v0.1.1

Agent Mesh v0.1.1 is a maintenance release. It fixes what came up when agentmesh-one runs as a hub on Cloud Run for members in several clusters, and it gives the operator the signing keys.

Control plane

• Operator-owned signing keys (#738). --signing-key-path takes a PEM file with the Ed25519 keys for Biscuits and the P-256 key for the ES256 JWTs behind /sts/token. The first key of each kind signs, the others verify. The file is re-read every 30 seconds, so a rotation is an edit to the file and no restart. Automatic rotation is off while the file is present. On Cloud Run the file comes from Secret Manager and a new revision keeps the keys; the guide has the rotation procedure.
• Workload issuers resolve in the background (#736). The control plane starts when a --workload-issuer does not answer, retries with backoff, refuses that issuer's tokens with a 401 that names it until it resolves, and exports agentmesh_control_plane_workload_issuer_ready{issuer}.
• --issuer and --workload-issuer accumulate when repeated (#743). Before, the last flag replaced the others.
• A refused member credential says why (#745). agentmesh_control_plane_member_auth_refusals_total{reason} and a log line with the peer id: malformed, invalid_biscuit, unknown_node, banned, session_expired. unknown_node is what every node gets after a control plane restarts on an empty store.
• Inferred public router address on Cloud Run (#735). The address inferred from the request is now on this router's /info entry, which is the one nodes dial. --external-url is no longer needed on Cloud Run.

Node

• Re-enrollment (#738). A node started with --bootstrap-token-path that gets 401 node credential required enrolls again with the token, and accepts the answer only under a control plane key it already trusts. No restart after a hub revision.

Router

• The shutdown drain logs when no member is attached (#745).

SDKs

• sdk/js: an aborted join cancels its work instead of waiting past the abort; an aborted top-up tries no router it has not dialed yet; a join that hangs says at which stage.
• Mobile: a phone joined with a token changes its labels through Reset device identity.

Documentation

• Cloud Run guide: operator-owned keys and policy from Secret Manager, key rotation, and what a revision rollout does to member connections (--timeout bounds it).

Upgrading from v0.1.0 needs no change to flags or policy.