v1.3.0

What's Changed

• chore(security): retire the withdrawn braces advisory's osv ignore by @bonk-ai[bot] in #742
• docs: region and pricing claims follow the 2026-10-24 AWS measurements (#743) by @bonk-ai[bot] in #744
• feat: every region name works; the five-region list is deprecated (#743) by @bonk-ai[bot] in #745
• chore: prepare 1.3.0 release by @bonk-ai[bot] in #746

Full Changelog: v1.2.1...v1.3.0

v1.2.1

What's Changed

• docs: re-point the citations #669 to #716 moved, and drop the debt 1.2.0 paid by @bonk-ai[bot] in #719
• chore(deps): nightly rollup 2026-10-19 by @bonk-ai[bot] in #718
• fix(edges): a rename refused after an identical install still installs (#717) by @bonk-ai[bot] in #720
• chore(deps): nightly rollup 2026-10-20 by @bonk-ai[bot] in #726
• docs: document dockerfile --preserve-user and re-point the agentd citation #720 moved by @bonk-ai[bot] in #727
• fix(deps): rustls-webpki 0.103.16, certifi 2026.10.19, markdown-it 14.3.3 and vite 8.3.4 for the 2026-10-20 advisories by @bonk-ai[bot] in #728
• chore(deps): nightly rollup 2026-10-21 by @bonk-ai[bot] in #731
• build(deps): pyo3 0.30.1, with the wider input types the stub now carries (#722) by @bonk-ai[bot] in #729
• chore(deps): bump the three Sigstore crates to 0.15.0 together by @bonk-ai[bot] in #730
• docs: pyo3 0.30 in the system overview, and the cost.rs citations #729 moved by @bonk-ai[bot] in #733
• chore(deps): nightly rollup 2026-10-22 by @bonk-ai[bot] in #735
• docs: correct the Python README's cancellation rules and exception attributes by @bonk-ai[bot] in #736
• chore(deps): nightly rollup 2026-10-23 by @bonk-ai[bot] in #737
• docs: correct three contributor-doc claims the tree no longer matches by @bonk-ai[bot] in #738
• fix(deps): site lockfile for the 2026-10-23 fast-uri, undici and zod advisories by @bonk-ai[bot] in #740
• chore: prepare 1.2.1 release by @bonk-ai[bot] in #739
• test(live): run BIND-15's unlisted-region preflight in us-west-1 by @bonk-ai[bot] in #741

Full Changelog: v1.2.0...v1.2.1

v1.2.0

What's Changed

• chore(deps): nightly rollup 2026-10-16 by @bonk-ai[bot] in #666
• fix(tools): ask git about a symlink without its directory form in agents:check by @bonk-ai[bot] in #667
• docs: name exec --poweroff-on-exit and re-point the Maturin pin test by @bonk-ai[bot] in #668
• chore(deps): Rust 1.99.1 by @bonk-ai[bot] in #669
• fix: release sandbox when image ensure is canceled by @laithalsaadoon in #684
• fix: correct preflight IAM action hint by @laithalsaadoon in #679
• test: stabilize the mutation budget fixture by @laithalsaadoon in #680
• refactor: centralize the shared default daemon port by @laithalsaadoon in #693
• build: pin the optional formal verifier environment by @laithalsaadoon in #682
• feat: add authenticated default-user discovery by @laithalsaadoon in #687
• Measure ready hooks beyond five minutes in live conformance by @laithalsaadoon in #691
• Verify the Box example on native ARM64 Linux by @laithalsaadoon in #681
• fix: isolate concurrent daemon cache installs by @laithalsaadoon in #683
• fix: use the shared daemon port throughout conformance by @laithalsaadoon in #699
• Move durable run records and history into shared client layers by @laithalsaadoon in #685
• test: share offline control-plane parity fixtures by @laithalsaadoon in #688
• feat: preserve the final Dockerfile user when wrapping by @laithalsaadoon in #695
• test: prove shared parity cases against the merge base by @laithalsaadoon in #697
• fix: diagnose null-message access denials without blaming the region by @laithalsaadoon in #690
• feat: sweep images and VMs by prefix with keep lists by @laithalsaadoon in #689
• fix: share cached credential providers across clients by @laithalsaadoon in #686
• fix(python): drain async wake callbacks before shutdown by @laithalsaadoon in #701
• Expose configurable throttle retries and launch timing by @laithalsaadoon in #694
• feat(parity): cover strings, zero, absent and TypeScript defaults by @laithalsaadoon in #696
• Extend parity inventory to public inputs and types by @laithalsaadoon in #698
• Retry throttled conformance observer snapshots by @laithalsaadoon in #702
• Add scoped hosted recovery for interrupted live runs by @laithalsaadoon in #703
• Fix recovery repository metadata endpoint by @laithalsaadoon in #704
• Bind recovery provenance to direct job logs by @laithalsaadoon in #705
• Retry throttled recovery observations within the shared deadline by @laithalsaadoon in #706
• fix: complete approved image recovery before log dependency checks by @laithalsaadoon in #707
• ci: collect read-only recovery observations by @laithalsaadoon in #709
• fix: bound terminated history in recovery observations by @laithalsaadoon in #710
• fix: retry shutdown observation when a procfs row vanishes by @laithalsaadoon in #713
• fix: refresh native credentials throughout live verification by @laithalsaadoon in #708
• fix(conformance): repair the four live-suite failures from run 39088836602 by @laithalsaadoon in #714
• chore: prepare 1.2.0 release by @laithalsaadoon in #716

