Orbit v0.15.5 (Preview)

What changed

orbit instance clean now removes the instance home in every case. v0.15.4 swept the empty directory clean leaves behind, but only when it already existed at the moment the sweep ran. A daemon can land its final write after waitForDaemonStop returns — the pid stops being alive before the write reaches disk — so the sweep could find nothing and be followed by the write that recreated the directory.

The split was visible from the outside: an instance created but never started cleaned completely, while one that had run a daemon left an empty home behind. The sweep now retries briefly and requires two consecutive passes finding nothing, so an absence means the late write has landed and been swept rather than not having happened yet.

Why it matters

Nothing broke, and nothing accumulated where a user would see it — instance list has ignored homes without a manifest since v0.15.3. This is the disk-level remainder of that fix, finished.

Worth stating because the symptom was Cleaned instance "<name>". followed by a directory that was still there. A command reporting success while leaving its subject in place is the failure mode v0.15.3 and v0.15.4 both addressed from different angles; this closes the last of it.

Upgrade notes

No configuration changes.

Orbit v0.15.4 (Preview)

What changed

Three fixes, all from one person putting --dacpac-dir into a real CI pipeline. Each is a case of Orbit reporting something other than what it did.

daemon restart -c <other.yaml> no longer says it worked while ignoring the file. Restart brings the daemon back on the environment it is already serving — correct as a default, and how orbit update restarts without arguments. But it applied that to an explicit --config too, so a caller switching environments got "Orbit is ready" and the old one. It now refuses, and names the way across: orbit down, then orbit up -c <file>.

orbit daemon status reports the environment the daemon is serving, not one derived locally. Inside a branch that already knew the daemon was alive, it resolved a config path from the current directory — answering "what would I start" to a question about what is running. Together with the restart defect, four surfaces gave three answers for one environment, and the only correct one had no command that could change it.

instance clean no longer leaves an empty home behind. Clean creates the directory itself while addressing the daemon, and the daemon it stops can touch the path on the way out, so the directory could exist again by the time clean returned. It is swept afterwards, and only when empty.

--dacpac-dir '' is now an error rather than a silent fallback to building. An empty argument read as "flag omitted", so publish built from source and failed on project paths that do not exist on that machine — an error naming the config when the argument was the mistake. CI that signals "no artifacts this run" by clearing a variable hits this exactly.

Why it matters

None of these change what Orbit does. They change what it says it did, which is the part a user acts on.

The instance defect had a user following the tool's own suggested next command twice before concluding the tool was wrong rather than their typing. That is the expensive failure: not the wasted minutes, but that the error pointed confidently at the wrong thing. The same shape appears in all four — a config that was never in play, a name no command accepts, a home that reports removed, an argument blamed on the config.

Upgrade notes

No configuration changes. daemon restart with an explicit --config naming a different environment than the running one now fails instead of quietly restarting the old one; scripts relying on the previous behaviour should drop the flag, which restarts the running environment as before.

Orbit v0.15.3 (Preview)

What changed

instance list no longer shows instances that instance clean refuses to remove. The two commands disagreed about what exists: list walked the directories under ~/.orbit/instances and tolerated a missing manifest, while clean read the manifest first and reported instance "<name>" does not exist. A home left behind by an interrupted clean therefore appeared in the list with blank fields and could not be removed through orbit at all.

Both halves are fixed, because either alone leaves the problem standing: list now skips homes with no manifest, and clean finishes a half-done removal instead of refusing it. Existing residue disappears from the list on upgrade with nothing to run.

Three standard-library advisories. GO-2026-6218 (net/url), GO-2026-6091 (html/template) and GO-2026-6090 (crypto/tls) are all reachable from code Orbit runs — the HTTP health probe, the daemon's server, and the SQL Server connection and log-streaming paths. Fixed by building on Go 1.25.13; no source changes.

Why it matters

The instance defect compounded silently. Every interrupted clean added one entry, and nothing removed it — a user reported 42 accumulated names, of which two were real. Telling them apart meant inspecting ~/.orbit/instances/*/ for non-empty directories, which is an implementation detail no one should need. rmdir was the only thing that worked.

That is the same failure shape as two defects fixed in v0.15.2: several surfaces answering the same question differently, with the authoritative one the least visible. Here list and clean now share one definition — an instance exists if it has a manifest.

Upgrade notes

No configuration changes. If orbit instance list has been showing names you could not clean, they will be gone after upgrading.

Orbit v0.15.2 (Preview)

What changed

Everything here came from one person running --dacpac-dir for the first time. The feature's core held; its edges did not.

publish could not find the target under --instance. It derived the environment's resource name by trimming orbit- off the container name. In shared mode that is accidentally right — orbit-sql-server trims to sql-server. Under --instance the container is orbit-instance-<name>-<hash>-sql-server, so the trim produced a name no status response contains: publish reported the target unavailable seconds after up reported it healthy, and the hint told the user to start a resource orbit then rejected as unknown. It now reads the resource name the daemon already publishes for the dashboard.

