Releases

0.8.0

404 commit(s) since v0.7.2.

Features

mlog: opt-in OpenTelemetry export, switches and a local spool (2/7, spec 25) (#1994) (f4c13e4)
min, minimald: one trace per request across the CLI and the daemon (3/7, spec 25) (#1995) (98dbe05)
minvmd: export the VM host daemon's spans and carry telemetry into the guest (4/7, spec 25) (#1996) (8af4e1d)
diag: min bug carries the telemetry spool and redacts telemetry settings (5/7, spec 25) (#1997) (1af0a88)
otel: guest telemetry rides the VM channel (#2039) (f5bb38c)
packaging: ship minzoned in a signed macOS app bundle with the app icon (#2188) (4a87666)
stdlib: type the patch ledger by kind, and check revision against it (#1277) (aa13deb)
scripts: report non-Rust dependency pins and bump the pkgs locked_commit (#1875) (482c744)
bep: add the bep crate with the GitHub module and the sealed envelope (#2346) (c2f0b78)
bep: hold the proxy keys in the host keychain and publish their identity (#2363) (f8431d0)
bep: append one hash-chained audit record per proxy decision (#2361) (b8b4f22)
min: refuse GitHub grants at activation that the box or the host cannot honour (#2365) (767c59f)
bep: issue leaf certificates under a name-constrained root and a signing CA (#2438) (788b6ec)
bep: decide redemption as a pure function over host key, attribution and bounds (#2359) (554eff3)
min: sign in to GitHub under the published App, kept in the host keychain (#2364) (5919d28)
bep: refuse off-set authorities, off-port and expired values (#2448) (03466f7)
min: add min box spec with root fingerprint, upstream set, steering and full marker (#2443) (0c33a45)
bep: parse request heads strictly and forward a canonical head and body (#2362) (35529c8)
min: read one box's audit trail with min box audit (#2457) (334e184)
bep: refuse undeclared egress and host mismatches, admit only when every check passes (#2450) (4fcfa9c)
bep: verify store handles against the client's registered key and the current rule (#2467) (248b259)
bep: accept only box connections and terminate TLS for the module hosts over HTTP/1.1 (#2475) (cff2d9e)
bep: validate the upstream, pass unsealed requests through, and stream replies (#2481) (cc56e3b)
bep: wire the redemption decision and each box's declared egress into bep serve (#2486) (47223e0)
minimal: mint sealed GitHub sign-in references and register the box with the proxy (#2490) (e55b32c)
minimald: deliver each GitHub grant's sealed value into its variable in the box (#2491) (3eb782b)
minimald: point a proxy_env box's environment at the proxy (#2492) (e8feee2)
bep: issue and publish the host root certificate and hand it to each grant box (#2493) (efb91c7)
minimald: put the proxy's root certificate in a grant box's trust store (#2495) (197a96b)
minvmd: start the Box Egress Proxy beside gvproxy so git and gh reach GitHub (#2497) (ccc4f95)
bep: rotate the signing CA under an unchanged root (#2508) (99ade7d)
minimal: log out deletes the sign-in and refuses every reference to it (#2512) (42cf41d)
net: reject UDP to port 443 where a box's QUIC stance is blocked (#2513) (1c94b06)
bep: attribute a host-address redemption to its cohort and mark the audit (#2511) (2aa47e7)
minimal: read client-owned store rules and refuse rules in the deny set (#2514) (55d0845)
bep: renew an expiring GitHub sign-in once at the proxy (#2518) (f388b54)
minimal: mint store handles and keep client keys registered across proxy restarts (#2520) (17ce321)
minimald: steer credentialed names to the proxy and fail closed while it is down (#2519) (33b984a)
bep: rotate the signing CA through the control socket (#2545) (230709d)
minimal: check store rules at box creation and ask once per item (T54) (#2552) (15e9079)
minimal: sign store handles under one host-keychain client key (T59) (#2557) (4180736)
minimald: block UDP 443 for a host_ip cohort with a blocked QUIC stance (T53) (#2553) (160d3ed)
minimal: store, list and remove secrets with min secret (T26) (#2522) (da0bdfb)
minimal: list each store reference with its authorities in min box spec (T61) (#2569) (81ccbce)
minimald: ship a git credential helper in grant boxes (T50) (#2547) (853a4f6)
bep: record a revocation when a live box is destroyed (T20) (#2548) (7529939)
bep: revoke or replace a registered client key and bound the registry (T63) (#2571) (cdcf1a2)
bep: carry a store handle sealed as a store member (T60) (#2568) (694dba5)
minimal: lay out the split VM users, directories and socket modes (T65) (#2561) (be9202e)
minimald: steer the credentialed names of dns and both boxes through the gate (T58) (#2567) (3061ef1)
bep: deny Minimal's infrastructure domains in the box CA and store rules (T55) (#2582) (8409ca0)
bep: inject a stored key in its registered form per request (T28) (#2574) (bec5136)
bep: rotate audit segments, carry the chain and restore revocations at start (T33) (#2583) (9d3dc96)
bep: name the kid when a store handle is refused as unknown_key (#2592) (a1e65c5)
bep: wire the client-key bound into bep serve with --max-client-keys (T69) (#2593) (e8f53f6)
minimal: give a box re-created under its name an id of its own that redeems (T22) (#2584) (a38e265)
bep: carry the handle jti into the audit record (T68) (#2596) (e455d2d)
minimal: write the store rule from min secret set with fixed-token presets (T39) (#2577) (78e2a51)
bep: inject store values in bep serve (T67) (#2597) (5a93a07)
minimald: reject UDP 443 from a blocked cohort's own leaves (T72) (#2601) (5741f2f)
minvmd: refuse a minted box id that a retained revocation record holds (T74) (#2611) (2fc77ce)
bep: keep a replaced client key verifying until its boxes end (T84) (#2615) (4152396)
bep: give bep serve a chain-preserving way out of an unreadable audit line (T75) (#2608) (2ced764)
minimal: name the QUIC block helper in min finalize-install (T88) (#2644) (b49feb5)
minvmd: check a minted box id against retained revocations with no proxy (T89) (#2643) (8c5d45a)
bep: give bep serve the client's store rules so a store member is admitted (T83) (#2614) (dbba22b)
bep: free the client key of a box that ended without forget_box (T90) (#2642) (1b7dfad)
bep: admit a widened store rule without restarting bep serve (T91) (#2663) (bdc7a84)
minimal: keep store rules under min --config-dir in step with bep serve (T92) (#2666) (fad7c72)
just: add a preflight check and default cross to the amd64 image (#2478) (6f5ed76)
minimald: proxy runtime-published ports like a direct connection (T99) (#2714) (7097b96)
minimal: make min login the GitHub sign-in and drop retired cert surfaces (T113) (#2719) (cc55fef)
minimald: record VM refusals on the host and admit RPC only from the host (T107) (#2721) (abe99f7)
minimald: refuse an activation whose declared port something else holds (T100) (#2725) (703bb7f)
minimal: report an edited audit chain in min doctor (T34) (#2603) (d5e802b)
minimal: keep box names answering across a reboot and a second VM (T119) (#2722) (1f4bfd6)
minimald: route the documented host literal on a native daemon (T116) (#2715) (eebb8fb)
minimald: answer a macOS box's ports at the address its name resolves to (T98) (#2713) (64d3358)
minimald: refuse unmatched names for partial allow lists and gate proxy callers (T106) (#2716) (302edaf)
minimald: run a box's package builds under that box's egress verdict (#2720) (a26f89b)
minvmd: decide the node plane's own traffic by its baseline set (#2723) (486ea13)
bep: re-certify the published root when a store registration changes (#2767) (642b738)
minimal: read each box's parent so box audit --parent merges (#2800) (79c5030)
release: ship a signed, notarized bep beside minvmd on macOS (#2792) (e0fb640)
min: finish GitHub sign-in on a real page and offer repository choice (#2775) (463458e)
bep: hold the proxy's keys in the Secure Enclave inside bep.app (#2823) (6571aa3)
otel: a span on the ten error-returning entry points the instrumentation scan found (#2763) (628f0d9)
minimald: interim answerer holds host.min.internal at loopback (#2985) (014fa3e)

Fixes

minimal: say DNS, min.internal and box IPs plainly in finalize-install --show (#2166) (f90cf02)
minvmd: reword the DNS-service refusals and minzoned release output in plain language (#2169) (0fb46a8)
minvmd: reword refusal messages in plain language (#2171) (7dc57e6)
cli,tui: reword cleanup and status warnings in plain language (#2175) (12a1152)
minimald: reword network refusals and errors in plain language (#2173) (0ed86a6)
minimald: reword attach refusals and port-request failures in plain language (#2172) (710abda)
sessions: reword the credentialed-upstream policy row and ingress errors (#2180) (f3001e5)
minimal: say the finalize-install egress item plainly (#2179) (1f6bc55)
minimal: reword the min ls header rows and list warnings in plain language (#2182) (9db0c46)
minimal: reword the box-name rows, the names line and session start messages in plain language (#2183) (080797e)
minimal: skip the port-prompt subscription for a box with no host row (#2187) (4e168f6)
switch: raise the outbound tcp connect bound so a burst of connections stops timing out (#2184) (265081b)
minimald: elect one holder for a shared ingress port by creation order (#2185) (6f32545)
minimal: accept a sticky root-owned directory and check before changing the host (#2195) (acda93b)
minvmd: bind a waiting decl...

0.8.0

386 commit(s) since v0.7.2.

