v0.1.1

0.1.1 (2026-11-04)

A patch release. To upgrade from 0.1.0, change the version: the configuration does not change.

• The controller keeps the log records that it writes while it stops. Before, it lost the records
  that came after SIGTERM or Ctrl-C, on stdout and in the OTLP export, and a line
  context canceled took their place.
• The release now also carries checksums.txt.intoto.jsonl, the bundle of the provenance
  attestation of checksums.txt. With it, you can check the provenance without the attestation
  API, and scripts/verify-release.sh checks it when it is in the directory.
  Verify a release
  gives the details.

Fixes

• telemetry: keep the log records that come after a signal (#197) (87105c7)

v0.1.0

0.1.0 (2026-11-04)

bk-agent-stack-orchard is a Buildkite stack controller. It runs each Buildkite job of one queue in
its own ephemeral macOS virtual machine (VM), on Apple silicon Macs that
Orchard and Tart manage. When the job
ends, the controller deletes the VM.

This is the first release. Until version 1.0, a minor release can contain a breaking change, so
pin an exact version or an image digest.

What you need

• A Buildkite cluster with a self-hosted queue for the macOS jobs, and a cluster agent token for
  that queue. Other runners can serve the same queue: the controller skips each job that no
  profile carries.
• An Orchard controller, version 0.58.0 or later, with a service account for this controller.
• Apple silicon Mac hosts that run an Orchard worker and Tart 2.39.0 or later. The example
  playbook in deploy/hosts installs Orchard 0.58.0, Tart 2.41.1, and Softnet 0.24.1, and needs
  macOS 27.2 or later on the hosts.
• A Tart image for each profile, which you build. The project publishes no job VM image.
  images/ is a reference build. By default, each VM downloads a pinned buildkite-agent v4
  release when it starts.
• Optional: an OpenTelemetry collector that receives OTLP. The controller exports metrics,
  traces, and logs over OTLP only.

The install guide
gives the steps. The
README
lists the limitations of this release.

Artifacts

Artifact	Where
Binaries for macOS (arm64) and Linux (amd64, arm64)	The archives of this release, with SPDX SBOMs
Container image	ghcr.io/joshwrightcodes/bk-agent-stack-orchard:v0.1.0
Helm chart	oci://ghcr.io/joshwrightcodes/charts/bk-agent-stack-orchard, version 0.1.0, and the chart package of this release

The release workflow signs each artifact with a keyless cosign signature and attests its build
provenance. To check all of them, download checksums.txt, checksums.txt.sigstore.json, an
archive, and the chart package with its .sigstore.json file, and run
scripts/verify-release.sh v0.1.0 <directory> from a clone of the repository.
Verify a release
gives the details and the commands to check one artifact.

Report a vulnerability privately, as
SECURITY.md
describes.

Features

• admission: admit on fresh state, place waiting VMs as Orchard does (#64) (4a9b049)
• admission: count the fleet room and choose the jobs to start (#42) (548218c)
• buildkite: talk to the Stacks API through a narrow interface (#35) (0f1a503)
• config: read and validate the controller configuration (#31) (3ae32a6)
• controller: admit after the first job states, and prove restarts (#68) (b01fdfe)
• controller: run the tick that registers the stack and polls (#41) (3b758e1)
• deploy: add a Helm chart for the controller (#85) (3e576d3)
• deploy: run the Orchard controller on Kubernetes (#88) (057cad1)
• health: serve liveness and readiness over gRPC health checking (#75) (5b0301f)
• hosts: keep the job VMs away from their host with pf (#101) (016e33a)
• hosts: make a Mac host an Orchard worker with Ansible (#96) (bb4963b)
• hosts: move to Softnet 0.24 and Tart 2.40, and block by address (#107) (b162088)
• images: build an agent image without Xcode (#94) (0f83ca0)
• images: build the agent image from the vanilla macOS image (#115) (0c3e1fd)
• images: build the pilot image from the vanilla macOS image (#116) (6acf9ac)
• jobstates: record each job state with the time that it was asked (#50) (ee1f154)
• launcher: reserve a job, get its token, and start its machine (#43) (3cc1819)
• match: select a profile from the agent tags of a job (#33) (b7e2486), closes #5
• orchard: call the Orchard API with a generated client (#34) (5268cd6)
• progress: show each step of a VM on its job page (#79) (ad825f0)
• reaper: carry out every action of the decision table (#56) (0439b21)
• reaper: delete a machine when its job ends or it lives too long (#46) (6f53fd3)
• reaper: extend every reservation of a tick in one call (#58) (ed426ed)
• reaper: read all thirteen rows of the decision table (#55) (a8f5c63)
• reaper: tell the job page why the controller ended the job (#57) (ca60056)
• telemetry: count API errors, and complete the job and tick traces (#78) (e896919)
• telemetry: export OpenTelemetry metrics, traces, and logs (#36) (351b920)
• vmspec: build the specification of a job virtual machine (#32) ([19e56d2](19e56d2431876f...