minimal 0.8.0-dev.90.gd67d78ee

0.8.0

88 commit(s) since v0.7.0.

Features

• mlog: opt-in OpenTelemetry export, switches and a local spool (2/7, spec 25) (#1994) (f4c13e4)
• min, minimald: one trace per request across the CLI and the daemon (3/7, spec 25) (#1995) (98dbe05)
• minvmd: export the VM host daemon's spans and carry telemetry into the guest (4/7, spec 25) (#1996) (8af4e1d)
• diag: min bug carries the telemetry spool and redacts telemetry settings (5/7, spec 25) (#1997) (1af0a88)
• otel: guest telemetry rides the VM channel (#2039) (f5bb38c)
• packaging: ship minzoned in a signed macOS app bundle with the app icon (#2188) (4a87666)
• stdlib: type the patch ledger by kind, and check revision against it (#1277) (aa13deb)
• scripts: report non-Rust dependency pins and bump the pkgs locked_commit (#1875) (482c744)

Fixes

• minimal: say DNS, min.internal and box IPs plainly in finalize-install --show (#2166) (f90cf02)
• minvmd: reword the DNS-service refusals and minzoned release output in plain language (#2169) (0fb46a8)
• minvmd: reword refusal messages in plain language (#2171) (7dc57e6)
• cli,tui: reword cleanup and status warnings in plain language (#2175) (12a1152)
• minimald: reword network refusals and errors in plain language (#2173) (0ed86a6)
• minimald: reword attach refusals and port-request failures in plain language (#2172) (710abda)
• sessions: reword the credentialed-upstream policy row and ingress errors (#2180) (f3001e5)
• minimal: say the finalize-install egress item plainly (#2179) (1f6bc55)
• minimal: reword the min ls header rows and list warnings in plain language (#2182) (9db0c46)
• minimal: reword the box-name rows, the names line and session start messages in plain language (#2183) (080797e)
• minimal: skip the port-prompt subscription for a box with no host row (#2187) (4e168f6)
• switch: raise the outbound tcp connect bound so a burst of connections stops timing out (#2184) (265081b)
• minimald: elect one holder for a shared ingress port by creation order (#2185) (6f32545)
• minimal: accept a sticky root-owned directory and check before changing the host (#2195) (acda93b)
• minvmd: bind a waiting declared forward when the row holding its listener is withdrawn (#2186) (bfd0f99)
• minimal: give each local-range alias a /32 mask (#2196) (6c235fe)
• minimal: stop claiming a box name opens in any browser (#2211) (51f71f0)
• promote: find the draft release by listing and publish it under its tag (c5073b0)
• minimald: name the hand-over bind message in the actor's span (6e650e2)
• minimald: spawn the forward-ported tasks through the traced helpers (b567cf6)
• minvmd: say connection in the singular when the cap is one (5630f87)
• otel: the nineteen review follow-ups deferred from the telemetry stack (#2202) (#2207) (6c6c39a)
• cargo: remove the committed buf registry token (#2204) (813e4e5)
• minimald: hold an OS-picked port in the answerer relocation test (#2237) (e57b5ed)
• scripts: drop the nfpm pin that the 0.7.0 merge-back removed (#2243) (11b0b44)
• mctx: keep inline-table settings when adding deps (#2244) (9c985f0)
• minimal: hold the answerer channel socket owner-only (#2297) (746770d)
• minimal: remove the range aliases and resolver dir on macOS undo (#2246) (4e16307)
• minimal: compile the spin demo only in debug builds (#2301) (336c9b5)
• minimald: bound wedged transport writes with an inactivity deadline (#2303) (02f3af9)
• minimald: record dynamic-listen ports in the shared-port election (#2305) (3759c74)
• minimald: reuse the compose-time graph names in the finalize package check (#2304) (b45039a)
• minimal: spell network modes as host_ip, own_ip and none in min dash (#2310) (b18a418)
• minimald: log the box name plainly in shared-port hand-over lines (#2308) (1d13b17)
• minimald: name a pending hold in the expose refusal (#2317) (d825e46)
• minimal-client: skip entries vanishing during the workspace upload walk (#2316) (48a6259)
• minimal: flush the macOS system resolver cache in the finalize-install scripts (#2306) (9ea9433)
• common: write file cache downloads atomically via temp file and rename (#2242) (40420c9)
• minimal: ask only running VMs' daemons to release the hook port (#2245) (23e908f)
• mctx: keep task args from running as shell code (#2296) (cfcff04)
• net: keep restored own-ip boxes' rows and ingress across a VM restart (#2298) (10d34a5)
• net: refuse out-of-zone names at a guest deny-subtree DNS listener (#2300) (2c2f8cc)
• minimald: leave HEAD alone when a push targets another branch (#2319) (0a297d0)
• minimald: keep a timed-out hook's captured output (#2318) (3cfae65)
• minimal: report an already-destroyed session instead of failing (#2315) (c5b6dcd)
• minimald: handle --help at every level of the in-session min helper (#2312) (76cc0a7)
• minvmd: reap a stale gvproxy before drawing the node proxy port (#2313) (7675e02)
• send the lease ARP as the relay's first frame (#2333) (1bec117)
• minimal: name the held port in finalize-install's names item (#2309) (daa934d)
• installer,dash: stop the daemon across uninstall and reinstall (#2342) (2e67f8a)