Full Changelog: v1.1.1...v1.2.0

v1.1.1

What's Changed

• fix(ci): keep live credentials valid through cleanup by @laithalsaadoon in #661
• fix(ci): provide matching releases to main quickstart by @laithalsaadoon in #662
• fix: select published releases for version skew by @laithalsaadoon in #664
• chore: prepare v1.1.1 release by @laithalsaadoon in #665

Full Changelog: v1.1.0...v1.1.1

v1.0.1

What's Changed

• docs: re-point the source citations the 2026-10-11 changes moved after #555 by @bonk-ai[bot] in #590
• chore(deps): nightly rollup 2026-10-12 by @bonk-ai[bot] in #589
• docs: fix the site's broken internal links and check every built link by @bonk-ai[bot] in #591
• fix(agentd): report the release number as the daemon's version by @bonk-ai[bot] in #593
• chore: prepare 1.0.1 release by @bonk-ai[bot] in #596

Full Changelog: v1.0.0...v1.0.1

v1.0.0

Upgrade notes

• Verified tunnels use wire protocol 2. Wire protocol 2 binds the version, route, and guest port to each session. It confirms the session before it dials the guest. Peers refuse protocol 1 verified handshakes. Upgrade the client and daemon as a pair. Rebuild existing guest images before using verified tunnels. (#585)
• The npm package is now microvms. Replace @theagenticguy/microvms with microvms in installation commands and imports. (#578)

Changed

• Refresh source contract notes and CLI installation (#553). The installation task uses the current crate directory. Source comments describe the split client layers, adoption, streaming output, and hook acknowledgment.
• Document the stable public surfaces (#553). The CLI, Python and Node packages, published Rust crates, and wire protocol now have a shared stability policy and deprecation window. Updated guides describe the supported workflows and link to the contract checks.
• Release builds use fixed tool versions (#561). The TypeScript declarations follow
  the pinned NAPI-RS generator and omit __napiBindingTarget, which the package loader
  does not export.

Fixed

• Redact run-hook debug output (#553). The payload and its envelope retain field names while omitting token, environment, and identity values.
• Describe the schema response as JSON (#554). Its advertised media type matches the response the endpoint serves.
• Bound client response and state handling (#559). Disable HTTP redirect following, cap buffered responses, preserve release verification outcomes, resolve default state under an absolute user home, and reset incomplete verified TCP streams.
• Bound daemon connection and hook processing (#560). Hook envelopes have
  explicit size and collection limits; connections have admission, header-read,
  and idle bounds. Rejected request draining and handler output collection finish
  within their budgets. Archive file replacement preserves other hard links.
• Use configured publishing forks and protected editor credentials (#562). Publish background changes through configured forks with Actions disabled, require a protected password configuration for the remote editor, validate local forwarded Host headers, and render job text literally.
• CLI credential inputs (#564): Read agent tokens and tunnel identity secrets from protected files or stdin, and recommend registered names for subsequent commands.
• Validate JavaScript native class identity (#565). Class arguments and getter receivers are checked against their declared native classes.

