v0.1.7-rc.1

Changes in 0.1.7

Maintenance

• Require bounded fuzzing on public release candidates, with source-bound reports and retained diagnostics; beta and ordinary CI do not run mutation campaigns.

Upgrade

Use the documented update procedure and retain local configuration. Automated tests do not establish target-device acceptance.

Security

Release qualification now requires isolated fuzzing against the candidate source. Report findings through SECURITY.md.

Build provenance

rc candidate with a version fixed before compilation.

Source: 3ee1012716f02f850c1e4c148349d40d256291fc

Validation: https://github.com/victron-venus/dbus-pump/actions/runs/38493011399

See release-manifest.json for package hashes and version input evidence.

v0.1.7-beta.1

Changes in 0.1.7

Maintenance

• Require bounded fuzzing on public release candidates, with source-bound reports and retained diagnostics; beta and ordinary CI do not run mutation campaigns.

Upgrade

Use the documented update procedure and retain local configuration. Automated tests do not establish target-device acceptance.

Security

Release qualification now requires isolated fuzzing against the candidate source. Report findings through SECURITY.md.

Build provenance

beta candidate with a version fixed before compilation.

Source: 3ee1012716f02f850c1e4c148349d40d256291fc

Validation: https://github.com/victron-venus/dbus-pump/actions/runs/38491631132

See release-manifest.json for package hashes and version input evidence.

v0.1.6

Changes in 0.1.6

Fixed

• Preserve the stale-close valve latch while fresh tank readings recover inside
  the hysteresis band; respect the existing minimum interval before reopening
  below the start threshold.
• Give the Home Assistant bridge its own dbus-pump-ha supervisor and log names,
  avoiding the native Venus OS pump service restored at every boot.
• Install one persistent, idempotent boot hook with bounded supervisor retries;
  migrate only a positively owned legacy symlink and preserve device settings.
• Keep firmware service files and native stop markers untouched during install,
  restart, boot recovery and uninstall. Reject ambiguous service layouts.
• Require the firmware Python 3.12 runtime before stopping an existing worker.

Documentation

• Describe autostart verification, native coexistence, migration and rollback
  limits, including the unchanged shutdown valve-close behavior.

Maintenance

• Support explicit DESTDIR package staging and uninstall without live service actions, preserving operator-owned configuration.

• Treat Python test warnings as failures and apply broad Python lint checks with documented, narrow compatibility exceptions.

• Enable isolated keyless release signing and authenticated verification of the complete artifact inventory and reviewed source archive.

• Use SPDX license metadata and include LICENSE explicitly, removing the
  setuptools deprecation warning without changing the project license.

• Measure application code and release helpers with one
  explicit Python source inventory and an 80% statement-coverage gate.

• Exercise deterministic native packaging, untracked-file exclusion, required
  inputs, version validation and refusal to reuse stale output directories.

• Document governance, conduct, roadmap, security assurance and dated quality
  evidence, including the outstanding continuity requirement.

• Record test and build dependencies in uv.lock for reproducible Python checks, preserving the existing locked runtime versions.

• Separate manual callbacks and automatic valve commands from snapshot publication while preserving freshness deadlines and in-flight compensation.

• Publish reviewed release notes from the exact source commit used to build each candidate, preserving build provenance.

• Document contribution checks, confidential security reporting and the project-specific trust boundaries.

Upgrade

The Home Assistant worker uses dbus-pump-ha rather than the native Venus OS pump supervisor. The installer preserves settings and only migrates a positively identified old service. Review the documented boot recovery and rollback limits before updating; native firmware pump service files remain untouched.

Security

Private vulnerability reporting and response policy are documented in SECURITY.md. This maintenance update strengthens release evidence and review instructions; it does not replace deployment authentication, network isolation or independent equipment safeguards. No new project CVE is announced by these changes.

Build provenance

Promoted unchanged from v0.1.6-rc.2.

Source: b44fdb6856ab371feb5a287a28440bd7d7894f21

Validation: https://github.com/victron-venus/dbus-pump/actions/runs/38340141900

Promotion: https://github.com/victron-venus/dbus-pump/actions/runs/38340663478

Assets and release-manifest.json are byte-for-byte copies of the verified release candidate.

Target acceptance

Reviewed RC2 acceptance and limitations records verification on Venus OS v3.75 ARMv7: all 18 mapped installed files matched the authenticated RC2, all three D-Bus services were connected, and live tank telemetry advanced. The follow-up window included one recovered Home Assistant read timeout of a class also observed before the update. Automation remained disabled; no cold-boot or actuator test is claimed.

