2 management, D1 resource and time-travel helpers, observability queries, optional Version metadata tags, AI Search uploads, and the management operations needed by the Dashboard are now implemented through the same /client/v4 surface used by Wrangler and the official SDK.
• Cloudflare-style operator Dashboard. The bundled Dashboard now provides account/instance switching and detailed workflows for Workers, KV, D1, R2, Durable Objects, Queues, Workflows, Vectorize, AI Search, observability, backups, and platform status. Unsupported or unconfigured capabilities show explicit product gates instead of failed empty views.
• Safer local integrations. Operators can expose fixed private HTTP targets through policy-bound Service Bindings, while ordinary tenant egress remains public-address-only. The git artifact service now uses the pinned third_party/gitserver fork and supports thin-pack deltas against existing remote objects.

Workerd

The third_party/workerd submodule moved from 1c7b89bea323a39a8511271913820f9fcf39306d to 5347a1d6ad984411b4f63d63c3a62d589fc94abb. These commits update the fork documentation and branding only; the formal runtime pin remains v1.20260918.1-open-compute-i102.1c7b89be at revision 1c7b89bea323a39a8511271913820f9fcf39306d, and workerd --version still prints workerd 2026-09-18.

Every commit in the third_party/workerd submodule range:

• fbd4dddad docs: describe the Open Compute workerd fork
• c7feb6dae docs: use the Open Compute brand image
• 5347a1d6a docs: update Open Compute brand image format to WebP

SDK

• Package: @open-compute/sdk@0.2.2; install with npm install @open-compute/sdk@0.2.2 and verify the published version at npm.
• Pins: official cloudflare@7.1.0, Cloudflare OpenAPI revision 425ceea95cdaa4c43dd462279e42d74fbc00441e, and Wrangler 4.138.0 compatibility fixtures.
• Surface: generated clients now cover the new Queue message, Worker/Version, resource-management, observability, R2 multipart, and AI Search upload operations. Worker uploads use the official multipart metadata/module shape, including Service props, Artifacts, and multi-step Durable Object migrations.
• Pairing: only an ocd and SDK with the same stable X.Y.Z are qualified together.

Fixed

• Worker and Version uploads now share the official multipart wire shape instead of requiring Dashboard-specific request adapters.
• Workflow versions reserved during a Worker upload are staged, runtime-probed, and published before the Worker Version becomes ready; deterministic failures reject the whole batch.
• AI Search bindings resolve their public namespace + instance_name identity consistently, including the default namespace.
• R2 object metadata records exact sizes, folder upload preserves distinct relative keys, and multipart management operations use the durable object authority.
• Queue consumer and message operations now use public Queue identities and preserve durable scheduler, idempotency, metrics, and result-unknown behavior.
• dashboard:dev reuses built ocd, handles scope ownership and listener cleanup predictably, and keeps Vite HMR available for frontend work.
• Non-interactive ocd instance setup --yes now enables the bundled Dashboard, and the shared daemon serves its initial unauthenticated shell from a running Dashboard-enabled instance before session exchange, including multi-instance scopes.
• Release packaging exercises the production binary's embedded Dashboard shell, session exchange, account discovery, unauthenticated page reload, and a real Worker deployment lifecycle without depending on test-support fixtures.
• AI Search instance updates now serialize with background index activation instead of transiently making healthy instances unavailable.

Before you upgrade

• This is a breaking pre-1.0 configuration and persistence model change. Stop ocd, preserve a backup, and create an explicit daemon registry in <OCD_DIR>/ocd.toml. Every instance must have its own registered compute.toml with an explicit [data].path; legacy implicit single-instance layouts and account-identity fields are rejected rather than migrated silently.
• Startup applies control migrations V9 through V13. Previously published migration bytes are unchanged, but a database opened by 0.2.2 should not be reused with an older binary.
• Shared listener, admin authentication, Gateway, global artifact concurrency, and metric-series settings belong in ocd.toml. Product, storage, Dashboard, public-domain, and extension settings remain instance-scoped in compute.toml.
• The formal embedded workerd binary pin is unchanged. The new workerd submodule commits are documentation-only and do not alter runtime bytes.

Install or upgrade

An existing receipt-managed installation can upgrade directly after adapting its configuration and taking a backup:

ocd upgrade 0.2.2

For a new user-owned installation, download and review the installer, then pin this release:

curl -fsSL -o install.sh https://raw.githubusercontent.com/elliothux/open-compute/v0.2.2/scripts/install.sh
less install.sh
OPEN_COMPUTE_RELEASE_TAG=v0.2.2 sh install.sh
ocd setup --yes

Verify with ocd --version, ocd config check, ocd instances, ocd doctor, and ocd capabilities --json before admitting traffic.

Downloads

Host	Asset
macOS on Apple silicon	ocd-v0.2.2-darwin-arm64
Linux on ARM64	ocd-v0.2.2-linux-arm64
Linux on x86-64	ocd-v0.2.2-linux-x64

The release also contains release.json and SHA256SUMS. Every executable embeds the formally pinned workerd and Caddy payloads. Windows and Intel macOS remain source-build-only targets.

Security

There are no published security advisories specific to 0.2.2. Instance routing combines trusted host selection, credentials, and InstanceId; data roots, credentials, resources, child processes, runtime transports, and private Service policies remain isolated per instance. Private Service targets are resolved and pinned at startup, do not follow redirects, and never broaden ordinary tenant egress.

Known limitations

• Upgrading from 0.2.1 requires an explicit configuration conversion to the new daemon registry and per-instance data path; there is no legacy compatibility shim.
• The single-machine deployment profile does not implement Cloudflare's managed multi-region control plane or workers.dev service.
• Public Gateway qualification still requires routable TCP 443 and delegated UDP/TCP DNS on the deployment host.
• The macOS document parser has no enforceable hard memory ceiling; concurrency, input/output, CPU, and timeout bounds remain active.
• Code signing and macOS notarization are not included.

Verification

The release source is qualified by the repository build, source-identity contract, formatting, Clippy, no-default-features, Rust 1.98 checks, metadata, dependency boundaries, at least 90% Rust line coverage, and one complete workspace Gate against the formally pinned workerd. The tag workflow independently runs coverage, the macOS workspace Gate, the controlled Linux egress fixture, and three native package jobs. It publishes the paired npm SDK and exposes the GitHub Release only after all required jobs succeed and the five downloaded release assets match their manifest and checksums.

Full changelog

Thanks

No external issue reports were closed in this release.