Full changelog

v0.12.0

What's Changed

• docs: add the missing flags to cli.md's command sections and fix its flag-group carriers by @bonk-ai[bot] in #527
• docs: re-point data-flow.md's citations and describe run's three image paths by @bonk-ai[bot] in #529
• docs: re-point the impact analysis's pinned cost rate table to the moved tree by @bonk-ai[bot] in #519
• docs: re-point the mise task citations that later tasks shifted by @bonk-ai[bot] in #533
• ci: set up uv in the weekly links workflow, so its site build runs by @laithalsaadoon in #531
• test(semver): drop the protocol crate's lint allowance now 0.11.0 is the baseline by @laithalsaadoon in #534
• chore(deps): bump the three Sigstore crates to 0.14.0 together by @laithalsaadoon in #535
• chore(deps): nightly rollup 2026-10-08 by @bonk-ai[bot] in #532
• test(semver): gate core, the domain, the app and the edges against 0.11.0 (#298) by @laithalsaadoon in #536
• chore(deps): Bump jdx/mise-action from 5.0.1 to 5.1.1 in /.github/actions/mise in the actions group across 1 directory by @dependabot[bot] in #525
• chore(deps): nightly rollup 2026-10-09 by @bonk-ai[bot] in #538
• docs: correct cli.md's microvm.toml section and envelope key lists against the code by @bonk-ai[bot] in #539
• fix: four of the #280 follow-ups: mint credentials, listing dedupe, ensure identity, launch_image_arn by @laithalsaadoon in #540
• ci: one aggregate check for each sharded mutation job (#299) by @laithalsaadoon in #541
• feat(cost): a report counts no cycle unless named, the comparison one (#280) by @laithalsaadoon in #543
• test(conformance): drive the bindings' tunnel, port-forward and import handles live (#280) by @laithalsaadoon in #542
• docs(strategy): AgentCore runtime parity is no longer out of scope by @laithalsaadoon in #546
• feat(py): native asyncio awaitables beside every blocking method (#544) by @laithalsaadoon in #545
• fix(deps): clear Scorecard's vulnerability and pinning findings by @laithalsaadoon in #547
• release: 0.12.0 by @laithalsaadoon in #548