--parallel said what it does but not when it works. Concurrent first-time publishes race on the logins and roles the projects share, and all but one fail with Msg 15025. On a server that already has the databases it roughly halves the wall clock. Neither half was in --help, which is where the flag gets found; both are now, along with the measurements and their caveats in the SQL workflow docs.

--all with a stray number now explains itself. --parallel takes an optional value, so --parallel 4 leaves the 4 as a positional argument and the old error — "--all takes no database argument" — described a mistake nobody had made.

Why it matters

The prebuilt-dacpac path shipped in v0.15.0 after three rounds of review. Those rounds settled the directory layout, the fingerprint rule, and the error taxonomy, and the first real run confirmed all three: the published schema matched a hand-run sqlpackage baseline object for object, including the shared objects that composite deployment contributes.

What review could not settle was everything the feature depends on rather than defines. The target name came from a field whose meaning was documented but read one layer too literally. The flag parsing came from cobra. The performance surprise came from SQL Server. All three needed a run, not a reader — and all three were reachable from the first command a new user types.

Upgrade notes

No configuration changes. If you use orbit sqlserver publish with --instance, this release is the one where it works.

Orbit v0.15.1 (Preview)

What changed

Two corrections to the SQL Server readiness guidance introduced in v0.15.0. Both came from someone adopting that release and hitting what it did not say.

An exec health check runs argv — there is no shell. The type table said only "run command inside the container", from which a reader cannot tell that $VAR is not expanded. Writing -P "$MSSQL_SA_PASSWORD" as an argument passes those nineteen characters to the program verbatim. Wrap the command in sh -c when it needs a variable, a pipe, or a redirect. Now stated in the type table and explained in both locales.

The exec readiness probe keeps running after startup. It is the runtime liveness check too, so it performs one authenticated login per interval — 5 seconds by default — for as long as the environment is up. orbit doctor recommends this probe to every TCP-probed SQL Server target and previously said nothing about that. The hint and the configuration docs now name the ongoing cost and point at interval.

Why it matters

The v0.15.0 readiness work closed a real race: a SQL Server target can report healthy while still refusing logins, and a publish issued in that window fails on a target that is plainly running. Adopting the fix measurably removed it — 44 seconds of failed pre-login handshakes became zero for the environment that reported it.

But the advice that closes the race was incomplete in two ways, and both failures are quiet ones. A shell-less exec command fails exactly like a database that will not start: the probe fails, retries, and reports only after the whole budget is spent — so the natural next step is to debug SQL Server rather than the probe. And an always-on login probe is right for a container that lives minutes and is discarded, while being a standing background cost for a shared environment somebody leaves running all day, where the startup race it closes happens once.

Neither is a behaviour change. Both are things the tool knew and did not say.

Upgrade notes

No configuration changes are required. If you adopted the exec probe from v0.15.0's orbit doctor hint, it was already correct — the hint has always emitted the sh -c form. Consider raising health_check.interval on environments you leave running.

---

Known issue in this release — fixed in v0.15.2

orbit sqlserver publish cannot find its target when run with --instance — the resource name was derived from the container name, which only works in shared mode. Introduced in v0.15.0, fixed in v0.15.2. There is no workaround in this version.

Recorded here because an upgrade that skips versions reads the notes of the version it lands on, not the ones it passes over.

Orbit v0.15.0 (Preview)

What changed

Publish a schema without its source tree or the .NET SDK. orbit sqlserver publish, diff, diff --script, and reset accept --dacpac-dir, a per-invocation root holding one build-output directory per SQL project:

orbit sqlserver publish --all --dacpac-dir .artifacts

.artifacts/
  PlatformDB/
    PlatformDB.dacpac
    CommonFiles.dacpac      # referenced artifacts sit alongside the leaf
  OrdersDB/
    OrdersDB.dacpac

sqlserver.projects is unchanged — the environment file still declares path: to the .sqlproj, and the artifact is supplied at the call site, where it belongs. sqlpackage is still required; the .NET SDK is not.

Every missing piece is reported before the first database is touched, naming each project rather than failing partway through a multi-project publish.

SQL Server readiness now proves logins, not just an open port. A TCP probe accepts as soon as the listener is up, which can be seconds before the instance finishes recovering and authenticates. orbit doctor now warns when a sqlserver.target has no health check or a TCP-only one, and prints the authenticated exec probe to use instead. A publish that races a starting target also fails immediately with a clear cause rather than continuing with a silently degraded first-time-create decision.

Why it matters

Publishing a schema previously meant having its source on the machine that publishes — every schema repository cloned, every project rebuilt, on every CI run. The alternative was to bypass Orbit and call sqlpackage directly, which means reimplementing what sits around the apply: composite bootstrap for a database that does not exist yet, the retry that heals an unresolved shared reference, and the error classification that turns a sqlpackage failure into an actionable message.

Neither choice was good. This release removes it: a runner that already has the build artifacts can publish through Orbit and keep all of that.

