v0.11.0

What's Changed

• chore(example): pin the background example to the published microvms 0.10.0 wheel by @laithalsaadoon in #241
• docs(site): Content-Signal lines and the legacy Anthropic group in the crawler policy, matching the origin's robots.txt by @bonk-ai[bot] in #242
• docs: re-point 475 citations, refresh counts, and list the 0.10.0 SDK surface by @bonk-ai[bot] in #243
• docs(site): generated Python and TypeScript SDK reference by @bonk-ai[bot] in #244
• chore(deps): nightly rollup 2026-09-25 by @bonk-ai[bot] in #245
• docs: re-point mise.toml citations and list every task check runs by @bonk-ai[bot] in #246
• docs: rename CLAUDE.md to AGENTS.md and add comment and count rules by @bonk-ai[bot] in #247
• docs: drop undated counts from prose by @bonk-ai[bot] in #248
• test: ratchet the layering drift count with ratchet/drift.json and mise run ratchet:check by @bonk-ai[bot] in #287
• cli+bindings: enforce the driving-adapter contract with per-crate clippy rules and exact dependency sets by @bonk-ai[bot] in #288
• core: extract microvms-domain, a crate that can't do I/O, and amend ARCH-1 by @bonk-ai[bot] in #289
• core: split microvms-app and microvms-edges out of core, with one Clock, and make core the composition root by @bonk-ai[bot] in #290
• provision: fetch and verify the daemon release in Rust instead of spawning gh and curl by @bonk-ai[bot] in #291
• docs: SECURITY.md describes the in-process release verification by @bonk-ai[bot] in #292
• docs: AGENTS.md code map names the app and edges crates by @bonk-ai[bot] in #293
• docs: AGENTS.md for each crate with local rules by @bonk-ai[bot] in #294
• test: scanner gates assert a non-empty input and a sentinel, and live eq refuses absent-equals-absent by @bonk-ai[bot] in #308
• test: trace:check counts a key as tested only where a test or harness names it by @bonk-ai[bot] in #312
• test: a seeded-fault registry proves each guard fails on the fault it names by @bonk-ai[bot] in #313
• test: clippy bans, adapter-logic rules and a StartRequest builder keep the adapters thin by @bonk-ai[bot] in #314
• test: CI's Linux jobs run locally with CI's env and tools, and guards:fire runs in parallel by @bonk-ai[bot] in #316
• chore(deps): nightly rollup 2026-09-28 by @bonk-ai[bot] in #317
• test: a checked-in capability table holds core, the CLI, Python and TypeScript to the same names by @bonk-ai[bot] in #318
• docs: re-point analysis-page citations of PLATFORM, STRATEGY and TRUST after their rewrite by @bonk-ai[bot] in #319
• test: a mutants job fails a pull request whose tests miss a mutant of its changed Rust by @bonk-ai[bot] in #321
• test: a shared JSON case corpus that core, the CLI, Python and TypeScript answer identically by @bonk-ai[bot] in #322
• docs: AGENTS.md names the check behind each parity and guard rule, and agents:check fails on a name that doesn't exist by @bonk-ai[bot] in #329
• chore(deps): bump fast-uri to 3.1.8 in the docs site for GHSA-58mr-gqgx-xq4g and GHSA-qw65-cvwx-89v3 by @bonk-ai[bot] in #331
• chore(deps): bump undici to 8.11.2 in the docs site for GHSA-3wwx-pv8p-q78v by @bonk-ai[bot] in #332
• test: the ratchet counts every spec requirement TRACED doesn't list, so the untraced count can only go down by @bonk-ai[bot] in #330
• test: the guards job fires the entries a pull request affects, and every entry on a push to main by @bonk-ai[bot] in #334
• test: a schema check fails a wire change that breaks a caller of the previous release by @bonk-ai[bot] in #339
• test: agentd's tests walk the bootstrap and exec model and replay every path against the daemon by @bonk-ai[bot] in #341