Full Changelog: v0.11.0...v0.12.0

v0.11.0

What's Changed

• chore(example): pin the background example to the published microvms 0.10.0 wheel by @laithalsaadoon in #241
• docs(site): Content-Signal lines and the legacy Anthropic group in the crawler policy, matching the origin's robots.txt by @bonk-ai[bot] in #242
• docs: re-point 475 citations, refresh counts, and list the 0.10.0 SDK surface by @bonk-ai[bot] in #243
• docs(site): generated Python and TypeScript SDK reference by @bonk-ai[bot] in #244
• chore(deps): nightly rollup 2026-09-25 by @bonk-ai[bot] in #245
• docs: re-point mise.toml citations and list every task check runs by @bonk-ai[bot] in #246
• docs: rename CLAUDE.md to AGENTS.md and add comment and count rules by @bonk-ai[bot] in #247
• docs: drop undated counts from prose by @bonk-ai[bot] in #248
• test: ratchet the layering drift count with ratchet/drift.json and mise run ratchet:check by @bonk-ai[bot] in #287
• cli+bindings: enforce the driving-adapter contract with per-crate clippy rules and exact dependency sets by @bonk-ai[bot] in #288
• core: extract microvms-domain, a crate that can't do I/O, and amend ARCH-1 by @bonk-ai[bot] in #289
• core: split microvms-app and microvms-edges out of core, with one Clock, and make core the composition root by @bonk-ai[bot] in #290
• provision: fetch and verify the daemon release in Rust instead of spawning gh and curl by @bonk-ai[bot] in #291
• docs: SECURITY.md describes the in-process release verification by @bonk-ai[bot] in #292
• docs: AGENTS.md code map names the app and edges crates by @bonk-ai[bot] in #293
• docs: AGENTS.md for each crate with local rules by @bonk-ai[bot] in #294
• test: scanner gates assert a non-empty input and a sentinel, and live eq refuses absent-equals-absent by @bonk-ai[bot] in #308
• test: trace:check counts a key as tested only where a test or harness names it by @bonk-ai[bot] in #312
• test: a seeded-fault registry proves each guard fails on the fault it names by @bonk-ai[bot] in #313
• test: clippy bans, adapter-logic rules and a StartRequest builder keep the adapters thin by @bonk-ai[bot] in #314
• test: CI's Linux jobs run locally with CI's env and tools, and guards:fire runs in parallel by @bonk-ai[bot] in #316
• chore(deps): nightly rollup 2026-09-28 by @bonk-ai[bot] in #317
• test: a checked-in capability table holds core, the CLI, Python and TypeScript to the same names by @bonk-ai[bot] in #318
• docs: re-point analysis-page citations of PLATFORM, STRATEGY and TRUST after their rewrite by @bonk-ai[bot] in #319
• test: a mutants job fails a pull request whose tests miss a mutant of its changed Rust by @bonk-ai[bot] in #321
• test: a shared JSON case corpus that core, the CLI, Python and TypeScript answer identically by @bonk-ai[bot] in #322
• docs: AGENTS.md names the check behind each parity and guard rule, and agents:check fails on a name that doesn't exist by @bonk-ai[bot] in #329
• chore(deps): bump fast-uri to 3.1.8 in the docs site for GHSA-58mr-gqgx-xq4g and GHSA-qw65-cvwx-89v3 by @bonk-ai[bot] in #331
• chore(deps): bump undici to 8.11.2 in the docs site for GHSA-3wwx-pv8p-q78v by @bonk-ai[bot] in #332
• test: the ratchet counts every spec requirement TRACED doesn't list, so the untraced count can only go down by @bonk-ai[bot] in #330
• test: the guards job fires the entries a pull request affects, and every entry on a push to main by @bonk-ai[bot] in #334
• test: a schema check fails a wire change that breaks a caller of the previous release by @bonk-ai[bot] in #339
• test: agentd's tests walk the bootstrap and exec model and replay every path against the daemon by @bonk-ai[bot] in #341
• security: a threat table bound to named tests, four new requirement keys, and a fuzz harness for the client's event-stream parser by @bonk-ai[bot] in #344
• test: the guards job fires in three shards, with 60 minutes a shard on pull requests and pushes by @bonk-ai[bot] in #346
• fix: six parity bugs across the CLI, Python and TypeScript (#280 wave 1) by @bonk-ai[bot] in #340
• test: a model-conformance crate drives the app's tables and a Sandbox over every row and path of the models by @bonk-ai[bot] in #343
• fix: check-parity.py locates TypeDoc under a lock beside npm's cache by @bonk-ai[bot] in #349
• fix: fault messages carry no tree version or SHA, and Dependabot groups action bumps by @bonk-ai[bot] in #350
• perf: guards workers start warm, fault steps build incrementally, and one job saves the guards cache by @bonk-ai[bot] in #351
• chore(deps): bump syn from 2.0.119 to 3.0.6 in /agentd/fuzz by @dependabot[bot] in #352
• chore(deps): bump syn from 2.0.119 to 3.0.6 by @dependabot[bot] in #353
• chore(deps): bump the actions group across 1 directory with 5 updates by @dependabot[bot] in #354
• test: the model-conformance walk runs as parallel slices that cover every path once by @bonk-ai[bot] in #355
• test: agents:check resolves every path the hooks, tasks, workflows and scripts name by @bonk-ai[bot] in #356
• perf: the local check loop stops recompiling after the rustdoc walk and runs the unit suites in parallel by @bonk-ai[bot] in #361
• build: changelog entries are towncrier fragments, and a pull request that changes shipped code adds one by @bonk-ai[bot] in #360
• refactor: conformance/run_rs.py is an entry point over a harness, lane modules and the self-test by @bonk-ai[bot] in #363
• perf: lint faults fire in batches attributed by span, and each build's restored check runs once its faults are done by @bonk-ai[bot] in #364
• ci: the background example runs in the ubuntu tier, and fuzz runs as two jobs that share installs and builds by @bonk-ai[bot] in #359
• refactor: TRACED lives in one file per requirement group by @bonk-ai[bot] in #366
• refactor: the CLI's guard tests live in one module per command area by @bonk-ai[bot] in #368
• perf: bindings faults fire in the guards shards, each worker in its own environment by @bonk-ai[bot] in #367
• fix: check's cargo tasks can't rebuild a dependency under another task's doc tests by @bonk-ai[bot] in #369
• refactor: the seeded-fault registry is one file per owner in guards/faults/ by @bonk-ai[bot] in #370
• build: lefthook, lychee and trivy configs live in .config/, and deny.toml in .cargo/ by @bonk-ai[bot] in #372
• chore(deps): bump tokio-rustls from 0.26.5 to 0.26.6 by @bonk-ai[bot] in #371
• perf: guards shards weigh each command's own runs and batched lint entries, and the job fires in six legs by @bonk-ai[bot] in #373
• refactor: the crates live in crates/ and bindings/, the verification data in verify/, and scripts/ is tools/ by @bonk-ai[bot] in #374
• test: test_ratchet.py and the ratchet's git reads drop a hook's GIT_DIR (#311) by @bonk-ai[bot] in #375
• test(conformance): the ensure-image cleanup finds the run's VM...