Features

mlog: opt-in OpenTelemetry export, switches and a local spool (2/7, spec 25) (#1994) (f4c13e4)
min, minimald: one trace per request across the CLI and the daemon (3/7, spec 25) (#1995) (98dbe05)
minvmd: export the VM host daemon's spans and carry telemetry into the guest (4/7, spec 25) (#1996) (8af4e1d)
diag: min bug carries the telemetry spool and redacts telemetry settings (5/7, spec 25) (#1997) (1af0a88)
otel: guest telemetry rides the VM channel (#2039) (f5bb38c)
packaging: ship minzoned in a signed macOS app bundle with the app icon (#2188) (4a87666)
stdlib: type the patch ledger by kind, and check revision against it (#1277) (aa13deb)
scripts: report non-Rust dependency pins and bump the pkgs locked_commit (#1875) (482c744)
bep: add the bep crate with the GitHub module and the sealed envelope (#2346) (c2f0b78)
bep: hold the proxy keys in the host keychain and publish their identity (#2363) (f8431d0)
bep: append one hash-chained audit record per proxy decision (#2361) (b8b4f22)
min: refuse GitHub grants at activation that the box or the host cannot honour (#2365) (767c59f)
bep: issue leaf certificates under a name-constrained root and a signing CA (#2438) (788b6ec)
bep: decide redemption as a pure function over host key, attribution and bounds (#2359) (554eff3)
min: sign in to GitHub under the published App, kept in the host keychain (#2364) (5919d28)
bep: refuse off-set authorities, off-port and expired values (#2448) (03466f7)
min: add min box spec with root fingerprint, upstream set, steering and full marker (#2443) (0c33a45)
bep: parse request heads strictly and forward a canonical head and body (#2362) (35529c8)
min: read one box's audit trail with min box audit (#2457) (334e184)
bep: refuse undeclared egress and host mismatches, admit only when every check passes (#2450) (4fcfa9c)
bep: verify store handles against the client's registered key and the current rule (#2467) (248b259)
bep: accept only box connections and terminate TLS for the module hosts over HTTP/1.1 (#2475) (cff2d9e)
bep: validate the upstream, pass unsealed requests through, and stream replies (#2481) (cc56e3b)
bep: wire the redemption decision and each box's declared egress into bep serve (#2486) (47223e0)
minimal: mint sealed GitHub sign-in references and register the box with the proxy (#2490) (e55b32c)
minimald: deliver each GitHub grant's sealed value into its variable in the box (#2491) (3eb782b)
minimald: point a proxy_env box's environment at the proxy (#2492) (e8feee2)
bep: issue and publish the host root certificate and hand it to each grant box (#2493) (efb91c7)
minimald: put the proxy's root certificate in a grant box's trust store (#2495) (197a96b)
minvmd: start the Box Egress Proxy beside gvproxy so git and gh reach GitHub (#2497) (ccc4f95)
bep: rotate the signing CA under an unchanged root (#2508) (99ade7d)
minimal: log out deletes the sign-in and refuses every reference to it (#2512) (42cf41d)
net: reject UDP to port 443 where a box's QUIC stance is blocked (#2513) (1c94b06)
bep: attribute a host-address redemption to its cohort and mark the audit (#2511) (2aa47e7)
minimal: read client-owned store rules and refuse rules in the deny set (#2514) (55d0845)
bep: renew an expiring GitHub sign-in once at the proxy (#2518) (f388b54)
minimal: mint store handles and keep client keys registered across proxy restarts (#2520) (17ce321)
minimald: steer credentialed names to the proxy and fail closed while it is down (#2519) (33b984a)
bep: rotate the signing CA through the control socket (#2545) (230709d)
minimal: check store rules at box creation and ask once per item (T54) (#2552) (15e9079)
minimal: sign store handles under one host-keychain client key (T59) (#2557) (4180736)
minimald: block UDP 443 for a host_ip cohort with a blocked QUIC stance (T53) (#2553) (160d3ed)
minimal: store, list and remove secrets with min secret (T26) (#2522) (da0bdfb)
minimal: list each store reference with its authorities in min box spec (T61) (#2569) (81ccbce)
minimald: ship a git credential helper in grant boxes (T50) (#2547) (853a4f6)
bep: record a revocation when a live box is destroyed (T20) (#2548) (7529939)
bep: revoke or replace a registered client key and bound the registry (T63) (#2571) (cdcf1a2)
bep: carry a store handle sealed as a store member (T60) (#2568) (694dba5)
minimal: lay out the split VM users, directories and socket modes (T65) (#2561) (be9202e)
minimald: steer the credentialed names of dns and both boxes through the gate (T58) (#2567) (3061ef1)
bep: deny Minimal's infrastructure domains in the box CA and store rules (T55) (#2582) (8409ca0)
bep: inject a stored key in its registered form per request (T28) (#2574) (bec5136)
bep: rotate audit segments, carry the chain and restore revocations at start (T33) (#2583) (9d3dc96)
bep: name the kid when a store handle is refused as unknown_key (#2592) (a1e65c5)
bep: wire the client-key bound into bep serve with --max-client-keys (T69) (#2593) (e8f53f6)
minimal: give a box re-created under its name an id of its own that redeems (T22) (#2584) (a38e265)
bep: carry the handle jti into the audit record (T68) (#2596) (e455d2d)
minimal: write the store rule from min secret set with fixed-token presets (T39) (#2577) (78e2a51)
bep: inject store values in bep serve (T67) (#2597) (5a93a07)
minimald: reject UDP 443 from a blocked cohort's own leaves (T72) (#2601) (5741f2f)
minvmd: refuse a minted box id that a retained revocation record holds (T74) (#2611) (2fc77ce)
bep: keep a replaced client key verifying until its boxes end (T84) (#2615) (4152396)
bep: give bep serve a chain-preserving way out of an unreadable audit line (T75) (#2608) (2ced764)
minimal: name the QUIC block helper in min finalize-install (T88) (#2644) (b49feb5)
minvmd: check a minted box id against retained revocations with no proxy (T89) (#2643) (8c5d45a)
bep: give bep serve the client's store rules so a store member is admitted (T83) (#2614) (dbba22b)
bep: free the client key of a box that ended without forget_box (T90) (#2642) (1b7dfad)
bep: admit a widened store rule without restarting bep serve (T91) (#2663) (bdc7a84)
minimal: keep store rules under min --config-dir in step with bep serve (T92) (#2666) (fad7c72)
just: add a preflight check and default cross to the amd64 image (#2478) (6f5ed76)
minimald: proxy runtime-published ports like a direct connection (T99) (#2714) (7097b96)
minimal: make min login the GitHub sign-in and drop retired cert surfaces (T113) (#2719) (cc55fef)
minimald: record VM refusals on the host and admit RPC only from the host (T107) (#2721) (abe99f7)
minimald: refuse an activation whose declared port something else holds (T100) (#2725) (703bb7f)
minimal: report an edited audit chain in min doctor (T34) (#2603) (d5e802b)
minimal: keep box names answering across a reboot and a second VM (T119) (#2722) (1f4bfd6)
minimald: route the documented host literal on a native daemon (T116) (#2715) (eebb8fb)
minimald: answer a macOS box's ports at the address its name resolves to (T98) (#2713) (64d3358)
minimald: refuse unmatched names for partial allow lists and gate proxy callers (T106) (#2716) (302edaf)
minimald: run a box's package builds under that box's egress verdict (#2720) (a26f89b)
minvmd: decide the node plane's own traffic by its baseline set (#2723) (486ea13)
bep: re-certify the published root when a store registration changes (#2767) (642b738)
minimal: read each box's parent so box audit --parent merges (#2800) (79c5030)
release: ship a signed, notarized bep beside minvmd on macOS (#2792) (e0fb640)
min: finish GitHub sign-in on a real page and offer repository choice (#2775) (463458e)
bep: hold the proxy's keys in the Secure Enclave inside bep.app (#2823) (6571aa3)
otel: a span on the ten error-returning entry points the instrumentation scan found (#2763) (628f0d9)
minimald: interim answerer holds host.min.internal at loopback (#2985) (014fa3e)

Fixes

minimal: say DNS, min.internal and box IPs plainly in finalize-install --show (#2166) (f90cf02)
minvmd: reword the DNS-service refusals and minzoned release output in plain language (#2169) (0fb46a8)
minvmd: reword refusal messages in plain language (#2171) (7dc57e6)
cli,tui: reword cleanup and status warnings in plain language (#2175) (12a1152)
minimald: reword network refusals and errors in plain language (#2173) (0ed86a6)
minimald: reword attach refusals and port-request failures in plain language (#2172) (710abda)
sessions: reword the credentialed-upstream policy row and ingress errors (#2180) (f3001e5)
minimal: say the finalize-install egress item plainly (#2179) (1f6bc55)
minimal: reword the min ls header rows and list warnings in plain language (#2182) (9db0c46)
minimal: reword the box-name rows, the names line and session start messages in plain language (#2183) (080797e)
minimal: skip the port-prompt subscription for a box with no host row (#2187) (4e168f6)
switch: raise the outbound tcp connect bound so a burst of connections stops timing out (#2184) (265081b)
minimald: elect one holder for a shared ingress port by creation order (#2185) (6f32545)
minimal: accept a sticky root-owned directory and check before changing the host (#2195) (acda93b)
minvmd: bind a waiting decl...

0.8.0

377 commit(s) since v0.7.2.

Features

mlog: opt-in OpenTelemetry export, switches and a local spool (2/7, spec 25) (#1994) (f4c13e4)
min, minimald: one trace per request across the CLI and the daemon (3/7, spec 25) (#1995) (98dbe05)
minvmd: export the VM host daemon's spans and carry telemetry into the guest (4/7, spec 25) (#1996) (8af4e1d)
diag: min bug carries the telemetry spool and redacts telemetry settings (5/7, spec 25) (#1997) (1af0a88)
otel: guest telemetry rides the VM channel (#2039) (f5bb38c)
packaging: ship minzoned in a signed macOS app bundle with the app icon (#2188) (4a87666)
stdlib: type the patch ledger by kind, and check revision against it (#1277) (aa13deb)
scripts: report non-Rust dependency pins and bump the pkgs locked_commit (#1875) (482c744)
bep: add the bep crate with the GitHub module and the sealed envelope (#2346) (c2f0b78)
bep: hold the proxy keys in the host keychain and publish their identity (#2363) (f8431d0)
bep: append one hash-chained audit record per proxy decision (#2361) (b8b4f22)
min: refuse GitHub grants at activation that the box or the host cannot honour (#2365) (767c59f)
bep: issue leaf certificates under a name-constrained root and a signing CA (#2438) (788b6ec)
bep: decide redemption as a pure function over host key, attribution and bounds (#2359) (554eff3)
min: sign in to GitHub under the published App, kept in the host keychain (#2364) (5919d28)
bep: refuse off-set authorities, off-port and expired values (#2448) (03466f7)
min: add min box spec with root fingerprint, upstream set, steering and full marker (#2443) (0c33a45)
bep: parse request heads strictly and forward a canonical head and body (#2362) (35529c8)
min: read one box's audit trail with min box audit (#2457) (334e184)
bep: refuse undeclared egress and host mismatches, admit only when every check passes (#2450) (4fcfa9c)
bep: verify store handles against the client's registered key and the current rule (#2467) (248b259)
bep: accept only box connections and terminate TLS for the module hosts over HTTP/1.1 (#2475) (cff2d9e)
bep: validate the upstream, pass unsealed requests through, and stream replies (#2481) (cc56e3b)
bep: wire the redemption decision and each box's declared egress into bep serve (#2486) (47223e0)
minimal: mint sealed GitHub sign-in references and register the box with the proxy (#2490) (e55b32c)
minimald: deliver each GitHub grant's sealed value into its variable in the box (#2491) (3eb782b)
minimald: point a proxy_env box's environment at the proxy (#2492) (e8feee2)
bep: issue and publish the host root certificate and hand it to each grant box (#2493) (efb91c7)
minimald: put the proxy's root certificate in a grant box's trust store (#2495) (197a96b)
minvmd: start the Box Egress Proxy beside gvproxy so git and gh reach GitHub (#2497) (ccc4f95)
bep: rotate the signing CA under an unchanged root (#2508) (99ade7d)
minimal: log out deletes the sign-in and refuses every reference to it (#2512) (42cf41d)
net: reject UDP to port 443 where a box's QUIC stance is blocked (#2513) (1c94b06)
bep: attribute a host-address redemption to its cohort and mark the audit (#2511) (2aa47e7)
minimal: read client-owned store rules and refuse rules in the deny set (#2514) (55d0845)
bep: renew an expiring GitHub sign-in once at the proxy (#2518) (f388b54)
minimal: mint store handles and keep client keys registered across proxy restarts (#2520) (17ce321)
minimald: steer credentialed names to the proxy and fail closed while it is down (#2519) (33b984a)
bep: rotate the signing CA through the control socket (#2545) (230709d)
minimal: check store rules at box creation and ask once per item (T54) (#2552) (15e9079)
minimal: sign store handles under one host-keychain client key (T59) (#2557) (4180736)
minimald: block UDP 443 for a host_ip cohort with a blocked QUIC stance (T53) (#2553) (160d3ed)
minimal: store, list and remove secrets with min secret (T26) (#2522) (da0bdfb)
minimal: list each store reference with its authorities in min box spec (T61) (#2569) (81ccbce)
minimald: ship a git credential helper in grant boxes (T50) (#2547) (853a4f6)
bep: record a revocation when a live box is destroyed (T20) (#2548) (7529939)
bep: revoke or replace a registered client key and bound the registry (T63) (#2571) (cdcf1a2)
bep: carry a store handle sealed as a store member (T60) (#2568) (694dba5)
minimal: lay out the split VM users, directories and socket modes (T65) (#2561) (be9202e)
minimald: steer the credentialed names of dns and both boxes through the gate (T58) (#2567) (3061ef1)
bep: deny Minimal's infrastructure domains in the box CA and store rules (T55) (#2582) (8409ca0)
bep: inject a stored key in its registered form per request (T28) (#2574) (bec5136)
bep: rotate audit segments, carry the chain and restore revocations at start (T33) (#2583) (9d3dc96)
bep: name the kid when a store handle is refused as unknown_key (#2592) (a1e65c5)
bep: wire the client-key bound into bep serve with --max-client-keys (T69) (#2593) (e8f53f6)
minimal: give a box re-created under its name an id of its own that redeems (T22) (#2584) (a38e265)
bep: carry the handle jti into the audit record (T68) (#2596) (e455d2d)
minimal: write the store rule from min secret set with fixed-token presets (T39) (#2577) (78e2a51)
bep: inject store values in bep serve (T67) (#2597) (5a93a07)
minimald: reject UDP 443 from a blocked cohort's own leaves (T72) (#2601) (5741f2f)
minvmd: refuse a minted box id that a retained revocation record holds (T74) (#2611) (2fc77ce)
bep: keep a replaced client key verifying until its boxes end (T84) (#2615) (4152396)
bep: give bep serve a chain-preserving way out of an unreadable audit line (T75) (#2608) (2ced764)
minimal: name the QUIC block helper in min finalize-install (T88) (#2644) (b49feb5)
minvmd: check a minted box id against retained revocations with no proxy (T89) (#2643) (8c5d45a)
bep: give bep serve the client's store rules so a store member is admitted (T83) (#2614) (dbba22b)
bep: free the client key of a box that ended without forget_box (T90) (#2642) (1b7dfad)
bep: admit a widened store rule without restarting bep serve (T91) (#2663) (bdc7a84)
minimal: keep store rules under min --config-dir in step with bep serve (T92) (#2666) (fad7c72)
just: add a preflight check and default cross to the amd64 image (#2478) (6f5ed76)
minimald: proxy runtime-published ports like a direct connection (T99) (#2714) (7097b96)
minimal: make min login the GitHub sign-in and drop retired cert surfaces (T113) (#2719) (cc55fef)
minimald: record VM refusals on the host and admit RPC only from the host (T107) (#2721) (abe99f7)
minimald: refuse an activation whose declared port something else holds (T100) (#2725) (703bb7f)
minimal: report an edited audit chain in min doctor (T34) (#2603) (d5e802b)
minimal: keep box names answering across a reboot and a second VM (T119) (#2722) (1f4bfd6)
minimald: route the documented host literal on a native daemon (T116) (#2715) (eebb8fb)
minimald: answer a macOS box's ports at the address its name resolves to (T98) (#2713) (64d3358)
minimald: refuse unmatched names for partial allow lists and gate proxy callers (T106) (#2716) (302edaf)
minimald: run a box's package builds under that box's egress verdict (#2720) (a26f89b)
minvmd: decide the node plane's own traffic by its baseline set (#2723) (486ea13)
bep: re-certify the published root when a store registration changes (#2767) (642b738)
minimal: read each box's parent so box audit --parent merges (#2800) (79c5030)
release: ship a signed, notarized bep beside minvmd on macOS (#2792) (e0fb640)
min: finish GitHub sign-in on a real page and offer repository choice (#2775) (463458e)
bep: hold the proxy's keys in the Secure Enclave inside bep.app (#2823) (6571aa3)
otel: a span on the ten error-returning entry points the instrumentation scan found (#2763) (628f0d9)
minimald: interim answerer holds host.min.internal at loopback (#2985) (014fa3e)