• security: a threat table bound to named tests, four new requirement keys, and a fuzz harness for the client's event-stream parser by @bonk-ai[bot] in #344
• test: the guards job fires in three shards, with 60 minutes a shard on pull requests and pushes by @bonk-ai[bot] in #346
• fix: six parity bugs across the CLI, Python and TypeScript (#280 wave 1) by @bonk-ai[bot] in #340
• test: a model-conformance crate drives the app's tables and a Sandbox over every row and path of the models by @bonk-ai[bot] in #343
• fix: check-parity.py locates TypeDoc under a lock beside npm's cache by @bonk-ai[bot] in #349
• fix: fault messages carry no tree version or SHA, and Dependabot groups action bumps by @bonk-ai[bot] in #350
• perf: guards workers start warm, fault steps build incrementally, and one job saves the guards cache by @bonk-ai[bot] in #351
• chore(deps): bump syn from 2.0.119 to 3.0.6 in /agentd/fuzz by @dependabot[bot] in #352
• chore(deps): bump syn from 2.0.119 to 3.0.6 by @dependabot[bot] in #353
• chore(deps): bump the actions group across 1 directory with 5 updates by @dependabot[bot] in #354
• test: the model-conformance walk runs as parallel slices that cover every path once by @bonk-ai[bot] in #355
• test: agents:check resolves every path the hooks, tasks, workflows and scripts name by @bonk-ai[bot] in #356
• perf: the local check loop stops recompiling after the rustdoc walk and runs the unit suites in parallel by @bonk-ai[bot] in #361
• build: changelog entries are towncrier fragments, and a pull request that changes shipped code adds one by @bonk-ai[bot] in #360
• refactor: conformance/run_rs.py is an entry point over a harness, lane modules and the self-test by @bonk-ai[bot] in #363
• perf: lint faults fire in batches attributed by span, and each build's restored check runs once its faults are done by @bonk-ai[bot] in #364
• ci: the background example runs in the ubuntu tier, and fuzz runs as two jobs that share installs and builds by @bonk-ai[bot] in #359
• refactor: TRACED lives in one file per requirement group by @bonk-ai[bot] in #366
• refactor: the CLI's guard tests live in one module per command area by @bonk-ai[bot] in #368
• perf: bindings faults fire in the guards shards, each worker in its own environment by @bonk-ai[bot] in #367
• fix: check's cargo tasks can't rebuild a dependency under another task's doc tests by @bonk-ai[bot] in #369
• refactor: the seeded-fault registry is one file per owner in guards/faults/ by @bonk-ai[bot] in #370
• build: lefthook, lychee and trivy configs live in .config/, and deny.toml in .cargo/ by @bonk-ai[bot] in #372
• chore(deps): bump tokio-rustls from 0.26.5 to 0.26.6 by @bonk-ai[bot] in #371
• perf: guards shards weigh each command's own runs and batched lint entries, and the job fires in six legs by @bonk-ai[bot] in #373
• refactor: the crates live in crates/ and bindings/, the verification data in verify/, and scripts/ is tools/ by @bonk-ai[bot] in #374
• test: test_ratchet.py and the ratchet's git reads drop a hook's GIT_DIR (#311) by @bonk-ai[bot] in #375
• test(conformance): the ensure-image cleanup finds the run's VMs, images and log groups by its prefix (#310) by @bonk-ai[bot] in #376
• fix: check-dts-consumer.py installs tsc under the npx cache's lock and refuses a tsc npx didn't install (#348) by @bonk-ai[bot] in #377
• fix: agentd refuses or outlives a huge timeout_sec, and a huge service timestamp reads as absent (#335) by @bonk-ai[bot] in #378
• test: trace ARCH-1 to ARCH-4 (#307) by @bonk-ai[bot] in #379
• fix(app): ensure_image hashes and zips its artifact on the blocking pool, off the caller's worker (#309) by @bonk-ai[bot] in #380