Independent recipient verification confirmed that all eight stable assets are byte-for-byte identical to the accepted RC2 assets, including the original signed inventory and source archive.

v0.1.6-rc.2

Changes in 0.1.6

Fixed

• Preserve the stale-close valve latch while fresh tank readings recover inside
  the hysteresis band; respect the existing minimum interval before reopening
  below the start threshold.
• Give the Home Assistant bridge its own dbus-pump-ha supervisor and log names,
  avoiding the native Venus OS pump service restored at every boot.
• Install one persistent, idempotent boot hook with bounded supervisor retries;
  migrate only a positively owned legacy symlink and preserve device settings.
• Keep firmware service files and native stop markers untouched during install,
  restart, boot recovery and uninstall. Reject ambiguous service layouts.
• Require the firmware Python 3.12 runtime before stopping an existing worker.

Documentation

• Describe autostart verification, native coexistence, migration and rollback
  limits, including the unchanged shutdown valve-close behavior.

Maintenance

• Support explicit DESTDIR package staging and uninstall without live service actions, preserving operator-owned configuration.

• Treat Python test warnings as failures and apply broad Python lint checks with documented, narrow compatibility exceptions.

• Enable isolated keyless release signing and authenticated verification of the complete artifact inventory and reviewed source archive.

• Use SPDX license metadata and include LICENSE explicitly, removing the
  setuptools deprecation warning without changing the project license.

• Measure application code and release helpers with one
  explicit Python source inventory and an 80% statement-coverage gate.

• Exercise deterministic native packaging, untracked-file exclusion, required
  inputs, version validation and refusal to reuse stale output directories.

• Document governance, conduct, roadmap, security assurance and dated quality
  evidence, including the outstanding continuity requirement.

• Record test and build dependencies in uv.lock for reproducible Python checks, preserving the existing locked runtime versions.

• Separate manual callbacks and automatic valve commands from snapshot publication while preserving freshness deadlines and in-flight compensation.

• Publish reviewed release notes from the exact source commit used to build each candidate, preserving build provenance.

• Document contribution checks, confidential security reporting and the project-specific trust boundaries.

Upgrade

The Home Assistant worker uses dbus-pump-ha rather than the native Venus OS pump supervisor. The installer preserves settings and only migrates a positively identified old service. Review the documented boot recovery and rollback limits before updating; native firmware pump service files remain untouched.

Security

Private vulnerability reporting and response policy are documented in SECURITY.md. This maintenance update strengthens release evidence and review instructions; it does not replace deployment authentication, network isolation or independent equipment safeguards. No new project CVE is announced by these changes.

Build provenance

rc candidate with a version fixed before compilation.

Source: b44fdb6856ab371feb5a287a28440bd7d7894f21

Validation: https://github.com/victron-venus/dbus-pump/actions/runs/38340141900

See release-manifest.json for package hashes and version input evidence.

v0.1.6-rc.1

Changes in 0.1.6

Fixed

• Preserve the stale-close valve latch while fresh tank readings recover inside
  the hysteresis band; respect the existing minimum interval before reopening
  below the start threshold.
• Give the Home Assistant bridge its own dbus-pump-ha supervisor and log names,
  avoiding the native Venus OS pump service restored at every boot.
• Install one persistent, idempotent boot hook with bounded supervisor retries;
  migrate only a positively owned legacy symlink and preserve device settings.
• Keep firmware service files and native stop markers untouched during install,
  restart, boot recovery and uninstall. Reject ambiguous service layouts.
• Require the firmware Python 3.12 runtime before stopping an existing worker.

Documentation

• Describe autostart verification, native coexistence, migration and rollback
  limits, including the unchanged shutdown valve-close behavior.

Maintenance

• Support explicit DESTDIR package staging and uninstall without live service actions, preserving operator-owned configuration.

• Treat Python test warnings as failures and apply broad Python lint checks with documented, narrow compatibility exceptions.

• Enable isolated keyless release signing and authenticated verification of the complete artifact inventory and reviewed source archive.

• Use SPDX license metadata and include LICENSE explicitly, removing the
  setuptools deprecation warning without changing the project license.

• Measure application code and release helpers with one
  explicit Python source inventory and an 80% statement-coverage gate.

• Exercise deterministic native packaging, untracked-file exclusion, required
  inputs, version validation and refusal to reuse stale output directories.

• Document governance, conduct, roadmap, security assurance and dated quality
  evidence, including the outstanding continuity requirement.

• Record test and build dependencies in uv.lock for reproducible Python checks, preserving the existing locked runtime versions.

