Pandion v0.7.2

Changelog

• fc09f74 M3.2b: real Hetzner cluster + WireGuard mesh (#6)
• e502c3e M3.3: service-discovery injection + run commands (#7)
• 8d16b9a Relicense to Business Source License 1.1 + commercial licensing + CLA
• 5f1bd9e chore(e2e): auto-load .env in all scripts so creds need no manual export (#107)
• a47b2d7 feat(config): M3.1 — cluster.yaml parsing + schema validation + validate (#4)
• f827bc7 feat(config): apply cluster.yaml node settings — polyglot toolchain, size, image, region (P0-2) (#20)
• 65305de feat(doctor): report local-vs-provider state divergence (R7/F6) (#120)
• f267558 feat(doctor,reap): doctor --json + reap GCs orphaned journals (R7c) (#122)
• 5e614a1 feat(egress): accept hostnames in --egress-allow, resolved at provision (P2.1) (#109)
• 84067d9 feat(egress): on-node re-resolution timer for hostname egress-allow (P2.1) (#114)
• bcf635d feat(firewall): M2.1 — default-deny egress build-window (S2) (#2)
• 4d39f3b feat(firewall): add audit/dry-run mode — up --firewall-audit (P2.2) (#111)
• 542d7c0 feat(firewall): wire audit mode into cluster up -f and lockdown --audit (P2.2) (#112)
• 796f52c feat(gpu): ls --gpu-util — live GPU utilization column (M6-R2) (#100)
• 914e68d feat(gpu): multi-node GPU clusters — --gpu with -f cluster.yaml (M5 phase A) (#95)
• 30f5f02 feat(gpu): offline pricing cache for list-gpus (M6-R3) (#99)
• 20306d4 feat(gpu): peer rendezvous env for multi-node clusters (M5 phase B) (#96)
• f0abe25 feat(gpu): real teardown cost even without a provider timestamp (M6-R1) (#98)
• de78b67 feat(harden): disable IPv6 to close nftables egress gap + security next-steps plan (#104)
• 937d87c feat(lockdown): M3.5 — public deny-all via lockout-safe envcore lockdown (#9)
• af2493c feat(mock): file-backed mock state so idempotency is testable offline (R10/F9) (#119)
• a4f89b4 feat(orchestrator): M3.2a — multi-node provisioning + barrier (mock) (#5)
• 70b2852 feat(overlay): M2.2a — WireGuard management overlay + operator-scoped SSH (#3)
• 9fd9f9a feat(provider): M1 — Hetzner provider with spec-based type discovery
• d4a5b83 feat(provider): configurable type/location search order (region-first default)
• d11b860 feat(provision): retry a mid-boot instance termination with a fresh launch (#110)
• 596275d feat(security): LUKS-at-rest workspace encryption (P1, S-E) (#41)
• 3fc0c63 feat(security): block cloud metadata endpoint egress (P1, S-F) (#33)
• dd52e84 feat(security): cloud-edge firewall (M8) + sysctl hardening (P1) (#39)
• c7a51d5 feat(security): fail2ban SSH brute-force protection on nodes (P1) (#37)
• 07e7159 feat(security): on-node idle dead-man's-switch (P2b, A5) (#23)
• bda54c8 feat(security): run workloads as unprivileged envcore-run user (P1, S-C) (#21)
• b5e5a65 feat(state): version the journal + manifest schemas (R11/F10) (#121)
• 9c36392 feat(stream): M3.4 — multiplexed per-node output + tee logs (#8)
• 80c279d feat(up): state-idempotency phase 1 — up existence guard (R1) + honest TTL cost (R2) (#117)
• 6d4bf80 feat(ux): implement the full P0–P4 UX upgrade plan (#116)
• cc36383 feat(workspace): sync local project to nodes + remote build (P0-1) (#19)
• 5e28e33 feat: DigitalOcean GPU Droplets — GPUProvider on the existing DO backend (#89)
• 06ddf4b feat: DigitalOcean provider (M6) — proves the Provider seam (#30)
• 46b9be1 feat: GPU idle dead-man + teardown receipt + ls GPU columns (G2) (#84) (#84)
• a54710c feat: GPU seam (G0) — --gpu flag, GPUProvider interface, list-gpus (#82) (#82)
• 6adc256 feat: IDE Tier-2 — distributed debug-attach over the overlay (pandion debug) (#51)
• 85fb489 feat: L2 overlay lab profile (attackable cyber-range) + longer slow-boot provisioning window (#55)
• 5bbbe5a feat: Lambda Cloud GPU provider (G1) — offline-tested, CLI-wired (#83) (#83)
• 13eb936 feat: M0 walking skeleton — state machine, reconcile loop, mock provider
• bc8f7f2 feat: M1 increment 2 — hardened bootstrap, pinned SSH, --provider flag
• 0f17595 feat: OS-keychain secret store for provider tokens (H6) (#47)
• 9a978fb feat: Tier-2 shared debugging — pandion debug share/join/unshare (#53)
• bc317c2 feat: down reads provider from cluster manifest (no repeated --provider) (#77)
• 90c0342 feat: envcore reap — client-side orphan reaper for billing-leak prevention (P2/C4) (#22)
• d012e90 feat: ls --json — machine-readable fleet status (P3, L1) (#35)
• 547567e feat: pandion attach — durable runs + reattach (C3) (#27)
• 267c219 feat: pandion build [dir] — auto-detect toolchain, upload + build in the cloud (#79)
• f95558f feat: pandion completion bash|zsh|fish (P3) (#36)
• f1ed32a feat: pandion cp — scp files to/from a node (host-key pinned) (#42)
• 4d20025 feat: pandion ls/status live cost + --max-cost budget cap (M4) (#28)