• fix: doctor checks the region a microvm.toml pins, through run's own chain (#336) by @bonk-ai[bot] in #382
• test: trace BIND-1 to BIND-4, and amend BIND-1 to the bindings' protocol edge (#306) by @bonk-ai[bot] in #381
• test: trace CLI-1 to CLI-6, with named live checks for CLI-3 and CLI-4 (#304) by @bonk-ai[bot] in #384
• test: trace AGENTD-1 to AGENTD-6, with a model property and a live check per key (#305) by @bonk-ai[bot] in #389
• refactor: placement is computed once, in dependency_direction.rs, and the ratchet holds it to the base by @bonk-ai[bot] in #390
• fix: Python stream events are typed, tsc tells the hook timeouts apart, and the site writes Symbol.asyncIterator (#337) by @bonk-ai[bot] in #388
• ci(release): a tag drafts the release, and publishing waits on a live run of that draft by @bonk-ai[bot] in #383
• chore(deps): bump yoke-derive from the yanked 0.8.3 to 0.8.4 by @bonk-ai[bot] in #399
• test: the ratchet compares a change with its merge base, and nobody edits drift.json by @bonk-ai[bot] in #395
• fix(app): every build refuses a daemon that isn't an aarch64 ELF before the upload (#257) by @bonk-ai[bot] in #391
• docs: .erpaval is gone, and what cited it cites the code by @bonk-ai[bot] in #397
• security: a verified tunnel ends with a keyed end of stream, so a stream cut short no longer reads as complete (#342) by @bonk-ai[bot] in #398
• fix: a daemon 507 is InsufficientStorage, ERR_PLATFORM and not retryable (#256) by @bonk-ai[bot] in #404
• refactor(cli): attach mints through core's ControlPlaneMinter, and port-impl is enforced (#270) by @bonk-ai[bot] in #405
• test: a stateright model of the verified tunnel's handshake, frames and end of stream, and keys for the frame checks (#297) by @bonk-ai[bot] in #413
• test: the guards fire's work-stealing fixture orders its runs by marks, not by their durations by @bonk-ai[bot] in #415
• refactor: mise tasks live in one file per area under .config/mise/tasks by @bonk-ai[bot] in #406
• fix: Sandbox::run resolves a bare image name to its ARN, for every surface (#253) by @bonk-ai[bot] in #401
• refactor(py): register the exception classes from ErrorKind::ALL (#266) by @bonk-ai[bot] in #419
• feat: a terminate waits a given number of seconds for TERMINATED, on every surface (#267) by @bonk-ai[bot] in #411
• test(conformance): a version-skew section pairs this tree with the previous release both ways (#298) by @bonk-ai[bot] in #422
• test: trace TRAP-1 to TRAP-13, and amend TRAP-4 and TRAP-11 to what the client does (#301) by @bonk-ai[bot] in #407
• test: the ratchet counts the case corpus's known_drift markers and skips as parity drift (#320) by @bonk-ai[bot] in #424
• feat(bindings): Sandbox.preflight and Sandbox.managed_base_versions (#264, slice B) by @bonk-ai[bot] in #412
• refactor: every lifecycle wait is WaitOpts::for_lifecycle (#266) by @bonk-ai[bot] in #434
• fix: the ratchet and the unregistered-notes rule compare with the merge base of HEAD and --base by @bonk-ai[bot] in #435
• ci: every job installs mise from mise.lock and runs one ci: task, and ci:parity keeps what construction doesn't by @bonk-ai[bot] in #423
• feat(bindings): session_constants() publishes core's wait defaults (#266) by @bonk-ai[bot] in #433
• feat: split stdout and stderr in core, and add Python Session.spawn (#261) by @bonk-ai[bot] in #410
• feat: prompt_sync lives in core, and both bindings call it (#266) by @bonk-ai[bot] in #426
• perf(guards): a verdict cache replaces --affected, so a pull request fires what its change can move (#333) by @bonk-ai[bot] in #439
• feat: every keepalive surface takes the count of tolerated poll errors (#267) by @bonk-ai[bot] in #403
• feat(bindings): image administration on the ControlPlane (#264, slice A) by @bonk-ai[bot] in #409