Fixes

minimal: say DNS, min.internal and box IPs plainly in finalize-install --show (#2166) (f90cf02)
minvmd: reword the DNS-service refusals and minzoned release output in plain language (#2169) (0fb46a8)
minvmd: reword refusal messages in plain language (#2171) (7dc57e6)
cli,tui: reword cleanup and status warnings in plain language (#2175) (12a1152)
minimald: reword network refusals and errors in plain language (#2173) (0ed86a6)
minimald: reword attach refusals and port-request failures in plain language (#2172) (710abda)
sessions: reword the credentialed-upstream policy row and ingress errors (#2180) (f3001e5)
minimal: say the finalize-install egress item plainly (#2179) (1f6bc55)
minimal: reword the min ls header rows and list warnings in plain language (#2182) (9db0c46)
minimal: reword the box-name rows, the names line and session start messages in plain language (#2183) (080797e)
minimal: skip the port-prompt subscription for a box with no host row (#2187) (4e168f6)
switch: raise the outbound tcp connect bound so a burst of connections stops timing out (#2184) (265081b)
minimald: elect one holder for a shared ingress port by creation order (#2185) (6f32545)
minimal: accept a sticky root-owned directory and check before changing the host (#2195) (acda93b)
minvmd: bind a waiting decl...

0.8.0

372 commit(s) since v0.7.2.

Features

mlog: opt-in OpenTelemetry export, switches and a local spool (2/7, spec 25) (#1994) (f4c13e4)
min, minimald: one trace per request across the CLI and the daemon (3/7, spec 25) (#1995) (98dbe05)
minvmd: export the VM host daemon's spans and carry telemetry into the guest (4/7, spec 25) (#1996) (8af4e1d)
diag: min bug carries the telemetry spool and redacts telemetry settings (5/7, spec 25) (#1997) (1af0a88)
otel: guest telemetry rides the VM channel (#2039) (f5bb38c)
packaging: ship minzoned in a signed macOS app bundle with the app icon (#2188) (4a87666)
stdlib: type the patch ledger by kind, and check revision against it (#1277) (aa13deb)
scripts: report non-Rust dependency pins and bump the pkgs locked_commit (#1875) (482c744)
bep: add the bep crate with the GitHub module and the sealed envelope (#2346) (c2f0b78)
bep: hold the proxy keys in the host keychain and publish their identity (#2363) (f8431d0)
bep: append one hash-chained audit record per proxy decision (#2361) (b8b4f22)
min: refuse GitHub grants at activation that the box or the host cannot honour (#2365) (767c59f)
bep: issue leaf certificates under a name-constrained root and a signing CA (#2438) (788b6ec)
bep: decide redemption as a pure function over host key, attribution and bounds (#2359) (554eff3)
min: sign in to GitHub under the published App, kept in the host keychain (#2364) (5919d28)
bep: refuse off-set authorities, off-port and expired values (#2448) (03466f7)
min: add min box spec with root fingerprint, upstream set, steering and full marker (#2443) (0c33a45)
bep: parse request heads strictly and forward a canonical head and body (#2362) (35529c8)
min: read one box's audit trail with min box audit (#2457) (334e184)
bep: refuse undeclared egress and host mismatches, admit only when every check passes (#2450) (4fcfa9c)
bep: verify store handles against the client's registered key and the current rule (#2467) (248b259)
bep: accept only box connections and terminate TLS for the module hosts over HTTP/1.1 (#2475) (cff2d9e)
bep: validate the upstream, pass unsealed requests through, and stream replies (#2481) (cc56e3b)
bep: wire the redemption decision and each box's declared egress into bep serve (#2486) (47223e0)
minimal: mint sealed GitHub sign-in references and register the box with the proxy (#2490) (e55b32c)
minimald: deliver each GitHub grant's sealed value into its variable in the box (#2491) (3eb782b)
minimald: point a proxy_env box's environment at the proxy (#2492) (e8feee2)
bep: issue and publish the host root certificate and hand it to each grant box (#2493) (efb91c7)
minimald: put the proxy's root certificate in a grant box's trust store (#2495) (197a96b)
minvmd: start the Box Egress Proxy beside gvproxy so git and gh reach GitHub (#2497) (ccc4f95)
bep: rotate the signing CA under an unchanged root (#2508) (99ade7d)
minimal: log out deletes the sign-in and refuses every reference to it (#2512) (42cf41d)
net: reject UDP to port 443 where a box's QUIC stance is blocked (#2513) (1c94b06)
bep: attribute a host-address redemption to its cohort and mark the audit (#2511) (2aa47e7)
minimal: read client-owned store rules and refuse rules in the deny set (#2514) (55d0845)
bep: renew an expiring GitHub sign-in once at the proxy (#2518) (f388b54)
minimal: mint store handles and keep client keys registered across proxy restarts (#2520) (17ce321)
minimald: steer credentialed names to the proxy and fail closed while it is down (#2519) (33b984a)
bep: rotate the signing CA through the control socket (#2545) (230709d)
minimal: check store rules at box creation and ask once per item (T54) (#2552) (15e9079)
minimal: sign store handles under one host-keychain client key (T59) (#2557) (4180736)
minimald: block UDP 443 for a host_ip cohort with a blocked QUIC stance (T53) (#2553) (160d3ed)
minimal: store, list and remove secrets with min secret (T26) (#2522) (da0bdfb)
minimal: list each store reference with its authorities in min box spec (T61) (#2569) (81ccbce)
minimald: ship a git credential helper in grant boxes (T50) (#2547) (853a4f6)
bep: record a revocation when a live box is destroyed (T20) (#2548) (7529939)
bep: revoke or replace a registered client key and bound the registry (T63) (#2571) (cdcf1a2)
bep: carry a store handle sealed as a store member (T60) (#2568) (694dba5)
minimal: lay out the split VM users, directories and socket modes (T65) (#2561) (be9202e)
minimald: steer the credentialed names of dns and both boxes through the gate (T58) (#2567) (3061ef1)
bep: deny Minimal's infrastructure domains in the box CA and store rules (T55) (#2582) (8409ca0)
bep: inject a stored key in its registered form per request (T28) (#2574) (bec5136)
bep: rotate audit segments, carry the chain and restore revocations at start (T33) (#2583) (9d3dc96)
bep: name the kid when a store handle is refused as unknown_key (#2592) (a1e65c5)
bep: wire the client-key bound into bep serve with --max-client-keys (T69) (#2593) (e8f53f6)
minimal: give a box re-created under its name an id of its own that redeems (T22) (#2584) (a38e265)
bep: carry the handle jti into the audit record (T68) (#2596) (e455d2d)
minimal: write the store rule from min secret set with fixed-token presets (T39) (#2577) (78e2a51)
bep: inject store values in bep serve (T67) (#2597) (5a93a07)
minimald: reject UDP 443 from a blocked cohort's own leaves (T72) (#2601) (5741f2f)
minvmd: refuse a minted box id that a retained revocation record holds (T74) (#2611) (2fc77ce)
bep: keep a replaced client key verifying until its boxes end (T84) (#2615) (4152396)
bep: give bep serve a chain-preserving way out of an unreadable audit line (T75) (#2608) (2ced764)
minimal: name the QUIC block helper in min finalize-install (T88) (#2644) (b49feb5)
minvmd: check a minted box id against retained revocations with no proxy (T89) (#2643) (8c5d45a)
bep: give bep serve the client's store rules so a store member is admitted (T83) (#2614) (dbba22b)
bep: free the client key of a box that ended without forget_box (T90) (#2642) (1b7dfad)
bep: admit a widened store rule without restarting bep serve (T91) (#2663) (bdc7a84)
minimal: keep store rules under min --config-dir in step with bep serve (T92) (#2666) (fad7c72)
just: add a preflight check and default cross to the amd64 image (#2478) (6f5ed76)
minimald: proxy runtime-published ports like a direct connection (T99) (#2714) (7097b96)
minimal: make min login the GitHub sign-in and drop retired cert surfaces (T113) (#2719) (cc55fef)
minimald: record VM refusals on the host and admit RPC only from the host (T107) (#2721) (abe99f7)
minimald: refuse an activation whose declared port something else holds (T100) (#2725) (703bb7f)
minimal: report an edited audit chain in min doctor (T34) (#2603) (d5e802b)
minimal: keep box names answering across a reboot and a second VM (T119) (#2722) (1f4bfd6)
minimald: route the documented host literal on a native daemon (T116) (#2715) (eebb8fb)
minimald: answer a macOS box's ports at the address its name resolves to (T98) (#2713) (64d3358)
minimald: refuse unmatched names for partial allow lists and gate proxy callers (T106) (#2716) (302edaf)
minimald: run a box's package builds under that box's egress verdict (#2720) (a26f89b)
minvmd: decide the node plane's own traffic by its baseline set (#2723) (486ea13)
bep: re-certify the published root when a store registration changes (#2767) (642b738)
minimal: read each box's parent so box audit --parent merges (#2800) (79c5030)
release: ship a signed, notarized bep beside minvmd on macOS (#2792) (e0fb640)
min: finish GitHub sign-in on a real page and offer repository choice (#2775) (463458e)
bep: hold the proxy's keys in the Secure Enclave inside bep.app (#2823) (6571aa3)
otel: a span on the ten error-returning entry points the instrumentation scan found (#2763) (628f0d9)
minimald: interim answerer holds host.min.internal at loopback (#2985) (014fa3e)

