v0.2.0

What's Changed

• release: rename ~ to . in asset filenames before checksumming by @earthlingdavey in #25
• release: ship raw binaries as documented per-arch tar.gz by @earthlingdavey in #26
• packaging: drop the .apk until it can ship a working service by @earthlingdavey in #27
• liveswap: continuous watchdog — restart apps on crash or sustained health failure by @earthlingdavey in #28
• liveswap: replace the shared deploy secret with OIDC + local-key trust by @earthlingdavey in #29
• liveswap: push-upload & rollback deploy sources, with immutable versions by @earthlingdavey in #30
• liveswap: match numeric OIDC identity claims by exact digits by @earthlingdavey in #31
• liveswap: run apps as transient systemd units (systemd-only runner) by @earthlingdavey in #34
• liveswap: non-dumpable supervisor, the shared-UID rule, and the support matrix for isolation by @earthlingdavey in #38
• build(deps): bump the dockerfiles group across 2 directories with 1 update by @dependabot[bot] in #41
• build(deps): bump the go-deps group across 2 directories with 2 updates by @dependabot[bot] in #43
• build(deps): bump the compose-images group with 2 updates by @dependabot[bot] in #42
• liveswap: decode the webhook body into its own wire type by @earthlingdavey in #39
• build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 in /penaltybox by @dependabot[bot] in #44
• liveswap: sandbox every app unit — user + PID namespaces on Debian 13 (#35 phase 1) by @earthlingdavey in #40
• build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 in / and /liveswap by @earthlingdavey in #46
• liveswap: remove the retired sandboxFilesystem tier by @earthlingdavey in #47
• liveswap: measure the sandbox once per manager connection, not once per config load by @earthlingdavey in #48
• liveswap: sandbox is on or off — remove auto, delete the capability invalidation by @earthlingdavey in #49
• liveswap: fuzz the deploy-token claim matching and the webhook request parsing by @earthlingdavey in #50
• liveswap: the sandbox is unconditional — remove sandbox off, the tier and the record by @earthlingdavey in #51
• docs: design docs describe the present — collapse the amendment layers into history by @earthlingdavey in #53
• build(deps): bump curlimages/curl from 8.21.0 to 8.22.0 in the compose-images group by @dependabot[bot] in #54
• build(deps): bump the go-deps group across 2 directories with 1 update by @dependabot[bot] in #55
• liveswap: the app contract is a unix socket, not a loopback port by @earthlingdavey in #56
• docs: the egress residual names its issue (#57) by @earthlingdavey in #58
• liveswap: throttle webhook auth failures per address; cap archive entries by @earthlingdavey in #59
• ci: let the weekly soak start hotserve, and explain itself when it cannot by @earthlingdavey in #63
• ci: soak every merge to main, not just once a week by @earthlingdavey in #64
• liveswap: point the runner and D-Bus edges downward by @earthlingdavey in #65
• build(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /penaltybox by @dependabot[bot] in #69
• build(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 by @dependabot[bot] in #70
• liveswap: test the manager re-probe measureSandbox does before measuring by @earthlingdavey in #68
• liveswap: one view probe, shared by the three lanes that read the sandbox from inside by @earthlingdavey in #72
• docs: point the resource-caps references at #71, not #52 by @earthlingdavey in #73
• liveswap: move the two leaf blocks out of the files above them by @earthlingdavey in #74
• liveswap: write the layering down, and gate gofmt by @earthlingdavey in #76
• liveswap: put the two seams the detached sweep reads behind atomics by @earthlingdavey in #78
• docs: cite the threat model's source by symbol, not line number (#67) by @earthlingdavey in #79
• liveswap: report the command a unit is actually running by @earthlingdavey in #80
• docs: fix the README's root claim, and give security its own section by @earthlingdavey in #81
• docs: fix the module READMEs' examples and install guidance by @earthlingdavey in #82
• docs: add an Upgrading section to the README by @earthlingdavey in #84
• docs: fix the paved road a newcomer copies by @earthlingdavey in #85
• liveswap: log that it started, and with how many apps by @earthlingdavey in #87
• examples: a Deno app and a Node single executable, deployed by e2e by @earthlingdavey in #88
• build(deps): bump the go-deps group across 2 directories with 3 updates by @dependabot[bot] in #90
• examples/box: the box repo, a non-root administrator, and Getting started by @earthlingdavey in #89
• liveswap: the 'app definition changed' line says next launch, not next deploy by @earthlingdavey in #91
• docs: the paved road as the non-root administrator walks it by @earthlingdavey in #92
• examples: private-repo deploys, and rollback from the Actions tab by @earthlingdavey in #93
• docs: the first deploy as a numbered tutorial, and the page after it by @earthlingdavey in #95
• docs: README points at docs/ instead of repeating it by @earthlingdavey in #96
• examples: the READMEs walk the tutorial's order, and the sudoers file comes from the repo by @earthlingdavey in #97
• examples/box: the administrator can create an app's env file by @earthlingdavey in #98
• examples: deploy.sh dresses its output for the Actions job page by @earthlingdavey in #99
• liveswap: every webhook response passes a redaction filter by @earthlingdavey in #100
• liveswap: a failed deploy says why, from the app's side by @earthlingdavey in #101
• liveswap: a release built for the wrong machine is refused before anything runs by @earthlingdavey in #102
• liveswap: a deploy streams its phases to a client that asks by @earthlingdavey in #103
• liveswap: every deploy's outcome is on record, per version by @earthlingdavey in #104
• examples: deploy.sh accepts the single response of a box that does not stream by @earthlingdavey in #105
• liveswap: the response filter has four rules, and #104's code is held to them by @earthlingdavey in #108
• liveswap: the done line's comment says what order the filter leaves, and a redaction is pinned by @earthlingdavey in #110
• liveswap: deployed_by names who deployed, not only the source that let them in by @earthlingdavey in #111
• examples: a copy deploys with no file edited, and each release publishes the apps as templates by @earthlingdavey in #112
• examples, packaging, docs: what the v0.2.0-rc2 walk-through on a real box found by @earthlingdavey in #114

Full Changelog: v0.1.0...v0.2.0