v0.5.0 — workload retirement, and the credential lifecycle

The operator can now end a workload's identity — and the stated gaps in the credential story close: a stolen credential has a lever that stops it, a live stream no longer outlives the credential it opened on, and the console tells a credential that will recover from one that needs the host re-enrolled. Nothing in the agent changes: v0.4.x agents work unmodified against this control plane, and every scenario below was exercised on a live estate with v0.4.3 agents before this release.

• Workloads can be retired (#178, #180, #126). Nothing used to end a workload: a departed host's addresses kept rendering into other workloads' admit sets, where the next holder of an address inherited the admission; a copy of a workload's key and certificate could renew indefinitely, with no lever to refuse it. innerwall workload retire <id> and POST /api/v1/workloads/{id}/retire retire a workload, one way (ADR-0023). Its credential is refused from then on at renewal and on every agent call, with a refusal that names no reason; its live sync stream is ended, at the latest by its next heartbeat; its addresses leave every peer set and flow ingest's resolution, with only the workloads whose policy changed advancing a version; and an open silence of its agent is stored as an evidence gap ending at the retirement. The row stays, so its flows and gaps keep naming it. The host returns only by enrolling again, as a new workload. Migration 00017.
• The console retires, and draws retired as retired (#103, #112, #206). Retire… on the workload page and Retire selected… on the fleet, behind a dialog that states what retiring does and holds its confirm until acknowledged. The fleet's retired chip lists retired workloads apart from the active fleet — the operator's decision, not a health state. The credential card words each state: a valid credential "renews by" the two-thirds mark, an expired one "will recover by renewal" until the grace ends, and past it "needs re-enrollment," with the way to mint a token; the credential last issued is shown beside the one the live stream presented, and a difference is marked — a difference that persists after a reconnect is the sign a second party may hold a copy of the key, and the card says so.
• A sync stream ends with the credential it opened on (#105, #135). A stream opened on a valid credential used to keep receiving policy after the credential expired, for as long as its connection survived. Five minutes before expiry the control plane now directs the agent to reconnect — an agent that renewed on schedule redials with no error — and a stream still open at expiry is ended with a refusal naming the instant. The workload read's credential gains lifecycle and renewable_until, judged against the control plane's own renewal grace. The unused Reenroll directive is recorded reserved; the wire change is a comment alone.
• The credential a live stream presented is recorded (#112). Each stream open stamps the presented certificate's serial and expiry on the workload (migration 00018) and logs them; the workload read reports the credential in use beside the one last issued, so a renewal the running daemon never loaded reads as what it is instead of as enforcement failing.
• The gateway's certificate can be reissued (#133). innerwall ca issue-server --hosts … issues a new server certificate from the existing signing authority for a new host list — enrolled agents keep trusting it, because it chains to the same root. A stack whose first start named an address its agents cannot reach recovers with a reissue and a restart, instead of starting over.
• Go 1.26.10 (#207). Both binaries and the container image build on the toolchain whose crypto/x509 refuses the distrusted intermediates (CVE-2026-111943); on every steady-state path the chains Innerwall verifies are anchored to the operator's own signing authority, and for enrollment against the system trust store the update is a real fix.
• Documentation from the release gate (#215, #219). The multi-host guide has the reader verify the VM-reachable address before the certificate is minted, and names the host-alias fallback for virtual networks whose gateway is not the host; the retirement docs say how a host returning before its old credential expires comes back (stop the daemon, remove the state directory, enroll).

Upgrading

• Migrations. Two, 00017 and 00018, both additive: innerwall migrate or serve --migrate.
• Agents. No agent behavior or wire-contract change in this release. A v0.4.x agent works in full against a v0.5.0 control plane; upgrade in either order, or leave agents as they are. The v0.5.0 agent binary differs only by the Go toolchain it is built on.
• API. Every change is additive: the retire endpoint, lifecycle, renewable_until, serial, and last_presented on the credential, the retired filter and count.

Known limitations

The server-side evidence guard on mode changes and duplicate-identity detection remain unbuilt and on the public backlog; the recorded revocation story is retirement, short-lived certificates, and token revocation. Linux only, inbound only, one operator.