Fixes

minimal: say DNS, min.internal and box IPs plainly in finalize-install --show (#2166) (f90cf02)
minvmd: reword the DNS-service refusals and minzoned release output in plain language (#2169) (0fb46a8)
minvmd: reword refusal messages in plain language (#2171) (7dc57e6)
cli,tui: reword cleanup and status warnings in plain language (#2175) (12a1152)
minimald: reword network refusals and errors in plain language (#2173) (0ed86a6)
minimald: reword attach refusals and port-request failures in plain language (#2172) (710abda)
sessions: reword the credentialed-upstream policy row and ingress errors (#2180) (f3001e5)
minimal: say the finalize-install egress item plainly (#2179) (1f6bc55)
minimal: reword the min ls header rows and list warnings in plain language (#2182) (9db0c46)
minimal: reword the box-name rows, the names line and session start messages in plain language (#2183) (080797e)
minimal: skip the port-prompt subscription for a box with no host row (#2187) (4e168f6)
switch: raise the outbound tcp connect bound so a burst of connections stops timing out (#2184) (265081b)
minimald: elect one holder for a shared ingress port by creation order (#2185) (6f32545)
minimal: accept a sticky root-owned directory and check before changing the host (#2195) (acda93b)
minvmd: bind a waiting decl...

0.8.0

325 commit(s) since v0.7.2.

Features

mlog: opt-in OpenTelemetry export, switches and a local spool (2/7, spec 25) (#1994) (f4c13e4)
min, minimald: one trace per request across the CLI and the daemon (3/7, spec 25) (#1995) (98dbe05)
minvmd: export the VM host daemon's spans and carry telemetry into the guest (4/7, spec 25) (#1996) (8af4e1d)
diag: min bug carries the telemetry spool and redacts telemetry settings (5/7, spec 25) (#1997) (1af0a88)
otel: guest telemetry rides the VM channel (#2039) (f5bb38c)
packaging: ship minzoned in a signed macOS app bundle with the app icon (#2188) (4a87666)
stdlib: type the patch ledger by kind, and check revision against it (#1277) (aa13deb)
scripts: report non-Rust dependency pins and bump the pkgs locked_commit (#1875) (482c744)
bep: add the bep crate with the GitHub module and the sealed envelope (#2346) (c2f0b78)
bep: hold the proxy keys in the host keychain and publish their identity (#2363) (f8431d0)
bep: append one hash-chained audit record per proxy decision (#2361) (b8b4f22)
min: refuse GitHub grants at activation that the box or the host cannot honour (#2365) (767c59f)
bep: issue leaf certificates under a name-constrained root and a signing CA (#2438) (788b6ec)
bep: decide redemption as a pure function over host key, attribution and bounds (#2359) (554eff3)
min: sign in to GitHub under the published App, kept in the host keychain (#2364) (5919d28)
bep: refuse off-set authorities, off-port and expired values (#2448) (03466f7)
min: add min box spec with root fingerprint, upstream set, steering and full marker (#2443) (0c33a45)
bep: parse request heads strictly and forward a canonical head and body (#2362) (35529c8)
min: read one box's audit trail with min box audit (#2457) (334e184)
bep: refuse undeclared egress and host mismatches, admit only when every check passes (#2450) (4fcfa9c)
bep: verify store handles against the client's registered key and the current rule (#2467) (248b259)
bep: accept only box connections and terminate TLS for the module hosts over HTTP/1.1 (#2475) (cff2d9e)
bep: validate the upstream, pass unsealed requests through, and stream replies (#2481) (cc56e3b)
bep: wire the redemption decision and each box's declared egress into bep serve (#2486) (47223e0)
minimal: mint sealed GitHub sign-in references and register the box with the proxy (#2490) (e55b32c)
minimald: deliver each GitHub grant's sealed value into its variable in the box (#2491) (3eb782b)
minimald: point a proxy_env box's environment at the proxy (#2492) (e8feee2)
bep: issue and publish the host root certificate and hand it to each grant box (#2493) (efb91c7)
minimald: put the proxy's root certificate in a grant box's trust store (#2495) (197a96b)
minvmd: start the Box Egress Proxy beside gvproxy so git and gh reach GitHub (#2497) (ccc4f95)
bep: rotate the signing CA under an unchanged root (#2508) (99ade7d)
minimal: log out deletes the sign-in and refuses every reference to it (#2512) (42cf41d)
net: reject UDP to port 443 where a box's QUIC stance is blocked (#2513) (1c94b06)
bep: attribute a host-address redemption to its cohort and mark the audit (#2511) (2aa47e7)
minimal: read client-owned store rules and refuse rules in the deny set (#2514) (55d0845)
bep: renew an expiring GitHub sign-in once at the proxy (#2518) (f388b54)
minimal: mint store handles and keep client keys registered across proxy restarts (#2520) (17ce321)
minimald: steer credentialed names to the proxy and fail closed while it is down (#2519) (33b984a)
bep: rotate the signing CA through the control socket (#2545) (230709d)
minimal: check store rules at box creation and ask once per item (T54) (#2552) (15e9079)
minimal: sign store handles under one host-keychain client key (T59) (#2557) (4180736)
minimald: block UDP 443 for a host_ip cohort with a blocked QUIC stance (T53) (#2553) (160d3ed)
minimal: store, list and remove secrets with min secret (T26) (#2522) (da0bdfb)
minimal: list each store reference with its authorities in min box spec (T61) (#2569) (81ccbce)
minimald: ship a git credential helper in grant boxes (T50) (#2547) (853a4f6)
bep: record a revocation when a live box is destroyed (T20) (#2548) (7529939)
bep: revoke or replace a registered client key and bound the registry (T63) (#2571) (cdcf1a2)
bep: carry a store handle sealed as a store member (T60) (#2568) (694dba5)
minimal: lay out the split VM users, directories and socket modes (T65) (#2561) (be9202e)
minimald: steer the credentialed names of dns and both boxes through the gate (T58) (#2567) (3061ef1)
bep: deny Minimal's infrastructure domains in the box CA and store rules (T55) (#2582) (8409ca0)
bep: inject a stored key in its registered form per request (T28) (#2574) (bec5136)
bep: rotate audit segments, carry the chain and restore revocations at start (T33) (#2583) (9d3dc96)
bep: name the kid when a store handle is refused as unknown_key (#2592) (a1e65c5)
bep: wire the client-key bound into bep serve with --max-client-keys (T69) (#2593) (e8f53f6)
minimal: give a box re-created under its name an id of its own that redeems (T22) (#2584) (a38e265)
bep: carry the handle jti into the audit record (T68) (#2596) (e455d2d)
minimal: write the store rule from min secret set with fixed-token presets (T39) (#2577) (78e2a51)
bep: inject store values in bep serve (T67) (#2597) (5a93a07)
minimald: reject UDP 443 from a blocked cohort's own leaves (T72) (#2601) (5741f2f)
minvmd: refuse a minted box id that a retained revocation record holds (T74) (#2611) (2fc77ce)
bep: keep a replaced client key verifying until its boxes end (T84) (#2615) (4152396)
bep: give bep serve a chain-preserving way out of an unreadable audit line (T75) (#2608) (2ced764)
minimal: name the QUIC block helper in min finalize-install (T88) (#2644) (b49feb5)
minvmd: check a minted box id against retained revocations with no proxy (T89) (#2643) (8c5d45a)
bep: give bep serve the client's store rules so a store member is admitted (T83) (#2614) (dbba22b)
bep: free the client key of a box that ended without forget_box (T90) (#2642) (1b7dfad)
bep: admit a widened store rule without restarting bep serve (T91) (#2663) (bdc7a84)
minimal: keep store rules under min --config-dir in step with bep serve (T92) (#2666) (fad7c72)
just: add a preflight check and default cross to the amd64 image (#2478) (6f5ed76)
minimald: proxy runtime-published ports like a direct connection (T99) (#2714) (7097b96)
minimal: make min login the GitHub sign-in and drop retired cert surfaces (T113) (#2719) (cc55fef)
minimald: record VM refusals on the host and admit RPC only from the host (T107) (#2721) (abe99f7)
minimald: refuse an activation whose declared port something else holds (T100) (#2725) (703bb7f)
minimal: report an edited audit chain in min doctor (T34) (#2603) (d5e802b)
minimal: keep box names answering across a reboot and a second VM (T119) (#2722) (1f4bfd6)
minimald: route the documented host literal on a native daemon (T116) (#2715) (eebb8fb)
minimald: answer a macOS box's ports at the address its name resolves to (T98) (#2713) (64d3358)
minimald: refuse unmatched names for partial allow lists and gate proxy callers (T106) (#2716) (302edaf)
minimald: run a box's package builds under that box's egress verdict (#2720) (a26f89b)
minvmd: decide the node plane's own traffic by its baseline set (#2723) (486ea13)
bep: re-certify the published root when a store registration changes (#2767) (642b738)
minimal: read each box's parent so box audit --parent merges (#2800) (79c5030)
release: ship a signed, notarized bep beside minvmd on macOS (#2792) (e0fb640)
min: finish GitHub sign-in on a real page and offer repository choice (#2775) (463458e)
bep: hold the proxy's keys in the Secure Enclave inside bep.app (#2823) (6571aa3)

Fixes

minimal: say DNS, min.internal and box IPs plainly in finalize-install --show (#2166) (f90cf02)
minvmd: reword the DNS-service refusals and minzoned release output in plain language (#2169) (0fb46a8)
minvmd: reword refusal messages in plain language (#2171) (7dc57e6)
cli,tui: reword cleanup and status warnings in plain language (#2175) (12a1152)
minimald: reword network refusals and errors in plain language (#2173) (0ed86a6)
minimald: reword attach refusals and port-request failures in plain language (#2172) (710abda)
sessions: reword the credentialed-upstream policy row and ingress errors (#2180) (f3001e5)
minimal: say the finalize-install egress item plainly (#2179) (1f6bc55)
minimal: reword the min ls header rows and list warnings in plain language (#2182) (9db0c46)
minimal: reword the box-name rows, the names line and session start messages in plain language (#2183) (080797e)
minimal: skip the port-prompt subscription for a box with no host row (#2187) (4e168f6)
switch: raise the outbound tcp connect bound so a burst of connections stops timing out (#2184) (265081b)
minimald: elect one holder for a shared ingress port by creation order (#2185) (6f32545)
minimal: accept a sticky root-owned directory and check before changing the host (#2195) (acda93b)
minvmd: bind a waiting declared forward when the row holding its listener is withdrawn (#2186) (bfd0f99)
minimal: give each local-range alias a /32 mask (#2196) (6c235fe)
minimal: stop claiming a box name opens...

