v1.1.0

A capsule adopted across a controller replacement is read under its own
protocol, a held attempt is resolved without stopping the controller, and a
registry that blinked no longer costs an attempt. The schema is unchanged, so
an installation moves by repointing the image and recreating the container;
the runbook names the commands and what to do if it has to
go back.

Deploy this release

Point the Compose deployment at this controller digest and recreate
the container:

RUNPOOL_IMAGE=ghcr.io/rhobuild/runpool@sha256:ca22bcee93141da22e2c9406835668664522e501a22aa71c46422ef48f77a034

The controller carries the capsule digest below stamped into it and
refuses any other, so there is one image to set. Read the
deployment guide
before a first installation, and
the runbook
before moving an existing one.

What changed

Isolation and execution

• A capsule adopted across a controller replacement is read under the
  protocol it declares, not the one this build speaks. Both bumps this
  protocol has had moved what an existing word means, and a word read under
  the wrong version is understood rather than refused — waiting from an
  older supervisor reads as proof the runner never started, and returns to
  the queue an assignment its capsule is forking a runner for. A capsule
  whose protocol this controller does not speak now holds its attempt for a
  person. Its exit code is still trusted from every version, and is frozen:
  it is the only account a stopped capsule leaves. See
  the ADR.

Operations

• Resolving a held attempt no longer stops the controller. runpool attempts resolve --apply hands the decision to the controller serving
  that state directory, which applies it; with none running it writes
  directly under the lock as before. One command either way. Every write
  still belongs to whoever holds the lock — the decision travels to it
  rather than around it — and the audit record names the operator who
  decided, never the controller that carried it. See
  the ADR.
• A pull the registry refused in a way it might not repeat is tried again,
  up to three times, instead of spending an attempt's retry budget on a
  blip. An answer that will not change — an unpublished reference, a
  credential that does not carry, a malformed reference — is not retried.

---

Provenance

Release-qualified commit	42b7d8b2d7eaf1aa65b88937cea3661ece859d35
Controller	ghcr.io/rhobuild/runpool@sha256:ca22bcee93141da22e2c9406835668664522e501a22aa71c46422ef48f77a034
Capsule	ghcr.io/rhobuild/runpool/capsule@sha256:35f57c69d1ffd0efd3a5bf9f0dd4b108ae40405694d6ba503d6cfb595dee6dc0

Publication runs only after qualification passed against these exact
digests, so an attestation signed here says more than that GitHub built
it. Verify a digest before it reaches a deployment:

gh attestation verify oci://ghcr.io/rhobuild/runpool@sha256:ca22bcee93141da22e2c9406835668664522e501a22aa71c46422ef48f77a034 \
  --repo rhobuild/runpool \
  --signer-workflow rhobuild/runpool/.github/workflows/release.yml \
  --source-ref refs/tags/v1.1.0 \
  --deny-self-hosted-runners

Attached: standalone linux/amd64 and linux/arm64 binaries with
checksums.txt, an SBOM for each image, and the qualification record
this release was authorized against.