v0.10.0

What's Changed

• chore(deps): nightly rollup 2026-09-24 by @bonk-ai[bot] in #214
• docs: re-point 476 citations, refresh counts, and list the 0.9.0 protocol fields by @bonk-ai[bot] in #215
• fix(cli): a closed stdout or stderr never panics the CLI or changes its outcome (#216) by @laithalsaadoon in #217
• fix(core): cold-start budget for the agent version probe; the live suite survives a raising section by @laithalsaadoon in #218
• feat: Sandbox.detach() hands a launched VM to another process without a leak warning by @laithalsaadoon in #230
• feat(example): SDK-only VM lifecycle, published wheels, and a live end-to-end run by @laithalsaadoon in #229
• chore(trace): trace requirements from both specs across every crate, with stated layer waivers by @laithalsaadoon in #231
• feat(core,bindings): wrap_dockerfile and BaseImage.from_dockerfile for task Dockerfiles (#220) by @laithalsaadoon in #232
• feat(protocol): exec names its user, group and shell, and may inherit the image ENV (#224, #225, #226) by @laithalsaadoon in #235
• feat: provision_agentd in core and every binding, with verified cache and aarch64 checks (#219) by @laithalsaadoon in #234
• feat: Session.run_to_completion and ExecResult.posix_exit_code / notes (#222) by @laithalsaadoon in #233
• feat(bind): egress posture on the launched session and a request-side egress_posture_for (#227) by @laithalsaadoon in #236
• feat(bind): SizeClass.from_request and preflight in core and both bindings (#223) by @laithalsaadoon in #238
• feat(core,bindings): Sandbox.ensure_image, content-addressed build-or-reuse with a build context and S3 upload (#221) by @laithalsaadoon in #237
• docs(embedding): the provider shape a harness environment builds over the bindings by @laithalsaadoon in #239
• release: 0.10.0 by @laithalsaadoon in #240

Full Changelog: v0.9.0...v0.10.0

v0.9.0

What's Changed

• feat(cli): every run reports its egress posture, and --deny-egress is the honest limit by @laithalsaadoon in #167
• chore(deps): nightly rollup 2026-09-14 by @bonk-ai[bot] in #168
• docs(architecture): the overview counts 28 commands' lines and 188 live checks, as the tree does by @bonk-ai[bot] in #169
• chore(deps): nightly rollup 2026-09-15 by @bonk-ai[bot] in #175
• docs(reference): re-point the CLI page's 129 drifted path:line citations at the 0.8.0 tree by @bonk-ai[bot] in #176
• chore(deps): nightly rollup 2026-09-16 by @bonk-ai[bot] in #177
• docs(reference): re-point 202 drifted path:line citations on public-api and rpc-tools, and correct two counts by @bonk-ai[bot] in #178
• Improve sandbox onboarding, VPC egress support, and SDK validation by @laithalsaadoon in #179
• chore(deps): nightly rollup 2026-09-17 by @bonk-ai[bot] in #180
• docs(architecture, reference): agentd has twelve modules, cli.rs is 3,024 lines, and --connector is absent by name by @bonk-ai[bot] in #181
• chore(deps): nightly rollup 2026-09-18 by @bonk-ai[bot] in #183
• docs(architecture, analysis): every LOC figure counts the tree at 78304e3, and microvms-core has eleven modules over 34 files by @bonk-ai[bot] in #182
• docs(readme): restore badges, add Open-in-agent badges and a copyable start prompt by @laithalsaadoon in #184
• chore(deps): nightly rollup 2026-09-21 by @bonk-ai[bot] in #185
• docs(reference): Health lists hooks and hooks_dropped, the image hooks take State, RunHook carries the identity halves, and StartRequest has reap_group_on_exit by @bonk-ai[bot] in #186
• chore(deps): nightly rollup 2026-09-22 by @bonk-ai[bot] in #191
• docs(reference): re-point the path:line citations that #179 moved in cli.md and public-api.md, and give suspend_hook and terminate_hook their State argument by @bonk-ai[bot] in #192
• chore(deps): nightly rollup 2026-09-23 by @bonk-ai[bot] in #193
• docs(ccu): re-point 280 path:line citations on twelve ccu pages from each page's authoring commit by @bonk-ai[bot] in #194
• docs: one page on suspend and resume semantics, with the 2026-09-23 measurements by @laithalsaadoon in #207
• feat: background coding agent example; attach, permission modes, and group reaping in the SDKs by @laithalsaadoon in #206
• feat: lifecycle by ID in the SDKs, adopted-launch resume, per-VM logging, launch parity by @laithalsaadoon in #208
• feat: keep a busy VM awake from outside (core, Python, JS, CLI) by @laithalsaadoon in #209
• feat(agentd): per-VM identity at the run hook; workload hook handlers; Health.hooks in the SDKs by @laithalsaadoon in #210
• feat: adopt a VM by ID into a Sandbox or AgentVm (core, Python, JS) by @laithalsaadoon in #211
• feat: find a VM by name from any process, in core and both bindings by @laithalsaadoon in #212
• release: 0.9.0 by @laithalsaadoon in #213

Full Changelog: v0.8.0...v0.9.0