v0.1.0-rc.9

What's Changed

• node: tell agents to propose installing the a2a CLI by @kaisoz in #570
• feat(auth,sts,egress): task-scoped Biscuit attenuation, two-token STS, and egress brokers by @aojea in #578
• v0.1.0 readiness: release pipeline, operator-plane proto contract, storage units, SDK parity by @aojea in #589
• fix: pre-GA security, conformance, release, and test-pyramid hardening by @aojea in #590

Full Changelog: v0.1.0-rc.8...v0.1.0-rc.9

v0.1.0-rc.8

Changelog

• 5ad9e97 sdk: rewrite the card of an agent behind a node for the mesh
• b4e5f0d sdk: expect the card of an agent behind a node rewritten for the mesh
• 049d7a2 sdk: reserve again on a router where the control plane lists it now
• b4bdd4a sdk/python: dial a peer at the addresses given, whatever the peerstore holds
• 17e9fae build(deps): bump the docker-digests group across 4 directories with 1 update
• 988a43f deploy: routers on bananas keep a provider record for an hour
• a460ae3 sdk/python: a replaced peer costs connect one dial timeout per step
• 635651d deploy: open the VM router's ports in the COS host firewall
• bc02ea6 build(deps): bump the python-deps group across 2 directories with 2 updates
• 6af1426 build(deps): bump ghcr.io/devcontainers/features/docker-in-docker
• 6c55c60 Remove sam-a2a-bridge in favour of the official a2a CLI
• fe0813f sdk/python: a peer that is gone costs connect one wait, not one per router
• d68f2e3 sdk/python: refresh the credential from one thread at a time
• 6bed21b sdk/js: cite the js-libp2p issues behind the relay workarounds
• c916264 node: stdio bridge stops minting a session id
• 24fc55f tests: GET /mcp answers 405 on the sessionless node
• d64ba90 node: bound the stateless MCP test with a context
• a0896af node: serve MCP stateless
• cfd6543 build(deps): bump the docker-digests group across 2 directories with 1 update
• 708d042 build(deps): bump the python-deps group across 3 directories with 3 updates
• b2803d0 labels: a caller's requirement is a conjunction, as the egress floor is
• 7b0debb sdk: only a node passes the MCP gate too
• ea8bfef sdk: only a node passes the egress gate, and a malformed floor fails the runner
• e3ba29f sdk: an egress floor, stated at join and held on every call
• cdb282f examples/sandboxed-agent: the waits go, the typing stays
• 592c9f9 examples/sandboxed-agent: review fixes and a tighter cut
• 449d84a examples: an agent in a sandbox, a network the admin controls
• 02c8d27 sam-one: a seed policy file keeps its egress destinations
• 2cdab80 sdk/python: take every answer in a loop, not through any()
• a6adc42 sdk/python: dial routers and DHT peers at once, stop when the record is in hand
• 3fd56c6 build(deps): bump the docker-digests group across 3 directories with 2 updates
• bd58efb mobile: name the Kotlin module explicitly for the appfunctions compiler
• 4fcd4ce build(deps): bump org.jetbrains.kotlin.android
• 3a683c2 dependabot: base image versions are not digest refreshes
• dcc0f3c nano-init: bound the ingress handshake read
• c07888d build(deps): bump the python-deps group across 3 directories with 3 updates
• a547e38 build(deps): bump ghcr.io/devcontainers/features/docker-in-docker
• ee2e609 build(deps): bump ghcr.io/devcontainers/features/node
• 525ed45 build(deps-dev): bump @types/node from 26.6.1 to 26.6.2 in /sdk/js
• b03a444 build(deps): bump github/codeql-action/upload-sarif
• 3ebeef3 build(deps): bump github.com/dustin/go-humanize from 1.0.1 to 1.1.0
• 2f788dd sdk/python: cap the hang-up after a stalled stream open at one second
• a18bc97 sdk/python: bound every dial the DHT walk makes

v0.1.0-rc.7

What's Changed

• sdk: make members stay reachable and authorize reliably; egress as a service type by @aojea in #521
• sam-one: --tunnel codespaces, and a mesh of your own in a GitHub codespace by @aojea in #522

