v0.2.0 - guest credentials for PS Direct

Guest sessions can now carry a credential, which makes the whole guest family usable on a provisioned VM that has a logon password.

Downloads: pick your architecture, verify the .sha256 sidecar, then run hvlab version:

File	Target
hvlab-v0.2.0-x64.zip	x86_64-pc-windows-msvc
hvlab-v0.2.0-arm64.zip	aarch64-pc-windows-msvc

Each archive contains hvlab.exe, README.md, both licenses, NOTICE, CHANGELOG.md, and a BUILD.txt recording the exact toolchain and commit it was built from.

---

[0.2.0] — 2026-11-01

Added

• Guest credentials for PowerShell Direct. GuestCredential in hvlab-guest, with
  PsDirectSession::open_with_credential and open_with_command_and_credential.
  The credential travels in a framed auth request that precedes the identity
  handshake, and the sidecar turns it into a PSCredential. It never appears in
  argv, a temp file, or a log line; GuestCredential's Debug prints *** in
  place of the password.
• The sidecar creates its guest session lazily and reports the session flag it
  actually established, so a refused credential fails the open instead of being
  retried as a payload.
• The MCP layer reads HVLAB_GUEST_USER plus the password variable named by
  HVLAB_GUEST_PASSWORD_ENV (default HVLAB_GUEST_PASSWORD) and passes the
  credential to every guest tool. Setting one variable without the other is
  ignored, so a half-configured server runs credential-less rather than sending an
  empty password. Guests that accept credential-free PS Direct behave as before.
• sha256_hex_matches_published_vectors, pinning FIPS 180-4 known answers.

Changed

• sha2 0.10 → 0.11 (now on hybrid-array). Digest output is unchanged;
  sha256_hex_matches_published_vectors pins the FIPS 180-4 known answers so a
  future bump cannot silently alter plan-token digests.
• CI actions moved to their node24 releases (checkout v7, upload-artifact
  v7, download-artifact v8).
• The Ubuntu CI leg runs hvlab-core and hvlab-dump only; the Windows leg
  runs the full workspace.

Notes

• 246 tests. Field notes from a real kernel-driver lab, including the credential
  gap that motivated this release, are in
  docs/field-notes-2026-10-31.md.

v0.1.0 - first public release

Hyper-V control plane for AI agents and humans: a typed MCP server and CLI over WMI, PowerShell Direct, and the Windows debugger.

42 tools across nine families, with a plan-token gate on every destructive or guest-code-execution call.

Downloads — pick your architecture, verify the .sha256 sidecar, then run hvlab --version:

File	Target
hvlab-v0.1.0-x64.zip	x86_64-pc-windows-msvc
hvlab-v0.1.0-arm64.zip	aarch64-pc-windows-msvc

Each archive contains hvlab.exe, README.md, both licenses, NOTICE, CHANGELOG.md, and a BUILD.txt recording the exact toolchain and commit it was built from.

---

[0.1.0] — 2026-10-24

First public release. An honest 0.1.0: the host, guest, and dump surfaces are
implemented and tested; live kernel debugging and orchestration are not (see
the Status section of the README).

Added

MCP server (hvlab mcp, stdio)

• 42 tools across nine families: meta, host, vm, checkpoint, storage,
  network, device, guest, dump.
• Four safety classes with a single source of truth: 21 read-only, 17 mutating,
  2 destructive, 2 guest-execution.
• Plan tokens for D/X calls: SHA-256 over the canonicalized action plus the
  exact arguments, single-use, five-minute expiry, enforced centrally before
  dispatch.
• Tool profiles (HVLAB_TOOLS=core|full|readonly|<names|families>) and a lean
  listing projection that cuts the advertised payload by ~82% without removing
  any callable tool.
• hv_tools_search and hv_tools_describe for reaching the long tail under
  any profile.

Host plane (hvlab-host, WMI v2)

• VM inventory and lifecycle: start, stop (shutdown / save / turnoff), restart,
  reset, pause, resume, wait-for-state, rename.
• VM configuration: read memory, dynamic-memory flag, processors, notes, nested
  virtualization; setters take a dry_run that returns a diff without applying.
• Checkpoints: list, create (standard / production / disk-only), restore,
  delete, delete-subtree, rename.
• Storage: VHD/VHDX create, inspect, live state, resize, compact.
• Networking: switch list/create/remove, NIC connect/disconnect. External
  switches are refused in the backend — binding a physical adapter can take
  the host offline.
• Devices: attach and detach disks.
• Host facts: computer system, services, default storage roots, default switch.

Guest execution (hvlab-guest, PowerShell Direct)

• Length-prefixed JSON framing with a hard size cap; malformed frames are
  errors, never salvaged.
• Mandatory identity handshake: a per-session nonce echoed with the guest
  hostname before any payload is sent.
• Out-of-band exit codes; guest stdout can never forge a result.
• SHA-256 verified file transfer in both directions.
• Component-wise guest path allowlist that rejects .., substring tricks, and
  case-folded escapes.

Crash dumps (hvlab-dump, hvlab-debug)

• DUMP_HEADER64 fast path: bugcheck code, name, description, reference, and
  parameters in milliseconds, with no debugger installed. Offsets are asserted
  against kdmp-parser so an upstream format change fails a test.
• Full !analyze -v analysis through cdb.exe, with stack extraction, bounded
  raw log, explicit truncation, and a disk cache keyed by dump fingerprint.
• Dump discovery across the standard roots, newest first, with an explicit
  count of what was skipped.

CLI (hvlab)

• hvlab dump inspect <file>, hvlab mcp, hvlab tools, hvlab version.

Project

• 245 tests. CI runs the full suite on Windows, and the portable crates
  (hvlab-core, hvlab-dump) on Ubuntu as a portability guard, plus clippy -D warnings, rustfmt --check, cargo-deny, and cargo doc with warnings
  denied.
• No unsafe in library code; unwrap/expect denied outside tests.

Known limitations

• Live kernel debugging (hv_kd_*) is not implemented.
• Guest inspection tools (processes, services, registry, event log) are not
  implemented.
• Console and serial channels are not implemented.
• SSH and Linux guests are not supported.
• Orchestration (hv_recover, soak, watchdog, recipes) is not implemented.
• No HTTP transport, artifact server, or metrics endpoint.
• The declarative policy layer (mode, vm_allowlist) is not built; classes
  and plan tokens are enforced, the TOML policy file is not.
• hvlab doctor is a stub.