v0.1.0-alpha.10

What's Changed

• deploy: on-demand sam-one Cloud Run sandbox workflow by @aojea in #364
• docs: clarify required discovery service type by @darkdi in #340
• kind: replace the mesh-config node templating with a sam-node Helm chart by @kaisoz in #366
• docs: node-configuration - target_url works for type: mcp, not just H… by @fer-marino in #380
• fix: mcp_service - don't drop the last response on backend EOF (#375) by @fer-marino in #379
• feat(node): declare labels in the node config file instead of --labels by @kaisoz in #382
• node: make the backend probe timeout configurable by @fer-marino in #377
• mobile: attested labels, local attenuation and re-enrollment for the Android node by @kaisoz in #384
• resolve goroutine leak in serveOnPipe by @IbrahimAhmed8 in #359
• prevent concurrent close panics in channelListener by @IbrahimAhmed8 in #386
• prevent data race in ReEnrollNode by @IbrahimAhmed8 in #389
• use canonical peer ID string in revocation cache by @IbrahimAhmed8 in #390
• fix: command-backed MCP services get one subprocess per session, not a shared multiplexed bridge by @fer-marino in #387
• Node self-reported service catalog and console mnemonics for node labels by @aojea in #408
• refactor(node): migrate service proxy from Director to Rewrite by @eminaktas in #407
• fix peer ID aliasing bugs across control plane and discovery by @IbrahimAhmed8 in #394
• node: operator-enforced egress label floor (egress.require_labels) by @HosniBelfeki in #385
• fix: control plane - mint a fresh biscuit when an approved enrollment's token has expired by @fer-marino in #391
• controlplane: opt-in autonomous recovery after signing-key retirement by @aojea in #412
• identity: one role gate and one admission verifier, audit follow-ups by @aojea in #413

New Contributors

• @darkdi made their first contribution in #340
• @fer-marino made their first contribution in #380
• @eminaktas made their first contribution in #407

Full Changelog: v0.1.0-alpha.9...v0.1.0-alpha.10