• Separate manual callbacks and automatic valve commands from snapshot publication while preserving freshness deadlines and in-flight compensation.

• Publish reviewed release notes from the exact source commit used to build each candidate, preserving build provenance.

• Document contribution checks, confidential security reporting and the project-specific trust boundaries.

Upgrade

The Home Assistant worker uses dbus-pump-ha rather than the native Venus OS pump supervisor. The installer preserves settings and only migrates a positively identified old service. Review the documented boot recovery and rollback limits before updating; native firmware pump service files remain untouched.

Security

Private vulnerability reporting and response policy are documented in SECURITY.md. This maintenance update strengthens release evidence and review instructions; it does not replace deployment authentication, network isolation or independent equipment safeguards. No new project CVE is announced by these changes.

Build provenance

rc candidate with a version fixed before compilation.

Source: fd2970e6152c6ed65904c40ad92bf5a3aa943941

Validation: https://github.com/victron-venus/dbus-pump/actions/runs/38335703645

See release-manifest.json for package hashes and version input evidence.

v0.1.6-nightly.20261013121131.38395425628.1

Changes in 0.1.6

Fixed

• Preserve the stale-close valve latch while fresh tank readings recover inside
  the hysteresis band; respect the existing minimum interval before reopening
  below the start threshold.
• Give the Home Assistant bridge its own dbus-pump-ha supervisor and log names,
  avoiding the native Venus OS pump service restored at every boot.
• Install one persistent, idempotent boot hook with bounded supervisor retries;
  migrate only a positively owned legacy symlink and preserve device settings.
• Keep firmware service files and native stop markers untouched during install,
  restart, boot recovery and uninstall. Reject ambiguous service layouts.
• Require the firmware Python 3.12 runtime before stopping an existing worker.

Documentation

• Describe autostart verification, native coexistence, migration and rollback
  limits, including the unchanged shutdown valve-close behavior.

Maintenance

• Support explicit DESTDIR package staging and uninstall without live service actions, preserving operator-owned configuration.

• Treat Python test warnings as failures and apply broad Python lint checks with documented, narrow compatibility exceptions.

• Enable isolated keyless release signing and authenticated verification of the complete artifact inventory and reviewed source archive.

• Use SPDX license metadata and include LICENSE explicitly, removing the
  setuptools deprecation warning without changing the project license.

• Measure application code and release helpers with one
  explicit Python source inventory and an 80% statement-coverage gate.

• Exercise deterministic native packaging, untracked-file exclusion, required
  inputs, version validation and refusal to reuse stale output directories.

• Document governance, conduct, roadmap, security assurance and dated quality
  evidence, including the outstanding continuity requirement.

• Record test and build dependencies in uv.lock for reproducible Python checks, preserving the existing locked runtime versions.

• Separate manual callbacks and automatic valve commands from snapshot publication while preserving freshness deadlines and in-flight compensation.

• Publish reviewed release notes from the exact source commit used to build each candidate, preserving build provenance.

• Document contribution checks, confidential security reporting and the project-specific trust boundaries.

Upgrade

The Home Assistant worker uses dbus-pump-ha rather than the native Venus OS pump supervisor. The installer preserves settings and only migrates a positively identified old service. Review the documented boot recovery and rollback limits before updating; native firmware pump service files remain untouched.

Security

Private vulnerability reporting and response policy are documented in SECURITY.md. This maintenance update strengthens release evidence and review instructions; it does not replace deployment authentication, network isolation or independent equipment safeguards. No new project CVE is announced by these changes.

Build provenance

nightly candidate with a version fixed before compilation.

Source: b1d72605da9daa1a9b92039e921a107c0c0d2891

Validation: https://github.com/victron-venus/dbus-pump/actions/runs/38395425628

See release-manifest.json for package hashes and version input evidence.

v0.1.6-beta.19

Changes in 0.1.6

Fixed

• Preserve the stale-close valve latch while fresh tank readings recover inside
  the hysteresis band; respect the existing minimum interval before reopening
  below the start threshold.
• Give the Home Assistant bridge its own dbus-pump-ha supervisor and log names,
  avoiding the native Venus OS pump service restored at every boot.
• Install one persistent, idempotent boot hook with bounded supervisor retries;
  migrate only a positively owned legacy symlink and preserve device settings.
• Keep firmware service files and native stop markers untouched during install,
  restart, boot recovery and uninstall. Reject ambiguous service layouts.
• Require the firmware Python 3.12 runtime before stopping an existing worker.