• test: a semver job holds microvms-protocol to its last release on crates.io, and reports core (#298) by @bonk-ai[bot] in #438
• test: a names case area, a wait refusal that claims no report, and an offline stream test (#338) by @bonk-ai[bot] in #441
• fix(conformance): the skew section expects agentd's crate version from health, not the release tag (#298) by @bonk-ai[bot] in #444
• feat(bindings): run-to-completion takes reap_group_on_exit, as run does (#267) by @bonk-ai[bot] in #416
• feat(cli): exec --timeout-sec and --complete, and posixExitCode, notes, synthesized (#259) by @bonk-ai[bot] in #431
• test: publint and attw lint the npm package as npm pack makes it by @bonk-ai[bot] in #446
• feat(app): EnsureImageRequest carries a create request's fields, and AgentVm ensures its image (#258, core) by @bonk-ai[bot] in #429
• feat(cli): microvm names lists the name registry, and --delete clears a name (#267) by @bonk-ai[bot] in #417
• test: fuzz harnesses for the verified tunnel's handshake and frame reads, on the daemon and the client (#297) by @bonk-ai[bot] in #440
• refactor(tools): the script gates report every finding past an unreadable input by @bonk-ai[bot] in #449
• docs: the pull request rules, and pr-body:check holds each body to the template's sections and the size cap by @bonk-ai[bot] in #442
• fix: a cost report's defaults and JSON shape live in core (#255) by @bonk-ai[bot] in #447
• feat: line-range file reads in core, both bindings and cp --lines (#265) by @bonk-ai[bot] in #448
• test: FAIL_TO_PASS proves a fix's regression test on its merge base, and emits the entry every fire proves again by @bonk-ai[bot] in #456
• test: trace COST-1 to COST-10, with live checks on a real run's cost report (#303) by @bonk-ai[bot] in #460
• fix(guards): a pull request reads every leg's record from one push, so a command keeps its verdict whichever leg recorded it by @bonk-ai[bot] in #450
• feat(core): serve a tunnel and a port-forward in core, the loops the CLI now calls (#263) by @bonk-ai[bot] in #437
• feat(py): ControlPlane has a region property, as TypeScript's does (#267) by @bonk-ai[bot] in #453
• test: every surface default is held to core's through the parity table (#300) by @bonk-ai[bot] in #457
• perf(guards): a script gate's entries fire in one run, each proven by the one line that names its own file by @bonk-ai[bot] in #461
• test: mutmut ratchets the gate scripts' changed functions against their base by @bonk-ai[bot] in #452
• fix: Sandbox::run returns once the daemon answers, on every surface (#254) by @bonk-ai[bot] in #451
• feat(cli): image-versions, image-set-status and image-builds (#264, slice C) by @bonk-ai[bot] in #458
• refactor: directory sync and guarded extraction move into core (#260, core half) by @bonk-ai[bot] in #463
• feat(cli): dockerfile --wrap and --agent print core's other two Dockerfiles (#269) by @bonk-ai[bot] in #455
• feat: the budget gate is core's, and both bindings have it (#270) by @bonk-ai[bot] in #462
• test: trace STATE-1 to STATE-12, with a model property per transition and the replay credited (#302) by @bonk-ai[bot] in #471
• feat(bindings): AgentVm.launch takes launch_env, shell and ready_timeout (#267) by @bonk-ai[bot] in #466
• feat(cli): build --reuse, run's build and agent-up go through core's ensure_image, and the aws s3 cp upload is gone (#258) by @bonk-ai[bot] in #475
• feat: registering a record another machine wrote is core's (#270) by @bonk-ai[bot] in #470
• feat(cli): build --tag, --base-image, --inherit-workdir and the hook timeouts (#264, slice D) by @bonk-ai[bot] in #479
