v0.3.20

[0.3.20] - 2026-08-07

Added

• DevOps runbooks — docs/devops/ Passport CI gate, offline repair worker,
  air-gap packages/VirtIO, fleet analyze, cutover weekend, failure triage,
  cloud disk sources (S3/GCS/Azure), forensic IR, SBOM/inventory CI.
• GitHub Wiki — operator cheat sheets (Passport, day-0, packages, env,
  TUI, KubeVirt/GCF/agent) linked from README / docs INDEX.
• GUESTKIT_PACKAGE_MIRROR — HTTP fallback via curl/wget when host
  dnf/apt-get is missing or fails (comma-separated bases; optional
  {name}/{ext} templates). Helps macOS hosts stage PackageInstall.
• Domain-leave first-boot RunOnce — windows-domain-leave stages
  GuestKitDomainLeave RunOnce (Add-Computer -WorkGroupName) in addition
  to Tcpip/Winlogon markers (DC computer-account delete still needs live AD).
• Worker performance + migration profiles — guestkit.profile jobs run
  the same CLI InspectionProfile implementations as guestkit profile.
• Offline ServiceOperation / CommandExec staging — enable/disable via
  systemd wants Symlink/FileDelete; start/restart and other commands stage
  guestkit-firstboot-live.service when chroot cannot run them.
• UEFI-aware fix-grub --force — detects ESP under the guest root and
  runs grub-install --target=x86_64-efi|arm64-efi --efi-directory=… --no-nvram --removable (BIOS path unchanged).
• Windows AES/RC4 SAM NT-hash write — rescue -o reset-password --password
  reconstructs the SYSKEY bootkey from SYSTEM LSA class names, derives the
  hashed bootkey from SAM F, and writes an AES-128-CBC (or legacy RC4)
  encrypted NT hash into the user V blob. Falls back to SAM blank + RunOnce
  net user if SYSTEM/bootkey/crypto fails.
• PackageInstall host fetch — with GUESTKIT_PACKAGE_FETCH=1, offline
  plan apply downloads missing .rpm/.deb on the host (dnf download /
  yumdownloader / apt-get download) into GUESTKIT_PACKAGE_CACHE or
  ~/.cache/guestkit/packages, then stages the first-boot oneshot as before.
• Offline GRUB repair (fix-grub) — rescue -o fix-grub bind-mounts
  proc/sys/dev and runs chroot grub2-mkconfig / grub-mkconfig /
  update-grub; --force also attempts grub-install onto the NBD device
  (BIOS) or EFI removable path when an ESP is present;
  if chroot mkconfig fails, stages guestkit-firstboot-grub.service.
  --export-plan writes the first-boot FileWrite/Symlink ops. check-grub
  remains diagnose-only.
• System Reserved / ESP detection — offline Windows evidence probes
  non-OS NTFS/FAT volumes for bootmgr + BCD (legacy System Reserved) or
  EFI Microsoft Boot (ESP). Surfaces on windows.system_reserved, promotes
  bcd_store_found / bootmgr_found, fixes esp_present (no longer aliased
  to bootmgr). Boot check BOOT-014, migration MIG-W-011, Passport
  flags system_reserved_layout + bcd_store_found.
• Windows driver/hotfix migration diagnostics — offline HotFix registry +
  $NtUninstall* / $hf_mig$ / CBS.log tail; VirtIO .sys presence on
  WindowsDriverEntry.sys_present; BCD UTF-16 probe for testsigning /
  nointegritychecks. Migration MIG-W-012 (hotfixes/servicing),
  MIG-W-013 (VirtIO files); Passport hotfix_count /
  hf_mig_present / driver_signature_enforcement. Hive paths resolve via
  guestfs mount root.
• Offline activation / ghost-NIC depth — SOFTWARE ProductId/EditionID/
  DigitalProductId + oeminfo.ini → windows.activation (OEM/Retail/Volume);
  SYSTEM Enum\PCI remnant/problem NICs → ghost_nics; Tcpip static
  interfaces → static_nic_configs. Enriches MIG-W-006/007/008; Passport
  activation_channel, ghost_nic_count, static_nic_count.
• Offline BitLocker / VSS enrichment — BitLockerStatus\BootStatus (On →
  hard block), FVE/$BitLocker/fvevol artifacts (offline_uncertain warning),
  VSS+swprv services + System Volume Information inference. Fills
  windows.bitlocker / windows.vss for MIG-W-005/009; Passport
  bitlocker_uncertain.
• Day-0 plan/rescue depth — windows-dhcp / windows-dns / linux-hostname
  profiles; rescue enable-rdp / enable-winrm / set-timezone; Windows
  set-hostname applies registry day-0 plan (was Linux /etc/hostname).
• Cutover Passport signed-enterprise workflows — passport keygen (Ed25519
  seed + pubkey); emit --issuer / --expires-hours; verify --trust-keys
  allowlist + --max-age-hours freshness gate (signing/verify need agent).
• Production Helm — values-prod.yaml: PVC-backed Postgres/Redis/MinIO
  (eval still emptyDir); Ingress TLS + cert-manager annotations; pinned
  GHCR v0.3.19 images; nightly image-vault backup CronJob + backup PVC.
• Guest Control Fabric poll telemetry — airgap reconciler records per-method
  latency + transport attempts; Redis fleet rollup; GET .../guest/poll-telemetry
  (VM + fleet); guest/status exposes lastPoll / telemetryMode.
• Fleet analyze performance — parallel --jobs / GUESTKIT_FLEET_JOBS
  (default min(4, CPUs)); evidence-cache hit skips remount.
• Cloud disk source depth — persistent ~/.cache/guestkit/cloud pulls;
  S3 GUESTKIT_S3_ENDPOINT/AWS_ENDPOINT_URL; azure:// URIs; GCS
  gcloud storage fallback; CI recipe scripts/ci-cloud-disk-sources.sh.
• Offline heuristic remediations + linux-grub — systemctl enable/disable
  → Symlink/FileDelete; fail2ban/auditd/chrony/apparmor/sshd enable offline;
  ufw default deny FileEdit; day-0 linux-grub (--grub-timeout /
  --grub-cmdline) for /etc/default/grub.
• Offline PackageInstall staging — when GUESTKIT_PACKAGE_CACHE (or
  host_cache) holds matching .rpm/.deb, offline plan apply stages
  packages + a first-boot systemd oneshot instead of skipping; optional
  GUESTKIT_PACKAGE_FETCH=1 downloads missing packages on the host first;
  live install unchanged.
• Windows offline password set — rescue -o reset-password --password
  prefers AES/RC4 SAM NT-hash write via SYSKEY; falls back to SAM blank +
  HKLM RunOnce net user for first boot; omit --password to blank only.

Changed

• Docs — Roadmap parked list cleared; CLI / quick-reference / feature guide /
  fix-plans updated for AES SAM passwords, fix-grub, and
  GUESTKIT_PACKAGE_FETCH offline staging.