Documentation

• Describe autostart verification, native coexistence, migration and rollback
  limits, including the unchanged shutdown valve-close behavior.

Maintenance

• Support explicit DESTDIR package staging and uninstall without live service actions, preserving operator-owned configuration.

• Treat Python test warnings as failures and apply broad Python lint checks with documented, narrow compatibility exceptions.

• Enable isolated keyless release signing and authenticated verification of the complete artifact inventory and reviewed source archive.

• Use SPDX license metadata and include LICENSE explicitly, removing the
  setuptools deprecation warning without changing the project license.

• Measure application code and release helpers with one
  explicit Python source inventory and an 80% statement-coverage gate.

• Exercise deterministic native packaging, untracked-file exclusion, required
  inputs, version validation and refusal to reuse stale output directories.

• Document governance, conduct, roadmap, security assurance and dated quality
  evidence, including the outstanding continuity requirement.

• Record test and build dependencies in uv.lock for reproducible Python checks, preserving the existing locked runtime versions.

• Separate manual callbacks and automatic valve commands from snapshot publication while preserving freshness deadlines and in-flight compensation.

• Publish reviewed release notes from the exact source commit used to build each candidate, preserving build provenance.

• Document contribution checks, confidential security reporting and the project-specific trust boundaries.

Upgrade

The Home Assistant worker uses dbus-pump-ha rather than the native Venus OS pump supervisor. The installer preserves settings and only migrates a positively identified old service. Review the documented boot recovery and rollback limits before updating; native firmware pump service files remain untouched.

Security

Private vulnerability reporting and response policy are documented in SECURITY.md. This maintenance update strengthens release evidence and review instructions; it does not replace deployment authentication, network isolation or independent equipment safeguards. No new project CVE is announced by these changes.

Build provenance

beta candidate with a version fixed before compilation.

Source: b44fdb6856ab371feb5a287a28440bd7d7894f21

Validation: https://github.com/victron-venus/dbus-pump/actions/runs/38335763747

See release-manifest.json for package hashes and version input evidence.

v0.1.6-beta.18

Changes in 0.1.6

Fixed

• Preserve the stale-close valve latch while fresh tank readings recover inside
  the hysteresis band; respect the existing minimum interval before reopening
  below the start threshold.
• Give the Home Assistant bridge its own dbus-pump-ha supervisor and log names,
  avoiding the native Venus OS pump service restored at every boot.
• Install one persistent, idempotent boot hook with bounded supervisor retries;
  migrate only a positively owned legacy symlink and preserve device settings.
• Keep firmware service files and native stop markers untouched during install,
  restart, boot recovery and uninstall. Reject ambiguous service layouts.
• Require the firmware Python 3.12 runtime before stopping an existing worker.

Documentation

• Describe autostart verification, native coexistence, migration and rollback
  limits, including the unchanged shutdown valve-close behavior.

Maintenance

• Support explicit DESTDIR package staging and uninstall without live service actions, preserving operator-owned configuration.

• Treat Python test warnings as failures and apply broad Python lint checks with documented, narrow compatibility exceptions.

• Enable isolated keyless release signing and authenticated verification of the complete artifact inventory and reviewed source archive.

• Use SPDX license metadata and include LICENSE explicitly, removing the
  setuptools deprecation warning without changing the project license.

• Measure application code and release helpers with one
  explicit Python source inventory and an 80% statement-coverage gate.

• Exercise deterministic native packaging, untracked-file exclusion, required
  inputs, version validation and refusal to reuse stale output directories.

• Document governance, conduct, roadmap, security assurance and dated quality
  evidence, including the outstanding continuity requirement.

• Record test and build dependencies in uv.lock for reproducible Python checks, preserving the existing locked runtime versions.

• Separate manual callbacks and automatic valve commands from snapshot publication while preserving freshness deadlines and in-flight compensation.

• Publish reviewed release notes from the exact source commit used to build each candidate, preserving build provenance.

• Document contribution checks, confidential security reporting and the project-specific trust boundaries.

Upgrade

The Home Assistant worker uses dbus-pump-ha rather than the native Venus OS pump supervisor. The installer preserves settings and only migrates a positively identified old service. Review the documented boot recovery and rollback limits before updating; native firmware pump service files remain untouched.

Security

Private vulnerability reporting and response policy are documented in SECURITY.md. This maintenance update strengthens release evidence and review instructions; it does not replace deployment authentication, network isolation or independent equipment safeguards. No new project CVE is announced by these changes.

Build provenance

beta candidate with a version fixed before compilation.