• test: trace BIND-5, naming the bindings' cost-type tests and seeding a fault for each door (#306) by @bonk-ai[bot] in #474
• fix(conformance): COST-1's live check expects the retention floor projected, as the rule allows (#303) by @bonk-ai[bot] in #484
• feat(cli): microvm exists says whether a path exists in a running VM (#269) by @bonk-ai[bot] in #468
• refactor(bindings): an AgentVm's default agents and its before-launch refusal come from core (#266) by @bonk-ai[bot] in #476
• feat(bindings): download_dir and sync_dir in Python and Node, over core's workspace (#260) by @bonk-ai[bot] in #469
• feat(cli): run --no-wait returns at acceptance, and wait finishes the launch (#269) by @bonk-ai[bot] in #487
• perf: the mutmut job mutates only the changed functions, and measures check-guards-fire.py at all by @bonk-ai[bot] in #488
• feat(bindings): Session.tunnel and Session.port_forward, and the tunnel identity on launch (#263) by @bonk-ai[bot] in #491
• fix(guards): the restored check reads a command's runs in worker order, so its seeded fault fires every time by @bonk-ai[bot] in #481
• feat(bindings): base_image_version and project_dir on the image calls, read by core's project rule (#264, slice E) by @bonk-ai[bot] in #483
• feat(cli): egress-posture answers the posture a launch would report, before it (#269) by @bonk-ai[bot] in #493
• docs: a tracker box for an AWS change closes after its live run passes, and changelog:check runs its suite under pytest by @bonk-ai[bot] in #497
• feat(cli): --cpus and --memory-mib size a VM through core's SizeClass::from_request (#269) by @bonk-ai[bot] in #492
• fix: run reports the artifact it built from, and the caller-artifact section copies from there (#258) by @bonk-ai[bot] in #485
• test: the gate suites patch a script's own globals, past mutmut's trampoline by @bonk-ai[bot] in #498
• feat(cli): adopt holds a name or a triple to the service through core's Sandbox::adopt (#269) by @bonk-ai[bot] in #496
• test: trace ARCH-5, and promote untraced: check-trace.py fails on a requirement no layer checks (#307) by @bonk-ai[bot] in #499
• fix(conformance): CLI-8 names the run's VM from its history, and counts a listing's VMs once by @bonk-ai[bot] in #500
• chore(ratchet): the drift snapshot shows every category enforced with no drift (#286) by @bonk-ai[bot] in #502
• perf: the mutmut job runs in four shards within a budget, and loads mutated scripts precompiled by @bonk-ai[bot] in #501
• test: each mutmut fault runs the one test its message names by @bonk-ai[bot] in #503
• fix: the tree builds warning-free on Rust 1.99.0 by @bonk-ai[bot] in #505
• refactor(guards): fault families, scanners that declare their vacuity entries, and Falsification blocks that write their own by @bonk-ai[bot] in #506
• chore(deps): take devalue 5.9.4 in the docs site, past seven advisories by @bonk-ai[bot] in #507
• ci: pin the Rust toolchain to 1.99.0, so a new stable arrives as a pull request by @bonk-ai[bot] in #508
• chore(deps): nightly rollup 2026-10-02 by @bonk-ai[bot] in #509
• docs: correct contributor-doc claims the tree no longer matches by @bonk-ai[bot] in #510
• ci: only the repository owner starts a live conformance run by @bonk-ai[bot] in #511
• ci: fetch the history and tags in the live job so version-skew finds the previous release by @bonk-ai[bot] in #512
• ci: bound the conformance stack's roles in live runs by @bonk-ai[bot] in #513
• fix(control): retry a throttle the service sends as HTTP 400 by @bonk-ai[bot] in #515
• chore(deps): clear the SBOM job's advisories in the docs site and the background example by @laithalsaadoon in #530
• release: 0.11.0 by @bonk-ai[bot] in #516

Full Changelog: v0.10.0...v0.11.0