0.8.0

315 commit(s) since v0.7.2.

Features

mlog: opt-in OpenTelemetry export, switches and a local spool (2/7, spec 25) (#1994) (f4c13e4)
min, minimald: one trace per request across the CLI and the daemon (3/7, spec 25) (#1995) (98dbe05)
minvmd: export the VM host daemon's spans and carry telemetry into the guest (4/7, spec 25) (#1996) (8af4e1d)
diag: min bug carries the telemetry spool and redacts telemetry settings (5/7, spec 25) (#1997) (1af0a88)
otel: guest telemetry rides the VM channel (#2039) (f5bb38c)
packaging: ship minzoned in a signed macOS app bundle with the app icon (#2188) (4a87666)
stdlib: type the patch ledger by kind, and check revision against it (#1277) (aa13deb)
scripts: report non-Rust dependency pins and bump the pkgs locked_commit (#1875) (482c744)
bep: add the bep crate with the GitHub module and the sealed envelope (#2346) (c2f0b78)
bep: hold the proxy keys in the host keychain and publish their identity (#2363) (f8431d0)
bep: append one hash-chained audit record per proxy decision (#2361) (b8b4f22)
min: refuse GitHub grants at activation that the box or the host cannot honour (#2365) (767c59f)
bep: issue leaf certificates under a name-constrained root and a signing CA (#2438) (788b6ec)
bep: decide redemption as a pure function over host key, attribution and bounds (#2359) (554eff3)
min: sign in to GitHub under the published App, kept in the host keychain (#2364) (5919d28)
bep: refuse off-set authorities, off-port and expired values (#2448) (03466f7)
min: add min box spec with root fingerprint, upstream set, steering and full marker (#2443) (0c33a45)
bep: parse request heads strictly and forward a canonical head and body (#2362) (35529c8)
min: read one box's audit trail with min box audit (#2457) (334e184)
bep: refuse undeclared egress and host mismatches, admit only when every check passes (#2450) (4fcfa9c)
bep: verify store handles against the client's registered key and the current rule (#2467) (248b259)
bep: accept only box connections and terminate TLS for the module hosts over HTTP/1.1 (#2475) (cff2d9e)
bep: validate the upstream, pass unsealed requests through, and stream replies (#2481) (cc56e3b)
bep: wire the redemption decision and each box's declared egress into bep serve (#2486) (47223e0)
minimal: mint sealed GitHub sign-in references and register the box with the proxy (#2490) (e55b32c)
minimald: deliver each GitHub grant's sealed value into its variable in the box (#2491) (3eb782b)
minimald: point a proxy_env box's environment at the proxy (#2492) (e8feee2)
bep: issue and publish the host root certificate and hand it to each grant box (#2493) (efb91c7)
minimald: put the proxy's root certificate in a grant box's trust store (#2495) (197a96b)
minvmd: start the Box Egress Proxy beside gvproxy so git and gh reach GitHub (#2497) (ccc4f95)
bep: rotate the signing CA under an unchanged root (#2508) (99ade7d)
minimal: log out deletes the sign-in and refuses every reference to it (#2512) (42cf41d)
net: reject UDP to port 443 where a box's QUIC stance is blocked (#2513) (1c94b06)
bep: attribute a host-address redemption to its cohort and mark the audit (#2511) (2aa47e7)
minimal: read client-owned store rules and refuse rules in the deny set (#2514) (55d0845)
bep: renew an expiring GitHub sign-in once at the proxy (#2518) (f388b54)
minimal: mint store handles and keep client keys registered across proxy restarts (#2520) (17ce321)
minimald: steer credentialed names to the proxy and fail closed while it is down (#2519) (33b984a)
bep: rotate the signing CA through the control socket (#2545) (230709d)
minimal: check store rules at box creation and ask once per item (T54) (#2552) (15e9079)
minimal: sign store handles under one host-keychain client key (T59) (#2557) (4180736)
minimald: block UDP 443 for a host_ip cohort with a blocked QUIC stance (T53) (#2553) (160d3ed)
minimal: store, list and remove secrets with min secret (T26) (#2522) (da0bdfb)
minimal: list each store reference with its authorities in min box spec (T61) (#2569) (81ccbce)
minimald: ship a git credential helper in grant boxes (T50) (#2547) (853a4f6)
bep: record a revocation when a live box is destroyed (T20) (#2548) (7529939)
bep: revoke or replace a registered client key and bound the registry (T63) (#2571) (cdcf1a2)
bep: carry a store handle sealed as a store member (T60) (#2568) (694dba5)
minimal: lay out the split VM users, directories and socket modes (T65) (#2561) (be9202e)
minimald: steer the credentialed names of dns and both boxes through the gate (T58) (#2567) (3061ef1)
bep: deny Minimal's infrastructure domains in the box CA and store rules (T55) (#2582) (8409ca0)
bep: inject a stored key in its registered form per request (T28) (#2574) (bec5136)
bep: rotate audit segments, carry the chain and restore revocations at start (T33) (#2583) (9d3dc96)
bep: name the kid when a store handle is refused as unknown_key (#2592) (a1e65c5)
bep: wire the client-key bound into bep serve with --max-client-keys (T69) (#2593) (e8f53f6)
minimal: give a box re-created under its name an id of its own that redeems (T22) (#2584) (a38e265)
bep: carry the handle jti into the audit record (T68) (#2596) (e455d2d)
minimal: write the store rule from min secret set with fixed-token presets (T39) (#2577) (78e2a51)
bep: inject store values in bep serve (T67) (#2597) (5a93a07)
minimald: reject UDP 443 from a blocked cohort's own leaves (T72) (#2601) (5741f2f)
minvmd: refuse a minted box id that a retained revocation record holds (T74) (#2611) (2fc77ce)
bep: keep a replaced client key verifying until its boxes end (T84) (#2615) (4152396)
bep: give bep serve a chain-preserving way out of an unreadable audit line (T75) (#2608) (2ced764)
minimal: name the QUIC block helper in min finalize-install (T88) (#2644) (b49feb5)
minvmd: check a minted box id against retained revocations with no proxy (T89) (#2643) (8c5d45a)
bep: give bep serve the client's store rules so a store member is admitted (T83) (#2614) (dbba22b)
bep: free the client key of a box that ended without forget_box (T90) (#2642) (1b7dfad)
bep: admit a widened store rule without restarting bep serve (T91) (#2663) (bdc7a84)
minimal: keep store rules under min --config-dir in step with bep serve (T92) (#2666) (fad7c72)
just: add a preflight check and default cross to the amd64 image (#2478) (6f5ed76)
minimald: proxy runtime-published ports like a direct connection (T99) (#2714) (7097b96)
minimal: make min login the GitHub sign-in and drop retired cert surfaces (T113) (#2719) (cc55fef)
minimald: record VM refusals on the host and admit RPC only from the host (T107) (#2721) (abe99f7)
minimald: refuse an activation whose declared port something else holds (T100) (#2725) (703bb7f)
minimal: report an edited audit chain in min doctor (T34) (#2603) (d5e802b)
minimal: keep box names answering across a reboot and a second VM (T119) (#2722) (1f4bfd6)
minimald: route the documented host literal on a native daemon (T116) (#2715) (eebb8fb)
minimald: answer a macOS box's ports at the address its name resolves to (T98) (#2713) (64d3358)
minimald: refuse unmatched names for partial allow lists and gate proxy callers (T106) (#2716) (302edaf)
minimald: run a box's package builds under that box's egress verdict (#2720) (a26f89b)
minvmd: decide the node plane's own traffic by its baseline set (#2723) (486ea13)
bep: re-certify the published root when a store registration changes (#2767) (642b738)
minimal: read each box's parent so box audit --parent merges (#2800) (79c5030)
release: ship a signed, notarized bep beside minvmd on macOS (#2792) (e0fb640)
min: finish GitHub sign-in on a real page and offer repository choice (#2775) (463458e)
bep: hold the proxy's keys in the Secure Enclave inside bep.app (#2823) (6571aa3)

Fixes

minimal: say DNS, min.internal and box IPs plainly in finalize-install --show (#2166) (f90cf02)
minvmd: reword the DNS-service refusals and minzoned release output in plain language (#2169) (0fb46a8)
minvmd: reword refusal messages in plain language (#2171) (7dc57e6)
cli,tui: reword cleanup and status warnings in plain language (#2175) (12a1152)
minimald: reword network refusals and errors in plain language (#2173) (0ed86a6)
minimald: reword attach refusals and port-request failures in plain language (#2172) (710abda)
sessions: reword the credentialed-upstream policy row and ingress errors (#2180) (f3001e5)
minimal: say the finalize-install egress item plainly (#2179) (1f6bc55)
minimal: reword the min ls header rows and list warnings in plain language (#2182) (9db0c46)
minimal: reword the box-name rows, the names line and session start messages in plain language (#2183) (080797e)
minimal: skip the port-prompt subscription for a box with no host row (#2187) (4e168f6)
switch: raise the outbound tcp connect bound so a burst of connections stops timing out (#2184) (265081b)
minimald: elect one holder for a shared ingress port by creation order (#2185) (6f32545)
minimal: accept a sticky root-owned directory and check before changing the host (#2195) (acda93b)
minvmd: bind a waiting declared forward when the row holding its listener is withdrawn (#2186) (bfd0f99)
minimal: give each local-range alias a /32 mask (#2196) (6c235fe)
minimal: stop claiming a box name opens...

0.8.0

311 commit(s) since v0.7.2.