Source: fd2970e6152c6ed65904c40ad92bf5a3aa943941

Validation: https://github.com/victron-venus/dbus-pump/actions/runs/38335233621

See release-manifest.json for package hashes and version input evidence.

v0.1.6-beta.17

Changes in 0.1.6

Fixed

• Give the Home Assistant bridge its own dbus-pump-ha supervisor and log names,
  avoiding the native Venus OS pump service restored at every boot.
• Install one persistent, idempotent boot hook with bounded supervisor retries;
  migrate only a positively owned legacy symlink and preserve device settings.
• Keep firmware service files and native stop markers untouched during install,
  restart, boot recovery and uninstall. Reject ambiguous service layouts.
• Require the firmware Python 3.12 runtime before stopping an existing worker.

Documentation

• Describe autostart verification, native coexistence, migration and rollback
  limits, including the unchanged shutdown valve-close behavior.

Maintenance

• Record test and build dependencies in uv.lock for reproducible Python checks, preserving the existing locked runtime versions.
• Separate manual callbacks and automatic valve commands from snapshot publication while preserving freshness deadlines and in-flight compensation.
• Publish reviewed release notes from the exact source commit used to build each candidate, preserving build provenance.
• Document contribution checks, confidential security reporting and the project-specific trust boundaries.

Upgrade

The Home Assistant worker uses dbus-pump-ha rather than the native Venus OS pump supervisor. The installer preserves settings and only migrates a positively identified old service. Review the documented boot recovery and rollback limits before updating; native firmware pump service files remain untouched.

Security

Private vulnerability reporting and response policy are documented in SECURITY.md. This maintenance update strengthens release evidence and review instructions; it does not replace deployment authentication, network isolation or independent equipment safeguards. No new project CVE is announced by these changes.

Valve recovery correction (documented 2026-10-12)

This release also includes the stale-close recovery fix. After stale telemetry closes the valve, a fresh tank reading inside the hysteresis band keeps it closed. A reading below the start threshold may reopen it only after the existing minimum switch interval. This prevents recovery alone from reopening a valve that was closed for stale data; manual mode priority is unchanged.

Build provenance

beta candidate with a version fixed before compilation.

Source: 852ac7247eccbea19a4b9ff1fbd37d8a7850083e

Validation: https://github.com/victron-venus/dbus-pump/actions/runs/38325516006

See release-manifest.json for package hashes and version input evidence.

v0.1.6-beta.16

Changes in 0.1.6

Fixed

• Give the Home Assistant bridge its own dbus-pump-ha supervisor and log names,
  avoiding the native Venus OS pump service restored at every boot.
• Install one persistent, idempotent boot hook with bounded supervisor retries;
  migrate only a positively owned legacy symlink and preserve device settings.
• Keep firmware service files and native stop markers untouched during install,
  restart, boot recovery and uninstall. Reject ambiguous service layouts.
• Require the firmware Python 3.12 runtime before stopping an existing worker.

Documentation

• Describe autostart verification, native coexistence, migration and rollback
  limits, including the unchanged shutdown valve-close behavior.

Maintenance

• Record test and build dependencies in uv.lock for reproducible Python checks, preserving the existing locked runtime versions.
• Separate manual callbacks and automatic valve commands from snapshot publication while preserving freshness deadlines and in-flight compensation.
• Publish reviewed release notes from the exact source commit used to build each candidate, preserving build provenance.
• Document contribution checks, confidential security reporting and the project-specific trust boundaries.

Upgrade

The Home Assistant worker uses dbus-pump-ha rather than the native Venus OS pump supervisor. The installer preserves settings and only migrates a positively identified old service. Review the documented boot recovery and rollback limits before updating; native firmware pump service files remain untouched.

Security

Private vulnerability reporting and response policy are documented in SECURITY.md. This maintenance update strengthens release evidence and review instructions; it does not replace deployment authentication, network isolation or independent equipment safeguards. No new project CVE is announced by these changes.

Valve recovery correction (documented 2026-10-12)

This release also includes the stale-close recovery fix. After stale telemetry closes the valve, a fresh tank reading inside the hysteresis band keeps it closed. A reading below the start threshold may reopen it only after the existing minimum switch interval. This prevents recovery alone from reopening a valve that was closed for stale data; manual mode priority is unchanged.

Build provenance

beta candidate with a version fixed before compilation.

Source: 7fc536c0b4345564df867648e88e327dd6634558

Validation: https://github.com/victron-venus/dbus-pump/actions/runs/38321957650

See release-manifest.json for package hashes and version input evidence.