v0.7.1

Changelog

• feat: bind local appliance volumes from provision disks (#79)

Assets

• qctl-host — workstation CLI
• qctl-guest — appliance CLI
• qctl-platform-rocky.mjs — Rocky platform module

v0.7.0

Changelog

• fix: rebuild seed before continuing first-boot vm up (#78)
• feat: unify provision networking on labeled interfaces and ethernet.vm (#77)
• fix: wait for stamp-gated QCTL_READY on serial for vm up (#76)
• fix: stop rewriting tank canary on appliance import (#75)
• feat: create lab VLAN dummy parents in guest init (#74)
• feat: thin VmDriverModule registry with create/reconcile specs (#73)
• feat: track VM first-boot via INSTALLED flag and scrub seed on success (#72)
• feat: run secret check/sync via supervisor with --app (#71)
• docs: document sudo-free quadlet and tighten supervisor ACL tests (#70)
• fix: async systemctl so ensure can run during qctl-app@ start (#69)
• feat: run quadlet ops via supervisor admin socket (#68)
• feat: seed qctl-supervisor and fix Bun Type=notify for qctl-app@ (#67)
• feat: rewrite cross-engine peer deps to qctl-app@ on install (#66)
• feat: add qctl-app@ proxy with refcounted ensure/release (#65)
• feat: add dual-socket qctl supervisor transport (#64)
• feat: persist non-secret admin identity in OsConfig (#63)

Assets

• qctl-host — workstation CLI
• qctl-guest — appliance CLI
• qctl-platform-rocky.mjs — Rocky platform module

v0.6.0

Changelog

• fix: recognize Rocky 10 cloud-final on serial for vm up (#62)
• chore: bump Bun, Rocky 10.2, and npm/pipx dependency pins (#61)
• feat: stage seed on ISO and drive guest init from SeedConfig (#60)
• chore: path-first CLI help order and describes (#59)
• feat: orchestrate guest quadlet and sync over SSH (#58)
• feat: add ${__DIRNAME} and default guest instance root to /tank/rocky (#57)
• chore: collapse dual ROCKY_/QCTL_ guest env names to QCTL_* (#56)
• feat: add qctl vm shell and advertise it after up (#55)
• fix: require explicit profile for provision loads (#54)
• feat: scaffold AGENTS.md and qctl-provision skill on init (#53)
• docs: teach Quickstart path and Later Proxmox in help (#52)
• feat: bare qctl new opens a TTY kind picker (#51)
• feat: add qctl new profile with Proxmox overlays (#50)
• feat: add qctl new env for provision environments (#49)
• feat: scaffold new app/common/network/unit with prompts (#48)
• chore: scrub test temps and restore mocks in preload (#47)
• feat: interactive init wizard, quickstart, and check modes (#46)
• chore: rename TANK_ROOT to APP_ROOT (#45)
• feat: prefix provision layers and merge profile last (#44)
• chore: rename libvirt VM target from local to workstation (#43)
• fix: harden Arborist installs (omit=dev; guest always frozen) (#42)
• feat: select env and target via provision profiles (#41)
• feat: merge provision YAML as common → target → env → overlay (#40)
• feat: run init-tank on a disposable boot disk (#39)
• feat: prefix guest internal commands with internal (#38)
• feat: hide guest internal commands from default help (#37)
• feat: add disk topology support (#35)
• feat: always-on emulated TPM 2.0 for local and Proxmox VMs (#36)

Assets

• qctl-host — workstation CLI
• qctl-guest — appliance CLI
• qctl-platform-rocky.mjs — Rocky platform module

v0.5.1

Changelog

• fix: accept !env Buffer in secrets schema leaves (#34)