• 30ee0e5 feat: pandion ssh — host-key-pinned SSH into a node (debug story) (#40)
• 0c60cd3 feat: up --dry-run — preview plan + projected cost, create nothing (L4) (#31)
• d510d23 feat: up honors defaults.{region,size,ttl} from config; --size/--region flags (#78)
• d339a5a feat: add Vultr, Linode/Akamai, and Scaleway providers (#48)
• be74ace feat: architecture guard for prebuilt-binary uploads (sync mode binaries) (#67)
• 974519d feat: capability add-back (P1b) (#25)
• 294bc32 feat: deploy prebuilt binaries — implement sync mode "binaries" + document how apps run (#66)
• b7fa3d6 feat: deploy-only nodes + pandion start (separate deploy from run) (#58)
• cb63912 feat: down --dry-run + confirm, pandion code (IDE), cross-platform CI (M7) (#45)
• 3a5569a feat: encrypted Layer-2 overlay (security.overlay: l2, safe profile) + conformance harness (#54)
• 472f1df feat: finish P0-2 cluster.yaml wiring + auditd baseline (P0-2, S-F) (#38)
• 6d32342 feat: hardened Docker engine (--engine=docker) (#24)
• f30d45a feat: install C++ toolchain via cloud-init + readiness gate before run
• 60105d1 feat: install libraries on a node — --packages, additive toolchain, verify install (#60)
• 51c44d4 feat: pandion init + ~/.pandion/config.yaml — bare one-liners that just work (#74)
• 52aeced feat: pandion relay share/unshare/status — the clickable browser-terminal link (Phase 1 complete) (#70)
• 5977148 feat: pandion relay up — deploy the browser-SSH relay on a node (Phase 1) (#69)
• dfd9f8d feat: per-node engine=docker in clusters (P0-2 complete) (#43)
• aa3b067 feat: relay --domain — browser-trusted Let's Encrypt TLS (Phase 2) (#71)
• 80a6c4a feat: relay read-only shares + unknown-token rate-limiting (Phase 2) (#72)
• 9d2d8de feat: relay server core — browser-SSH bridge (Phase 1 foundation) (#68)
• 0ae19fb feat: relay session recording — capture + fetch the terminal (Phase 2, relay finished) (#73)
• f7c4717 feat: reproducibility lockfile + toolchain pinning (P1, H2) (#34)
• 71ae545 feat: runnable example — examples/zmq-cluster (broker + 2 workers) (#64)
• ac2243f feat: setup: hook — install non-apt software declaratively in the build window (#61)
• 2371c65 feat: signup pointer for newcomers with a disclosed DigitalOcean referral (#59)
• 78267ae feat: structured audit trail of infra actions (L3) (#46)
• 42eb340 feat: wire --profile / $PANDION_PROFILE through all commands (#80) (#80)
• d7453af fix(ci): cask token must use {{ .Env.VAR }} form (#17)
• 7b1f6df fix(cli): wire lambda into the up dispatch; fail loud on unwired provider (#86) (#86)
• 2616b42 fix(cluster): auto-rollback on Ctrl+C during provisioning (F15) (#10)
• 3d6f190 fix(config): allow lambda as a cluster provider; add multi-node GPU e2e (#97)
• eb43db1 fix(harden): disable_root=false so root SSH works on Lambda/OCI (#87) (#87)
• e183dee fix(lambda): open the WireGuard port so overlay + lockdown work (#92)
• 911a524 fix(lambda): retry Cloudflare 429s with backoff + client-side throttle (#103)
• 9dae9c7 fix(lambda): treat terminating instances as gone; validate G1 live (#85) (#85)
• 9c3b7a4 fix(ls): match gpu-util node by IP, not name (Lambda name mismatch) (#113)
• 2ba4e00 fix(ls): populate region in ls + add ls/cost e2e (M4 follow-up) (#29)
• f356f5b fix(ls): retry the --gpu-util read so a transient SSH miss doesn't blank it (#108)
• a1c59a7 fix(provider): namespace Hetzner server names by cluster id (F9)
• f2ad7ee fix(provider): register login key with Hetzner; observable SSH retry
• 9cece84 fix(script): lockdown takes only --id (provider from manifest) (#88)
• 293aaab fix(teardown): destroy backoff + error aggregation (R8) and safe-to-re-run hints (R12) (#118)
• 81d898b fix: Scaleway multi-node — register login key via IAM (reliable root injection) (#57)
• 6aa3f52 fix: Vultr user_data base64 + no-leak e2e teardown; roadmap note (#49)
• 5f080ff polish: actionable credential errors for Vultr + Scaleway (#50)
• 9f923a8 release: 0.7.0 — GPU support (Lambda + DO Droplets), profiles (#91)
• d1740f4 release: 0.7.1 — Lambda overlay/lockdown firewall fix (#93)
• 69331eb release: cut CHANGELOG 0.6.0 (Relay + AGPL + init/config) (#76)
• c168086 release: v0.4.0 — 5 providers + IDE Tier-2 debug-attach (#52)
• f9502eb rename: EnvCore -> Pandion (#26)
• 5b9c6e4 style: gofmt-clean files from recent features (fix red CI) (#115)
• 290f89b test(gpu): comprehensive, cost-controlled GPU e2e (scripts/e2e_gpu_full.sh) (#102)
• 3369fa7 test(script): add scripts/e2e_do_gpu.sh — DO GPU Droplet e2e runner (#90)
• 54661ce test(security): cross-provider hardening matrix runner (P1.3) (#106)
• 02ae707 test(security): e2e for lockdown safety gate + overlay-only-SSH (P1) (#105)