The readiness change fixes a failure that looked like a bug in publishing but was not. A container reporting healthy while refusing logins produced sql_server_unavailable on a target that was plainly running, and the guidance said to start something already started. Orbit's own CI had been working around this by waiting on the container log; that signal is now what Orbit recommends to users.

Upgrade notes

No configuration changes are required.

orbit doctor will warn about SQL Server targets using a TCP health check. The warning includes the exact YAML to adopt; environments are not broken until it is acted on, but the race it describes stays possible until then.

The bundled demo (orbit init) now versions independently of Orbit and is pinned at v2026.8.1. This has no user-visible effect.

---

Known issue in this release — fixed in v0.15.2

--dacpac-dir (and every other orbit sqlserver publish invocation) cannot find its target when run with --instance. The resource name was derived by trimming orbit- off the container name, which is correct in shared mode and wrong under --instance: publish reports the target unavailable seconds after up reports it healthy, and the suggested remedy names a resource orbit rejects as unknown.

There is no workaround in this version. Use v0.15.2 or later if you publish schema under --instance — which is the mode a CI runner isolating its environment will be using, and therefore the main case --dacpac-dir was built for.

Recorded here rather than only in v0.15.2's notes because an upgrade that skips versions reads the notes of the version it lands on, not the ones it passes over.

Orbit v0.14.4 (Preview)

What changed

Publishing one SQL project to several databases works end to end again, and three settings now behave the way the documentation describes them.

SQL configuration errors are back on a single line. The multi-line messages introduced in v0.14.2 broke out of the validation error list, so the YAML snippet offered as the fix rendered as though it were another problem. The errors still name both offending project paths and the remedy.

health_check.timeout now applies to http checks. The field was documented and honoured by tcp, but HTTP probes were capped by a fixed 5s deadline — a check configured timeout: 300ms gave up at 5.001s instead. Only configurations that explicitly set the field change behaviour, and only toward the value they asked for; omitting it still means 5s exactly as before.

An https endpoint now counts as a readiness signal. A resource publishing https alongside any second port received no inferred probe, and orbit doctor warned that Orbit "cannot infer when it is ready" — about a configuration v0.14.2 had just documented. Resources whose only endpoint is TLS now get the same TCP readiness check an http endpoint would.

Publish errors stop blaming the wrong file. When a build produced no usable dacpac, the error asserted the build "wrote X instead" and pointed at a <SqlTargetName> override. The build directory also holds a project's <ProjectReference> dacpacs, so an ordinary build failure named a dependency as the culprit and sent you hunting for an override that did not exist.

Documentation corrections in both locales: tls_skip_verify follows redirects, including to another host; health_check.timeout bounds http and tcp probes while exec is bounded by the surrounding operation and a log wait defaults to 60s; a probe that times out costs its timeout rather than its interval, so a large timeout stretches the startup budget toward retries × timeout; and readiness inference accepts an https alias, not only http.

This release replaces v0.14.3, which was withdrawn shortly after publication. It carries the same fixes.

Why it matters

Every item here is a case where Orbit's own documentation described behaviour the code did not deliver. A databases: project could not publish at all, a configured HTTP timeout was silently discarded, and a TLS-only service was told Orbit could not tell when it was ready. Each one cost time in the place where trust matters most — the error message or the setting you reach for when something is already wrong.

The release also closes the gap that let the publish defect ship: the live SQL Server gate now names its test project and target database differently, so a build artifact resolved under the wrong name fails the release instead of reaching users.

Orbit v0.14.2 (Preview)

What changed

Orbit health checks can now target HTTPS endpoints explicitly with scheme: https and opt out of certificate verification per check with tls_skip_verify: true. HTTP-to-HTTPS redirects honor the same per-check TLS policy, while secure verification remains the default and final responses must still be 2xx. This preview also includes more reliable SQL project DACPAC discovery.

Why it matters

Teams can run local services backed by self-signed or development certificates consistently across machines without disabling TLS verification globally or changing application redirect behavior.

Orbit v0.13.0 (Preview)

What changed

• Added the official Orbit documentation website and clearer agent entry points.
• Aligned CLI help with actual lifecycle behavior and made supported recovery and settings commands discoverable.
• Stabilized settings JSON maps across daemon-backed and offline reads.
• Added explicit multi-database SQL project targets and rejected ambiguous project or database identifiers before publish and reset.

Why it matters

Developers and coding agents can now discover the correct command from orbit --help, rely on stable machine-readable settings, and avoid silent or destructive SQL target ambiguity. The bundled demo and Orbit agent plugin remain version-matched with this preview.

Orbit v0.12.0 (Preview)

What changed

Orbit environments can now inherit from one parent file with extends:. Mapping keys merge recursively while scalar and list values are replaced. Parent and child schema errors preserve their authored file and line, and missing parents surface as stale after transient-save protection.

The bundled quickstart and agent plugin are paired with this release.

Why it matters

Teams can maintain E2E and CI variants without copying hundreds of lines of shared environment configuration. Errors still point to the file authors need to fix, and running environments notice when a shared parent changes or disappears.