Assets

• qctl-host — workstation CLI
• qctl-guest — appliance CLI
• qctl-platform-rocky.mjs — Rocky platform module

v0.5.0

Changelog

• fix: skip local appliance uidmap in CI and release 0.5.0 (#33)
• feat: resolve !env to Buffer with optional encoding (#32)
• fix: base64-encode unsafe Tier-0 secrets in cloud-config (#31)
• fix: pass vm target through to runSeed from init-tank and up (#30)
• fix: hard-fail when guest tooling cannot be embedded in seed (#29)
• fix: detect StageError init-tank fatals on serial console (#28)

Assets

• qctl-host — workstation CLI
• qctl-guest — appliance CLI
• qctl-platform-rocky.mjs — Rocky platform module

v0.4.0

Changelog

• fix: install varlock plugins via package.json and Arborist (#27)

Assets

• qctl-host — workstation CLI
• qctl-guest — appliance CLI
• qctl-platform-rocky.mjs — Rocky platform module

v0.3.0

Changelog

• chore: release 0.3.0 with barrel cleanup and sibling tests (#25)
• docs: sync root and guest READMEs with CLI command trees (#24)
• chore: trim shared public API and export test-helpers (#23)
• chore: split seed and seed-template into focused modules (#22)
• chore: split local appliance into lifecycle and quadlet modules (#21)
• chore: split provision helpers and drop .env.host (#20)
• chore: split libvirt helpers into concern modules (#19)
• chore: extract shared VM up pipeline with thin driver backends (#18)
• ci: tidy release graph and skip -pre versions (#17)
• ci: single main release workflow with gated qctl and plugin (#16)
• ci: split PR checks from environment-gated main releases (#15)
• ci: gate releases on confirmations, CI, and changelog (#14)
• fix: load cloud image pin from platform module (#13)
• chore: rehome host shared libs out of vm/ (#12)
• chore: share init-tank guest-fatal wait across VM drivers (#11)
• refactor: split guest quadlet up and reorganize package layout (#10)
• feat: add qctl local nested systemd+Podman appliance workflow (#9)
• Accept multiple apps on quadlet up/down/ps/start/stop/restart/enable. (#8)
• Add optional provision users.admin/apps with schema defaults. (#7)

Assets

• qctl-host — workstation CLI
• qctl-guest — appliance CLI
• qctl-platform-rocky.mjs — Rocky platform module

v0.2.0

qctl 0.2.0

Assets

• qctl-host — workstation CLI (seed kit + embedded varlock-local-encrypt; install/rename to qctl on PATH)
• qctl-guest — appliance CLI (stages / quadlet / secret; seed installs as /usr/local/bin/qctl; embeds varlock-local-encrypt)
• qctl-platform-rocky.mjs — thin Rocky platform module (guest import(); exports CLOUD_IMAGE pin for host vm download)
• SHA256SUMS

Host downloads qctl-guest and qctl-platform-rocky.mjs from this release when seeding /
sync --include-tooling (override with QCTL_GUEST_DIST). The encrypt helper is
embedded in the host binary (materialized beside it at runtime).

Pin platform in provision/<env>.yaml (version defaults to the running host):

qctl:
  platform: rocky@0.2.0

Vaultwarden plugin is staged separately on npm (release-plugin workflow → npm stage approve).

v0.1.0

qctl 0.1.0

Assets

• qctl-host — workstation CLI (seed kit + vm; install/rename to qctl on PATH)
• qctl-guest — appliance CLI (stages / quadlet / secret; seed installs as /usr/local/bin/qctl)
• qctl-platform-rocky.mjs — thin Rocky platform module (guest import(); exports CLOUD_IMAGE pin for host vm download)
• varlock-local-encrypt — native helper staged next to binaries
• SHA256SUMS

Host downloads qctl-guest, qctl-platform-rocky.mjs, and varlock-local-encrypt
from this release when seeding / sync --include-tooling (override with QCTL_GUEST_DIST).

Pin platform in provision/<env>.yaml (version defaults to the running host):

qctl:
  platform: rocky@0.1.0

Vaultwarden plugin is staged separately on npm (release-plugin workflow → npm stage approve).