v1.0.0

1.0.0 (2026-07-22)

Features

• auth: support production PAT credentials (#26) (f493f93)
• controller: prove phase 1 controller core (#8) (9bd37f7)
• github: integrate runner scale-set lifecycle (#11) (e778ef1)
• github: recover failed message sessions (#16) (a76994b)
• image: prove one-shot guest contract (#9) (85f273a)
• incus: implement owned runner lifecycle (#10) (d03cace)
• provenance: add file-backed live proof gate (#39) (173381f)
• provenance: add job machine proof primitives (#36) (ce7c89c)
• provenance: add TPM-bound proof key storage (#41) (4d891a8)
• provenance: bind authenticated jobs to Incus machines (#38) (c32e134)
• provenance: deliver proofs to runner guests (#37) (ea7e504)
• release: add native Linux packages (#46) (e69fd1c)
• release: publish reference VM image (#20) (1943892)
• replace the reference VM image with a hardened-image guide (#45) (0b7a4b6)
• security: add Incus isolation baseline (#28) (10f4be2)
• systemd: add hardened service deployment (#18) (956a34a)

Bug Fixes

• app: bound component shutdown (#17) (439ca19)
• ci: gate unavailable repository services (#21) (82f5ed4)
• controller: back off failed Incus operations (#19) (4979f7d)
• controller: fail closed on inventory uncertainty (#30) (92cd3ce)
• controller: fence idle runners before scale-down (#31) (2e72d30)
• incus: boot and clean up Noble runners (#12) (8580997)
• incus: bound runner diagnostics (#33) (e2138ad)
• incus: pin runner environment identity (#32) (6e11ff1)
• live: use scoped runner evidence (#15) (56eaf85)
• provenance: align proofs with live Incus and GitHub metadata (#40) (e1d5979)
• security: fail closed on controller inputs (#27) (f04f474)
• security: harden Incus runner isolation (#29) (9902257)