Features

mlog: opt-in OpenTelemetry export, switches and a local spool (2/7, spec 25) (#1994) (f4c13e4)
min, minimald: one trace per request across the CLI and the daemon (3/7, spec 25) (#1995) (98dbe05)
minvmd: export the VM host daemon's spans and carry telemetry into the guest (4/7, spec 25) (#1996) (8af4e1d)
diag: min bug carries the telemetry spool and redacts telemetry settings (5/7, spec 25) (#1997) (1af0a88)
otel: guest telemetry rides the VM channel (#2039) (f5bb38c)
packaging: ship minzoned in a signed macOS app bundle with the app icon (#2188) (4a87666)
stdlib: type the patch ledger by kind, and check revision against it (#1277) (aa13deb)
scripts: report non-Rust dependency pins and bump the pkgs locked_commit (#1875) (482c744)
bep: add the bep crate with the GitHub module and the sealed envelope (#2346) (c2f0b78)
bep: hold the proxy keys in the host keychain and publish their identity (#2363) (f8431d0)
bep: append one hash-chained audit record per proxy decision (#2361) (b8b4f22)
min: refuse GitHub grants at activation that the box or the host cannot honour (#2365) (767c59f)
bep: issue leaf certificates under a name-constrained root and a signing CA (#2438) (788b6ec)
bep: decide redemption as a pure function over host key, attribution and bounds (#2359) (554eff3)
min: sign in to GitHub under the published App, kept in the host keychain (#2364) (5919d28)
bep: refuse off-set authorities, off-port and expired values (#2448) (03466f7)
min: add min box spec with root fingerprint, upstream set, steering and full marker (#2443) (0c33a45)
bep: parse request heads strictly and forward a canonical head and body (#2362) (35529c8)
min: read one box's audit trail with min box audit (#2457) (334e184)
bep: refuse undeclared egress and host mismatches, admit only when every check passes (#2450) (4fcfa9c)
bep: verify store handles against the client's registered key and the current rule (#2467) (248b259)
bep: accept only box connections and terminate TLS for the module hosts over HTTP/1.1 (#2475) (cff2d9e)
bep: validate the upstream, pass unsealed requests through, and stream replies (#2481) (cc56e3b)
bep: wire the redemption decision and each box's declared egress into bep serve (#2486) (47223e0)
minimal: mint sealed GitHub sign-in references and register the box with the proxy (#2490) (e55b32c)
minimald: deliver each GitHub grant's sealed value into its variable in the box (#2491) (3eb782b)
minimald: point a proxy_env box's environment at the proxy (#2492) (e8feee2)
bep: issue and publish the host root certificate and hand it to each grant box (#2493) (efb91c7)
minimald: put the proxy's root certificate in a grant box's trust store (#2495) (197a96b)
minvmd: start the Box Egress Proxy beside gvproxy so git and gh reach GitHub (#2497) (ccc4f95)
bep: rotate the signing CA under an unchanged root (#2508) (99ade7d)
minimal: log out deletes the sign-in and refuses every reference to it (#2512) (42cf41d)
net: reject UDP to port 443 where a box's QUIC stance is blocked (#2513) (1c94b06)
bep: attribute a host-address redemption to its cohort and mark the audit (#2511) (2aa47e7)
minimal: read client-owned store rules and refuse rules in the deny set (#2514) (55d0845)
bep: renew an expiring GitHub sign-in once at the proxy (#2518) (f388b54)
minimal: mint store handles and keep client keys registered across proxy restarts (#2520) (17ce321)
minimald: steer credentialed names to the proxy and fail closed while it is down (#2519) (33b984a)
bep: rotate the signing CA through the control socket (#2545) (230709d)
minimal: check store rules at box creation and ask once per item (T54) (#2552) (15e9079)
minimal: sign store handles under one host-keychain client key (T59) (#2557) (4180736)
minimald: block UDP 443 for a host_ip cohort with a blocked QUIC stance (T53) (#2553) (160d3ed)
minimal: store, list and remove secrets with min secret (T26) (#2522) (da0bdfb)
minimal: list each store reference with its authorities in min box spec (T61) (#2569) (81ccbce)
minimald: ship a git credential helper in grant boxes (T50) (#2547) (853a4f6)
bep: record a revocation when a live box is destroyed (T20) (#2548) (7529939)
bep: revoke or replace a registered client key and bound the registry (T63) (#2571) (cdcf1a2)
bep: carry a store handle sealed as a store member (T60) (#2568) (694dba5)
minimal: lay out the split VM users, directories and socket modes (T65) (#2561) (be9202e)
minimald: steer the credentialed names of dns and both boxes through the gate (T58) (#2567) (3061ef1)
bep: deny Minimal's infrastructure domains in the box CA and store rules (T55) (#2582) (8409ca0)
bep: inject a stored key in its registered form per request (T28) (#2574) (bec5136)
bep: rotate audit segments, carry the chain and restore revocations at start (T33) (#2583) (9d3dc96)
bep: name the kid when a store handle is refused as unknown_key (#2592) (a1e65c5)
bep: wire the client-key bound into bep serve with --max-client-keys (T69) (#2593) (e8f53f6)
minimal: give a box re-created under its name an id of its own that redeems (T22) (#2584) (a38e265)
bep: carry the handle jti into the audit record (T68) (#2596) (e455d2d)
minimal: write the store rule from min secret set with fixed-token presets (T39) (#2577) (78e2a51)
bep: inject store values in bep serve (T67) (#2597) (5a93a07)
minimald: reject UDP 443 from a blocked cohort's own leaves (T72) (#2601) (5741f2f)
minvmd: refuse a minted box id that a retained revocation record holds (T74) (#2611) (2fc77ce)
bep: keep a replaced client key verifying until its boxes end (T84) (#2615) (4152396)
bep: give bep serve a chain-preserving way out of an unreadable audit line (T75) (#2608) (2ced764)
minimal: name the QUIC block helper in min finalize-install (T88) (#2644) (b49feb5)
minvmd: check a minted box id against retained revocations with no proxy (T89) (#2643) (8c5d45a)
bep: give bep serve the client's store rules so a store member is admitted (T83) (#2614) (dbba22b)
bep: free the client key of a box that ended without forget_box (T90) (#2642) (1b7dfad)
bep: admit a widened store rule without restarting bep serve (T91) (#2663) (bdc7a84)
minimal: keep store rules under min --config-dir in step with bep serve (T92) (#2666) (fad7c72)
just: add a preflight check and default cross to the amd64 image (#2478) (6f5ed76)
minimald: proxy runtime-published ports like a direct connection (T99) (#2714) (7097b96)
minimal: make min login the GitHub sign-in and drop retired cert surfaces (T113) (#2719) (cc55fef)
minimald: record VM refusals on the host and admit RPC only from the host (T107) (#2721) (abe99f7)
minimald: refuse an activation whose declared port something else holds (T100) (#2725) (703bb7f)
minimal: report an edited audit chain in min doctor (T34) (#2603) (d5e802b)
minimal: keep box names answering across a reboot and a second VM (T119) (#2722) (1f4bfd6)
minimald: route the documented host literal on a native daemon (T116) (#2715) (eebb8fb)
minimald: answer a macOS box's ports at the address its name resolves to (T98) (#2713) (64d3358)
minimald: refuse unmatched names for partial allow lists and gate proxy callers (T106) (#2716) (302edaf)
minimald: run a box's package builds under that box's egress verdict (#2720) (a26f89b)
minvmd: decide the node plane's own traffic by its baseline set (#2723) (486ea13)
bep: re-certify the published root when a store registration changes (#2767) (642b738)
minimal: read each box's parent so box audit --parent merges (#2800) (79c5030)
release: ship a signed, notarized bep beside minvmd on macOS (#2792) (e0fb640)
min: finish GitHub sign-in on a real page and offer repository choice (#2775) (463458e)

Fixes

minimal: say DNS, min.internal and box IPs plainly in finalize-install --show (#2166) (f90cf02)
minvmd: reword the DNS-service refusals and minzoned release output in plain language (#2169) (0fb46a8)
minvmd: reword refusal messages in plain language (#2171) (7dc57e6)
cli,tui: reword cleanup and status warnings in plain language (#2175) (12a1152)
minimald: reword network refusals and errors in plain language (#2173) (0ed86a6)
minimald: reword attach refusals and port-request failures in plain language (#2172) (710abda)
sessions: reword the credentialed-upstream policy row and ingress errors (#2180) (f3001e5)
minimal: say the finalize-install egress item plainly (#2179) (1f6bc55)
minimal: reword the min ls header rows and list warnings in plain language (#2182) (9db0c46)
minimal: reword the box-name rows, the names line and session start messages in plain language (#2183) (080797e)
minimal: skip the port-prompt subscription for a box with no host row (#2187) (4e168f6)
switch: raise the outbound tcp connect bound so a burst of connections stops timing out (#2184) (265081b)
minimald: elect one holder for a shared ingress port by creation order (#2185) (6f32545)
minimal: accept a sticky root-owned directory and check before changing the host (#2195) (acda93b)
minvmd: bind a waiting declared forward when the row holding its listener is withdrawn (#2186) (bfd0f99)
minimal: give each local-range alias a /32 mask (#2196) (6c235fe)
minimal: stop claiming a box name opens in any browser (#2211) (51f71f0)
promote: find the draft release by listing and p...

0.8.0

294 commit(s) since v0.7.2.

