v0.1.0

0.1.0 (2026-11-04)

bk-agent-stack-orchard is a Buildkite stack controller. It runs each Buildkite job of one queue in
its own ephemeral macOS virtual machine (VM), on Apple silicon Macs that
Orchard and Tart manage. When the job
ends, the controller deletes the VM.

This is the first release. Until version 1.0, a minor release can contain a breaking change, so
pin an exact version or an image digest.

What you need

• A Buildkite cluster with a self-hosted queue for the macOS jobs, and a cluster agent token for
  that queue. Other runners can serve the same queue: the controller skips each job that no
  profile carries.
• An Orchard controller, version 0.58.0 or later, with a service account for this controller.
• Apple silicon Mac hosts that run an Orchard worker and Tart 2.39.0 or later. The example
  playbook in deploy/hosts installs Orchard 0.58.0, Tart 2.41.1, and Softnet 0.24.1, and needs
  macOS 27.2 or later on the hosts.
• A Tart image for each profile, which you build. The project publishes no job VM image.
  images/ is a reference build. By default, each VM downloads a pinned buildkite-agent v4
  release when it starts.
• Optional: an OpenTelemetry collector that receives OTLP. The controller exports metrics,
  traces, and logs over OTLP only.

The install guide
gives the steps. The
README
lists the limitations of this release.

Artifacts

Artifact	Where
Binaries for macOS (arm64) and Linux (amd64, arm64)	The archives of this release, with SPDX SBOMs
Container image	ghcr.io/joshwrightcodes/bk-agent-stack-orchard:v0.1.0
Helm chart	oci://ghcr.io/joshwrightcodes/charts/bk-agent-stack-orchard, version 0.1.0, and the chart package of this release

The release workflow signs each artifact with a keyless cosign signature and attests its build
provenance. To check all of them, download checksums.txt, checksums.txt.sigstore.json, an
archive, and the chart package with its .sigstore.json file, and run
scripts/verify-release.sh v0.1.0 <directory> from a clone of the repository.
Verify a release
gives the details and the commands to check one artifact.

Report a vulnerability privately, as
SECURITY.md
describes.

Features

• admission: admit on fresh state, place waiting VMs as Orchard does (#64) (4a9b049)
• admission: count the fleet room and choose the jobs to start (#42) (548218c)
• buildkite: talk to the Stacks API through a narrow interface (#35) (0f1a503)
• config: read and validate the controller configuration (#31) (3ae32a6)
• controller: admit after the first job states, and prove restarts (#68) (b01fdfe)
• controller: run the tick that registers the stack and polls (#41) (3b758e1)
• deploy: add a Helm chart for the controller (#85) (3e576d3)
• deploy: run the Orchard controller on Kubernetes (#88) (057cad1)
• health: serve liveness and readiness over gRPC health checking (#75) (5b0301f)
• hosts: keep the job VMs away from their host with pf (#101) (016e33a)
• hosts: make a Mac host an Orchard worker with Ansible (#96) (bb4963b)
• hosts: move to Softnet 0.24 and Tart 2.40, and block by address (#107) (b162088)
• images: build an agent image without Xcode (#94) (0f83ca0)
• images: build the agent image from the vanilla macOS image (#115) (0c3e1fd)
• images: build the pilot image from the vanilla macOS image (#116) (6acf9ac)
• jobstates: record each job state with the time that it was asked (#50) (ee1f154)
• launcher: reserve a job, get its token, and start its machine (#43) (3cc1819)
• match: select a profile from the agent tags of a job (#33) (b7e2486), closes #5
• orchard: call the Orchard API with a generated client (#34) (5268cd6)
• progress: show each step of a VM on its job page (#79) (ad825f0)
• reaper: carry out every action of the decision table (#56) (0439b21)
• reaper: delete a machine when its job ends or it lives too long (#46) (6f53fd3)
• reaper: extend every reservation of a tick in one call (#58) (ed426ed)
• reaper: read all thirteen rows of the decision table (#55) (a8f5c63)
• reaper: tell the job page why the controller ended the job (#57) (ca60056)
• telemetry: count API errors, and complete the job and tick traces (#78) (e896919)
• telemetry: export OpenTelemetry metrics, traces, and logs (#36) (351b920)
• vmspec: build the specification of a job virtual machine (#32) (19e56d2)
• vmspec: download the agent when the vm starts (#156) (f0f7c66)
• vmspec: name the host after the vm and add image tags (#152) (4f6dbc6)

Fixes

• bound api calls so a slow service cannot stall the loop (#177) (6096700)
• close the gaps of the fix stack review (#185) (4d7d85b)
• controller: start each job once, and read each source on time (#48) (85ca71a)
• deps: move golang.org/x/net to 0.62.0 (#134) (ed8cff3)
• deps: update go minor and patch (#148) (c778171)
• deps: update module google.golang.org/grpc to v1.85.0 (#128) (a1c3e52)
• harden the controller for a first release (#146) (4ccba8e)
• harden the probes, orchard trust, and deploy egress (#180) (840b876)
• hosts: drain a host before a change, prune unused images (#192) (a3614db)
• hosts: keep the mac host closed to every job vm (#179) (167a46c)
• hosts: run tart by its path in the image tasks (#194) (ae4b6c6)
• images: agent 4.9.0, macOS 27.2 everywhere, Tart 2.41.1 (#140) (6ea6209)
• images: pass the release gate on the pilot image (#151) (d1db998)
• inventory: decide that a worker is offline by the injected clock (#45) (055b771)
• inventory: never treat another controller's vms as orphans (#175) (164a28d)
• keep orchard internal and give each host its own account (#150) (c34e01e)
• launcher: give each token the start timeouts of its profile (#188) (aaeb36c)
• make the I-2 check and admission order deterministic (#193) (4c11f7c)
• orchard: trust the Orchard certificate that the operator gives (#86) (f3c60c8)
• quickstart: run orchard on loopback with authentication (#176) (704fc75)
• reaper: close the reaper and token gaps of the review (#191) (fb2a5f0)
• reaper: show the startup script of a machine that failed (#103) (5c0fa24)
• refuse a release whose commit is not on main (#165) (c6a523c)
• refuse plain HTTP endpoints, and patch Go for two vulns (#138) (481b735)
• run the creates and deletes of a tick in parallel (#183) (3c53241)
• scripts: fix the correctness findings of the script review (#170) (c2ca3c9)
• stack: sweep the queue behind a long head of unmatched jobs (#178) (92b8541)
• telemetry: close the telemetry gaps of the review (#196) (cdd63ed)
• test the invariants and measure the pilot exit criteria (#149) (3f9549d)
• vmspec: remove extra git credential helpers before the agent (#157) (3f615a9)