Full Changelog: v0.1.0-rc.6...v0.1.0-rc.7

v0.1.0-rc.6

Changelog

• 913e868 docs: egress destinations, HTTP grants and the request facts
• 8f292be tests: the egress destination CUJ with real binaries
• 7c9b141 sdk: inject method and path and apply the HTTP narrowing rules
• 81b1122 node: serve assigned egress destinations and decide on method and path
• 774b384 controlplane: validate, store and distribute egress destinations
• 69b807e api: egress destinations and HTTP narrowing in the policy vocabulary
• 3af5282 sdk/js: HEAD keeps the declared length, a cancelled body closes its reader
• 95aad4b sdk: a dot segment spelled %2e is a dot segment
• eddc550 docs: the JS SDK in a browser
• 7ce454d sdk: a browser page as a member of a sam-one mesh, tested
• fcbeedc sdk/js: one SDK for Node and the browser
• bc61021 sdk/js: speak /libp2p-http on the stream itself
• 08d03ed sdk/js: identity and encodings without node:crypto and Buffer
• 38dc24a controlplane: answer the mesh protocol's endpoints for any origin
• 9a0103e router, node: accept Noise after TLS
• b4a92f0 sdk: dial routers over WebSocket, so both SDKs join sam-one
• b7a766f node: pin that the inference backend sees no forwarding header
• 406c790 hack: lint with golangci-lint v2.14.0 and deadcode from x/tools v0.50.0
• a1d5da8 sdk/js: reach peers through a router the control plane names by /dnsaddr
• 5bb6c83 sdk: a caller's label requirement is met by any one pair, as in sam-node
• c4b0bde sdk/python: test the manager's slot count once it is back
• 190fe09 sdk/python: no resource manager, no background dialer on the host
• 34ce86d Merge pull request #510 from aojea/sdk/a2a-only
• a69280a sdk/python: a stream reset mid-response is an error, a close is the end
• a38ce11 testnet, docs: agents written with the A2A SDKs talk across languages
• 363f9c9 sdk: agents written with the official A2A SDKs, JavaScript to Python
• 34ef878 docs: the SDKs are agents; they call services and accept A2A
• c47424e testnet: SDK canaries and probes run agents reached by peer ID
• b96b3cb tests/integration: SDK members accept A2A, publish nothing
• 1723054 node: reach a peer named by ID through the authenticated routers
• d013c00 sdk/js: accept A2A for the agent, stop publishing services
• 20866aa sdk/python: accept A2A for the agent, stop publishing services
• d4d40c5 Merge pull request #506 from aojea/fix/release-separate-sdk-jobs
• 10b9555 release: parallelize SDK publishing into separate jobs with retry support

v0.1.0-rc.5

Changelog

• cd21719 Merge pull request #505 from aojea/fix/sdk-python-yamux-backlog
• acb1e00 sdk/python: return the yamux slot on a cancelled open, parse pre-release versions
• a3ee487 sdk/python: return yamux backlog slots on close, bound every stream open
• 37e4641 Merge pull request #502 from aojea/fix/sdk-python-reservation-renewal
• 1006a10 sdk/python: drop the router connection when a renewal fails
• 7b82456 sdk/python: renew the relay reservation before the router drops it
• 2057d82 Merge pull request #501 from aojea/fix/release-sdk-dist-tag
• 33fc488 release: npm dist-tag for prereleases and a manual SDK publish

v0.1.0-rc.4

What's Changed

• Native JavaScript and Python SDKs by @aojea in #490
• zero-config cloud deploy by @aojea in #491
• configurable relay circuit limits by @kaisoz in #498

Full Changelog: v0.1.0-rc.3...v0.1.0-rc.4

v0.1.0-rc.3

What's Changed

• mobile: fix Android DNS bootstrap during enrollment by @aojea in #463
• mobile: keep browser and device login token requests in the foreground by @aojea in #465
• console: hide revoked nodes from the Nodes view by @kaisoz in #475
• Skip revoked peers in DHT discovery by @kaisoz in #474
• node: clear the router auth session when the connection drops by @kaisoz in #477
• Identify control-plane clients by version and refresh credentials on key rotation by @aojea in #476

Full Changelog: v0.1.0-rc.2...v0.1.0-rc.3

v0.1.0-rc.2

What's Changed

• docs: restructure and rewrite the documentation site by @aojea in #443
• node: pull keys, bans and policy from the control plane in one loop by @aojea in #453
• control-plane: publish mesh events for real by @aojea in #454
• node, router: one client for the control plane's pull endpoints by @aojea in #456

New Contributors

• @anxkhn made their first contribution in #441

Full Changelog: v0.1.0-rc.1...v0.1.0-rc.2

v0.1.0-rc.1

What's Changed

• mobile: keep the PeerID when unenrolling by @kaisoz in #429
• node: reap the stdio bridge backend after killing it by @aojea in #431
• Security triage: mcp 2.x, LangChain 1.x, Go floor, verified-token audience, npm lockfiles by @aojea in #432
• Close latent hole in service re-declare path by @IbrahimAhmed8 in #428
• node: authenticate each router once, not once per advertised address by @aojea in #433
• node: wait for the DHT routing table before advertising by @aojea in #435
• Testnet observability: metrics, cold-path probe, health workflow by @aojea in #436

Full Changelog: v0.1.0-rc.0...v0.1.0-rc.1

v0.1.0-rc.0

What's Changed

• Security review remediation: proof of possession, identity bans, type-bound dispatch, gossip validation, control-plane transport trust, secrets hygiene, mobile tokens by @aojea in #415
• sam-one: QR device enrollment, Cloudflare quick tunnels, SAM Connect scanner by @aojea in #427

Full Changelog: v0.1.0-alpha.10...v0.1.0-rc.0