Features

mlog: opt-in OpenTelemetry export, switches and a local spool (2/7, spec 25) (#1994) (f4c13e4)
min, minimald: one trace per request across the CLI and the daemon (3/7, spec 25) (#1995) (98dbe05)
minvmd: export the VM host daemon's spans and carry telemetry into the guest (4/7, spec 25) (#1996) (8af4e1d)
diag: min bug carries the telemetry spool and redacts telemetry settings (5/7, spec 25) (#1997) (1af0a88)
otel: guest telemetry rides the VM channel (#2039) (f5bb38c)
packaging: ship minzoned in a signed macOS app bundle with the app icon (#2188) (4a87666)
stdlib: type the patch ledger by kind, and check revision against it (#1277) (aa13deb)
scripts: report non-Rust dependency pins and bump the pkgs locked_commit (#1875) (482c744)
bep: add the bep crate with the GitHub module and the sealed envelope (#2346) (c2f0b78)
bep: hold the proxy keys in the host keychain and publish their identity (#2363) (f8431d0)
bep: append one hash-chained audit record per proxy decision (#2361) (b8b4f22)
min: refuse GitHub grants at activation that the box or the host cannot honour (#2365) (767c59f)
bep: issue leaf certificates under a name-constrained root and a signing CA (#2438) (788b6ec)
bep: decide redemption as a pure function over host key, attribution and bounds (#2359) (554eff3)
min: sign in to GitHub under the published App, kept in the host keychain (#2364) (5919d28)
bep: refuse off-set authorities, off-port and expired values (#2448) (03466f7)
min: add min box spec with root fingerprint, upstream set, steering and full marker (#2443) (0c33a45)
bep: parse request heads strictly and forward a canonical head and body (#2362) (35529c8)
min: read one box's audit trail with min box audit (#2457) (334e184)
bep: refuse undeclared egress and host mismatches, admit only when every check passes (#2450) (4fcfa9c)
bep: verify store handles against the client's registered key and the current rule (#2467) (248b259)
bep: accept only box connections and terminate TLS for the module hosts over HTTP/1.1 (#2475) (cff2d9e)
bep: validate the upstream, pass unsealed requests through, and stream replies (#2481) (cc56e3b)
bep: wire the redemption decision and each box's declared egress into bep serve (#2486) (47223e0)
minimal: mint sealed GitHub sign-in references and register the box with the proxy (#2490) (e55b32c)
minimald: deliver each GitHub grant's sealed value into its variable in the box (#2491) (3eb782b)
minimald: point a proxy_env box's environment at the proxy (#2492) (e8feee2)
bep: issue and publish the host root certificate and hand it to each grant box (#2493) (efb91c7)
minimald: put the proxy's root certificate in a grant box's trust store (#2495) (197a96b)
minvmd: start the Box Egress Proxy beside gvproxy so git and gh reach GitHub (#2497) (ccc4f95)
bep: rotate the signing CA under an unchanged root (#2508) (99ade7d)
minimal: log out deletes the sign-in and refuses every reference to it (#2512) (42cf41d)
net: reject UDP to port 443 where a box's QUIC stance is blocked (#2513) (1c94b06)
bep: attribute a host-address redemption to its cohort and mark the audit (#2511) (2aa47e7)
minimal: read client-owned store rules and refuse rules in the deny set (#2514) (55d0845)
bep: renew an expiring GitHub sign-in once at the proxy (#2518) (f388b54)
minimal: mint store handles and keep client keys registered across proxy restarts (#2520) (17ce321)
minimald: steer credentialed names to the proxy and fail closed while it is down (#2519) (33b984a)
bep: rotate the signing CA through the control socket (#2545) (230709d)
minimal: check store rules at box creation and ask once per item (T54) (#2552) (15e9079)
minimal: sign store handles under one host-keychain client key (T59) (#2557) (4180736)
minimald: block UDP 443 for a host_ip cohort with a blocked QUIC stance (T53) (#2553) (160d3ed)
minimal: store, list and remove secrets with min secret (T26) (#2522) (da0bdfb)
minimal: list each store reference with its authorities in min box spec (T61) (#2569) (81ccbce)
minimald: ship a git credential helper in grant boxes (T50) (#2547) (853a4f6)
bep: record a revocation when a live box is destroyed (T20) (#2548) (7529939)
bep: revoke or replace a registered client key and bound the registry (T63) (#2571) (cdcf1a2)
bep: carry a store handle sealed as a store member (T60) (#2568) (694dba5)
minimal: lay out the split VM users, directories and socket modes (T65) (#2561) (be9202e)
minimald: steer the credentialed names of dns and both boxes through the gate (T58) (#2567) (3061ef1)
bep: deny Minimal's infrastructure domains in the box CA and store rules (T55) (#2582) (8409ca0)
bep: inject a stored key in its registered form per request (T28) (#2574) (bec5136)
bep: rotate audit segments, carry the chain and restore revocations at start (T33) (#2583) (9d3dc96)
bep: name the kid when a store handle is refused as unknown_key (#2592) (a1e65c5)
bep: wire the client-key bound into bep serve with --max-client-keys (T69) (#2593) (e8f53f6)
minimal: give a box re-created under its name an id of its own that redeems (T22) (#2584) (a38e265)
bep: carry the handle jti into the audit record (T68) (#2596) (e455d2d)
minimal: write the store rule from min secret set with fixed-token presets (T39) (#2577) (78e2a51)
bep: inject store values in bep serve (T67) (#2597) (5a93a07)
minimald: reject UDP 443 from a blocked cohort's own leaves (T72) (#2601) (5741f2f)
minvmd: refuse a minted box id that a retained revocation record holds (T74) (#2611) (2fc77ce)
bep: keep a replaced client key verifying until its boxes end (T84) (#2615) (4152396)
bep: give bep serve a chain-preserving way out of an unreadable audit line (T75) (#2608) (2ced764)
minimal: name the QUIC block helper in min finalize-install (T88) (#2644) (b49feb5)
minvmd: check a minted box id against retained revocations with no proxy (T89) (#2643) (8c5d45a)
bep: give bep serve the client's store rules so a store member is admitted (T83) (#2614) (dbba22b)
bep: free the client key of a box that ended without forget_box (T90) (#2642) (1b7dfad)
bep: admit a widened store rule without restarting bep serve (T91) (#2663) (bdc7a84)
minimal: keep store rules under min --config-dir in step with bep serve (T92) (#2666) (fad7c72)
just: add a preflight check and default cross to the amd64 image (#2478) (6f5ed76)
minimald: proxy runtime-published ports like a direct connection (T99) (#2714) (7097b96)
minimal: make min login the GitHub sign-in and drop retired cert surfaces (T113) (#2719) (cc55fef)
minimald: record VM refusals on the host and admit RPC only from the host (T107) (#2721) (abe99f7)
minimald: refuse an activation whose declared port something else holds (T100) (#2725) (703bb7f)
minimal: report an edited audit chain in min doctor (T34) (#2603) (d5e802b)
minimal: keep box names answering across a reboot and a second VM (T119) (#2722) (1f4bfd6)
minimald: route the documented host literal on a native daemon (T116) (#2715) (eebb8fb)
minimald: answer a macOS box's ports at the address its name resolves to (T98) (#2713) (64d3358)
minimald: refuse unmatched names for partial allow lists and gate proxy callers (T106) (#2716) (302edaf)
minimald: run a box's package builds under that box's egress verdict (#2720) (a26f89b)
minvmd: decide the node plane's own traffic by its baseline set (#2723) (486ea13)
bep: re-certify the published root when a store registration changes (#2767) (642b738)
minimal: read each box's parent so box audit --parent merges (#2800) (79c5030)
release: ship a signed, notarized bep beside minvmd on macOS (#2792) (e0fb640)

Fixes

minimal: say DNS, min.internal and box IPs plainly in finalize-install --show (#2166) (f90cf02)
minvmd: reword the DNS-service refusals and minzoned release output in plain language (#2169) (0fb46a8)
minvmd: reword refusal messages in plain language (#2171) (7dc57e6)
cli,tui: reword cleanup and status warnings in plain language (#2175) (12a1152)
minimald: reword network refusals and errors in plain language (#2173) (0ed86a6)
minimald: reword attach refusals and port-request failures in plain language (#2172) (710abda)
sessions: reword the credentialed-upstream policy row and ingress errors (#2180) (f3001e5)
minimal: say the finalize-install egress item plainly (#2179) (1f6bc55)
minimal: reword the min ls header rows and list warnings in plain language (#2182) (9db0c46)
minimal: reword the box-name rows, the names line and session start messages in plain language (#2183) (080797e)
minimal: skip the port-prompt subscription for a box with no host row (#2187) (4e168f6)
switch: raise the outbound tcp connect bound so a burst of connections stops timing out (#2184) (265081b)
minimald: elect one holder for a shared ingress port by creation order (#2185) (6f32545)
minimal: accept a sticky root-owned directory and check before changing the host (#2195) (acda93b)
minvmd: bind a waiting declared forward when the 10BC8 row holding its listener is withdrawn (#2186) (bfd0f99)
minimal: give each local-range alias a /32 mask (#2196) (6c235fe)
minimal: stop claiming a box name opens in any browser (#2211) (51f71f0)
promote: find the draft release by listing and publish it under its tag (c5073b0)
minimald: name the hand-over bind message in the actor...

0.8.0

289 commit(s) since v0.7.2.

Features

mlog: opt-in OpenTelemetry export, switches and a local spool (2/7, spec 25) (#1994) (f4c13e4)
min, minimald: one trace per request across the CLI and the daemon (3/7, spec 25) (#1995) (98dbe05)
minvmd: export the VM host daemon's spans and carry telemetry into the guest (4/7, spec 25) (#1996) (8af4e1d)
diag: min bug carries the telemetry spool and redacts telemetry settings (5/7, spec 25) (#1997) (1af0a88)
otel: guest telemetry rides the VM channel (#2039) (f5bb38c)
packaging: ship minzoned in a signed macOS app bundle with the app icon (#2188) (4a87666)
stdlib: type the patch ledger by kind, and check revision against it (#1277) (aa13deb)
scripts: report non-Rust dependency pins and bump the pkgs locked_commit (#1875) (482c744)
bep: add the bep crate with the GitHub module and the sealed envelope (#2346) (c2f0b78)
bep: hold the proxy keys in the host keychain and publish their identity (#2363) (f8431d0)
bep: append one hash-chained audit record per proxy decision (#2361) (b8b4f22)
min: refuse GitHub grants at activation that the box or the host cannot honour (#2365) (767c59f)
bep: issue leaf certificates under a name-constrained root and a signing CA (#2438) (788b6ec)
bep: decide redemption as a pure function over host key, attribution and bounds (#2359) (554eff3)
min: sign in to GitHub under the published App, kept in the host keychain (#2364) (5919d28)
bep: refuse off-set authorities, off-port and expired values (#2448) (03466f7)
min: add min box spec with root fingerprint, upstream set, steering and full marker (#2443) (0c33a45)
bep: parse request heads strictly and forward a canonical head and body (#2362) (35529c8)
min: read one box's audit trail with min box audit (#2457) (334e184)
bep: refuse undeclared egress and host mismatches, admit only when every check passes (#2450) (4fcfa9c)
bep: verify store handles against the client's registered key and the current rule (#2467) (248b259)
bep: accept only box connections and terminate TLS for the module hosts over HTTP/1.1 (#2475) (cff2d9e)
bep: validate the upstream, pass unsealed requests through, and stream replies (#2481) (cc56e3b)
bep: wire the redemption decision and each box's declared egress into bep serve (#2486) (47223e0)
minimal: mint sealed GitHub sign-in references and register the box with the proxy (#2490) (e55b32c)
minimald: deliver each GitHub grant's sealed value into its variable in the box (#2491) (3eb782b)
minimald: point a proxy_env box's environment at the proxy (#2492) (e8feee2)
bep: issue and publish the host root certificate and hand it to each grant box (#2493) (efb91c7)
minimald: put the proxy's root certificate in a grant box's trust store (#2495) (197a96b)
minvmd: start the Box Egress Proxy beside gvproxy so git and gh reach GitHub (#2497) (ccc4f95)
bep: rotate the signing CA under an unchanged root (#2508) (99ade7d)
minimal: log out deletes the sign-in and refuses every reference to it (#2512) (42cf41d)
net: reject UDP to port 443 where a box's QUIC stance is blocked (#2513) (1c94b06)
bep: attribute a host-address redemption to its cohort and mark the audit (#2511) (2aa47e7)
minimal: read client-owned store rules and refuse rules in the deny set (#2514) (55d0845)
bep: renew an expiring GitHub sign-in once at the proxy (#2518) (f388b54)
minimal: mint store handles and keep client keys registered across proxy restarts (#2520) (17ce321)
minimald: steer credentialed names to the proxy and fail closed while it is down (#2519) (33b984a)
bep: rotate the signing CA through the control socket (#2545) (230709d)
minimal: check store rules at box creation and ask once per item (T54) (#2552) (15e9079)
minimal: sign store handles under one host-keychain client key (T59) (#2557) (4180736)
minimald: block UDP 443 for a host_ip cohort with a blocked QUIC stance (T53) (#2553) (160d3ed)
minimal: store, list and remove secrets with min secret (T26) (#2522) (da0bdfb)
minimal: list each store reference with its authorities in min box spec (T61) (#2569) (81ccbce)
minimald: ship a git credential helper in grant boxes (T50) (#2547) (853a4f6)
bep: record a revocation when a live box is destroyed (T20) (#2548) (7529939)
bep: revoke or replace a registered client key and bound the registry (T63) (#2571) (cdcf1a2)
bep: carry a store handle sealed as a store member (T60) (#2568) (694dba5)
minimal: lay out the split VM users, directories and socket modes (T65) (#2561) (be9202e)
minimald: steer the credentialed names of dns and both boxes through the gate (T58) (#2567) (3061ef1)
bep: deny Minimal's infrastructure domains in the box CA and store rules (T55) (#2582) (8409ca0)
bep: inject a stored key in its registered form per request (T28) (#2574) (bec5136)
bep: rotate audit segments, carry the chain and restore revocations at start (T33) (#2583) (9d3dc96)
bep: name the kid when a store handle is refused as unknown_key (#2592) (a1e65c5)
bep: wire the client-key bound into bep serve with --max-client-keys (T69) (#2593) (e8f53f6)
minimal: give a box re-created under its name an id of its own that redeems (T22) (#2584) (a38e265)
bep: carry the handle jti into the audit record (T68) (#2596) (e455d2d)
minimal: write the store rule from min secret set with fixed-token presets (T39) (#2577) (78e2a51)
bep: inject store values in bep serve (T67) (#2597) (5a93a07)
minimald: reject UDP 443 from a blocked cohort's own leaves (T72) (#2601) (5741f2f)
minvmd: refuse a minted box id that a retained revocation record holds (T74) (#2611) (2fc77ce)
bep: keep a replaced client key verifying until its boxes end (T84) (#2615) (4152396)
bep: give bep serve a chain-preserving way out of an unreadable audit line (T75) (#2608) (2ced764)
minimal: name the QUIC block helper in min finalize-install (T88) (#2644) (b49feb5)
minvmd: check a minted box id against retained revocations with no proxy (T89) (#2643) (8c5d45a)
bep: give bep serve the client's store rules so a store member is admitted (T83) (#2614) (dbba22b)
bep: free the client key of a box that ended without forget_box (T90) (#2642) (1b7dfad)
bep: admit a widened store rule without restarting bep serve (T91) (#2663) (bdc7a84)
minimal: keep store rules under min --config-dir in step with bep serve (T92) (#2666) (fad7c72)
just: add a preflight check and default cross to the amd64 image (#2478) (6f5ed76)
minimald: proxy runtime-published ports like a direct connection (T99) (#2714) (7097b96)
minimal: make min login the GitHub sign-in and drop retired cert surfaces (T113) (#2719) (cc55fef)
minimald: record VM refusals on the host and admit RPC only from the host (T107) (#2721) (abe99f7)
minimald: refuse an activation whose declared port something else holds (T100) (#2725) (703bb7f)
minimal: report an edited audit chain in min doctor (T34) (#2603) (d5e802b)
minimal: keep box names answering across a reboot and a second VM (T119) (#2722) (1f4bfd6)
minimald: route the documented host literal on a native daemon (T116) (#2715) (eebb8fb)
minimald: answer a macOS box's ports at the address its name resolves to (T98) (#2713) (64d3358)
minimald: refuse unmatched names for partial allow lists and gate proxy callers (T106) (#2716) (302edaf)
minimald: run a box's package builds under that box's egress verdict (#2720) (a26f89b)
minvmd: decide the node plane's own traffic by its baseline set (#2723) (486ea13)
bep: re-certify the published root when a store registration changes (#2767) (642b738)
minimal: read each box's parent so box audit --parent merges (#2800) (79c5030)