Other changes

• declare 0.8.0 as the next release (#2168) (28a38b3)
• switch: gate bep_host socket tests under miri (#2165) (1e32c2b)
• deny: ignore RUSTSEC-2024-0449 (unsafe-libyaml via nickel-lang-core's serde_yaml) (#2194) (71f35e0)
• rename the sandbox2 crate to sandbox and add the box naming rule (#2106) (21b369b)
• otel: spec 25 — review round: stories, opt-out, host-env scope, vsock guest path, trust model (#1988) (a214f31)
• harden three flaky probes ahead of the telemetry series (#1993) (aacba86)
• otel: requirement tests for mlog, min, minimald and minvmd; Kani lanes (#1989) (b6386b9)
• macos: take the unit job's crate list from the justfile scope (#2200) (1e2d93a)
• deps: rustls 0.23.46 (RUSTSEC-2026-0346, -0347, -0348, -0349) (#2206) (598e6d8)
• minimal: fold minimal-tui into the dash module (#2104) (a3f2fa9)
• minimal: reword activate network and egress flag help (#2170) (93e440a)
• release: drop distro packages from the 0.7.0 release (#2214) (ce79c45)
• cli-min: qualify the own_ip deny-all default by the box's egress declaration (2ce67fd)
• e2e: expect the bundle's program in the range proof when the step installs the bundle (00eb544)
• rename the sessions crate to boxes (#2201) (6fb3c55)
• reference: document min net expose in sandbox-operations (#2216) (5955f3f)
• minimald: rename the session modules for what they hold (#2228) (c22640e)
• rename the session types for the box they model (#2229) (bfe0c5a)
• release: merge a diverged release tag back into main (804680c)
• release: fetch the tag and list unmatched fixes before a merge-back (e448eb2)
• release: force the tag fetch so a stale local tag is replaced (4cf5524)
• vale: accept the spec-hash and supply-chain terms (#2018) (647e902)
• telemetry: say DO_NOT_TRACK needs a non-empty value, and link spec 25 by URL (#2209) (cb46bda)
• reference: correct the --dynamic-ingress row for VM-backed hosts (#2217) (21744cc)
• e2e: hold daemon 2's busy default port across its start (#2311) (e2443c1)
• specs: let min secret set write the store rule, with fixed-token presets (#2247) (bb01558)
• spec-lint: read the linter from foundry's spec plugin (#2240) (#2241) (51c1348)
• specs: add an Anthropic API-key preset and set NODE_USE_ENV_PROXY under proxy_env (#2328) (c485dae)
• spikes: measure whether clients send a sealed handle unmodified (#2327) (dedbf2c)
• minvmd: move canonical_box_name into box_registry (#2344) (d67d78e)