Fixes

minimal: say DNS, min.internal and box IPs plainly in finalize-install --show (#2166) (f90cf02)
minvmd: reword the DNS-service refusals and minzoned release output in plain language (#2169) (0fb46a8)
minvmd: reword refusal messages in plain language (#2171) (7dc57e6)
cli,tui: reword cleanup and status warnings in plain language (#2175) (12a1152)
minimald: reword network refusals and errors in plain language (#2173) (0ed86a6)
minimald: reword attach refusals and port-request failures in plain language (#2172) (710abda)
sessions: reword the credentialed-upstream policy row and ingress errors (#2180) (f3001e5)
minimal: say the finalize-install egress item plainly (#2179) (1f6bc55)
minimal: reword the min ls header rows and list warnings in plain language (#2182) (9db0c46)
minimal: reword the box-name rows, the names line and session start messages in plain language (#2183) (080797e)
minimal: skip the port-prompt subscription for a box with no host row (#2187) (4e168f6)
switch: raise the outbound tcp connect bound so a burst of connections stops timing out (#2184) (265081b)
minimald: elect one holder for a shared ingress port by creation order (#2185) (6f32545)
minimal: accept a sticky root-owned directory and check before changing the host (#2195) (acda93b)
minvmd: bind a waiting declared forward when the row holding its listener is withdrawn (#2186) (bfd0f99)
minimal: give each local-range alias a /32 mask (#2196) (6c235fe)
minimal: stop claiming a box name opens in any browser (#2211) (51f71f0)
promote: find the draft release by listing and publish it under its tag (c5073b0)
minimald: name the hand-over bind message in the actor's span (6e650e2)
minimald: spawn the forward-ported tasks through the traced h...

0.8.0

270 commit(s) since v0.7.2.

Features

mlog: opt-in OpenTelemetry export, switches and a local spool (2/7, spec 25) (#1994) (f4c13e4)
min, minimald: one trace per request across the CLI and the daemon (3/7, spec 25) (#1995) (98dbe05)
minvmd: export the VM host daemon's spans and carry telemetry into the guest (4/7, spec 25) (#1996) (8af4e1d)
diag: min bug carries the telemetry spool and redacts telemetry settings (5/7, spec 25) (#1997) (1af0a88)
otel: guest telemetry rides the VM channel (#2039) (f5bb38c)
packaging: ship minzoned in a signed macOS app bundle with the app icon (#2188) (4a87666)
stdlib: type the patch ledger by kind, and check revision against it (#1277) (aa13deb)
scripts: report non-Rust dependency pins and bump the pkgs locked_commit (#1875) (482c744)
bep: add the bep crate with the GitHub module and the sealed envelope (#2346) (c2f0b78)
bep: hold the proxy keys in the host keychain and publish their identity (#2363) (f8431d0)
bep: append one hash-chained audit record per proxy decision (#2361) (b8b4f22)
min: refuse GitHub grants at activation that the box or the host cannot honour (#2365) (767c59f)
bep: issue leaf certificates under a name-constrained root and a signing CA (#2438) (788b6ec)
bep: decide redemption as a pure function over host key, attribution and bounds (#2359) (554eff3)
min: sign in to GitHub under the published App, kept in the host keychain (#2364) (5919d28)
bep: refuse off-set authorities, off-port and expired values (#2448) (03466f7)
min: add min box spec with root fingerprint, upstream set, steering and full marker (#2443) (0c33a45)
bep: parse request heads strictly and forward a canonical head and body (#2362) (35529c8)
min: read one box's audit trail with min box audit (#2457) (334e184)
bep: refuse undeclared egress and host mismatches, admit only when every check passes (#2450) (4fcfa9c)
bep: verify store handles against the client's registered key and the current rule (#2467) (248b259)
bep: accept only box connections and terminate TLS for the module hosts over HTTP/1.1 (#2475) (cff2d9e)
bep: validate the upstream, pass unsealed requests through, and stream replies (#2481) (cc56e3b)
bep: wire the redemption decision and each box's declared egress into bep serve (#2486) (47223e0)
minimal: mint sealed GitHub sign-in references and register the box with the proxy (#2490) (e55b32c)
minimald: deliver each GitHub grant's sealed value into its variable in the box (#2491) (3eb782b)
minimald: point a proxy_env box's environment at the proxy (#2492) (e8feee2)
bep: issue and publish the host root certificate and hand it to each grant box (#2493) (efb91c7)
minimald: put the proxy's root certificate in a grant box's trust store (#2495) (197a96b)
minvmd: start the Box Egress Proxy beside gvproxy so git and gh reach GitHub (#2497) (ccc4f95)
bep: rotate the signing CA under an unchanged root (#2508) (99ade7d)
minimal: log out deletes the sign-in and refuses every reference to it (#2512) (42cf41d)
net: reject UDP to port 443 where a box's QUIC stance is blocked (#2513) (1c94b06)
bep: attribute a host-address redemption to its cohort and mark the audit (#2511) (2aa47e7)
minimal: read client-owned store rules and refuse rules in the deny set (#2514) (55d0845)
bep: renew an expiring GitHub sign-in once at the proxy (#2518) (f388b54)
minimal: mint store handles and keep client keys registered across proxy restarts (#2520) (17ce321)
minimald: steer credentialed names to the proxy and fail closed while it is down (#2519) (33b984a)
bep: rotate the signing CA through the control socket (#2545) (230709d)
minimal: check store rules at box creation and ask once per item (T54) (#2552) (15e9079)
minimal: sign store handles under one host-keychain client key (T59) (#2557) (4180736)
minimald: block UDP 443 for a host_ip cohort with a blocked QUIC stance (T53) (#2553) (160d3ed)
minimal: store, list and remove secrets with min secret (T26) (#2522) (da0bdfb)
minimal: list each store reference with its authorities in min box spec (T61) (#2569) (81ccbce)
minimald: ship a git credential helper in grant boxes (T50) (#2547) (853a4f6)
bep: record a revocation when a live box is destroyed (T20) (#2548) (7529939)
bep: revoke or replace a registered client key and bound the registry (T63) (#2571) (cdcf1a2)
bep: carry a store handle sealed as a store member (T60) (#2568) (694dba5)
minimal: lay out the split VM users, directories and socket modes (T65) (#2561) (be9202e)
minimald: steer the credentialed names of dns and both boxes through the gate (T58) (#2567) (3061ef1)
bep: deny Minimal's infrastructure domains in the box CA and store rules (T55) (#2582) (8409ca0)
bep: inject a stored key in its registered form per request (T28) (#2574) (bec5136)
bep: rotate audit segments, carry the chain and restore revocations at start (T33) (#2583) (9d3dc96)
bep: name the kid when a store handle is refused as unknown_key (#2592) (a1e65c5)
bep: wire the client-key bound into bep serve with --max-client-keys (T69) (#2593) (e8f53f6)
minimal: give a box re-created under its name an id of its own that redeems (T22) (#2584) (a38e265)
bep: carry the handle jti into the audit record (T68) (#2596) (e455d2d)
minimal: write the store rule from min secret set with fixed-token presets (T39) (#2577) (78e2a51)
bep: inject store values in bep serve (T67) (#2597) (5a93a07)
minimald: reject UDP 443 from a blocked cohort's own leaves (T72) (#2601) (5741f2f)
minvmd: refuse a minted box id that a retained revocation record holds (T74) (#2611) (2fc77ce)
bep: keep a replaced client key verifying until its boxes end (T84) (#2615) (4152396)
bep: give bep serve a chain-preserving way out of an unreadable audit line (T75) (#2608) (2ced764)
minimal: name the QUIC block helper in min finalize-install (T88) (#2644) (b49feb5)
minvmd: check a minted box id against retained revocations with no proxy (T89) (#2643) (8c5d45a)
bep: give bep serve the client's store rules so a store member is admitted (T83) (#2614) (dbba22b)
bep: free the client key of a box that ended without forget_box (T90) (#2642) (1b7dfad)
bep: admit a widened store rule without restarting bep serve (T91) (#2663) (bdc7a84)
minimal: keep store rules under min --config-dir in step with bep serve (T92) (#2666) (fad7c72)
just: add a preflight check and default cross to the amd64 image (#2478) (6f5ed76)
minimald: proxy runtime-published ports like a direct connection (T99) (#2714) (7097b96)
minimal: make min login the GitHub sign-in and drop retired cert surfaces (T113) (#2719) (cc55fef)
minimald: record VM refusals on the host and admit RPC only from the host (T107) (#2721) (abe99f7)
minimald: refuse an activation whose declared port something else holds (T100) (#2725) (703bb7f)
minimal: report an edited audit chain in min doctor (T34) (#2603) (d5e802b)
minimal: keep box names answering across a reboot and a second VM (T119) (#2722) (1f4bfd6)
minimald: route the documented host literal on a native daemon (T116) (#2715) (eebb8fb)
minimald: answer a macOS box's ports at the address its name resolves to (T98) (#2713) (64d3358)
minimald: refuse unmatched names for partial allow lists and gate proxy callers (T106) (#2716) (302edaf)

Fixes

minimal: say DNS, min.internal and box IPs plainly in finalize-install --show (#2166) (f90cf02)
minvmd: reword the DNS-service refusals and minzoned release output in plain language (#2169) (0fb46a8)
minvmd: reword refusal messages in plain language (#2171) (7dc57e6)
cli,tui: reword cleanup and status warnings in plain language (#2175) (12a1152)
minimald: reword network refusals and errors in plain language (#2173) (0ed86a6)
minimald: reword attach refusals and port-request failures in plain language (#2172) (710abda)
sessions: reword the credentialed-upstream policy row and ingress errors (#2180) (f3001e5)
minimal: say the finalize-install egress item plainly (#2179) (1f6bc55)
minimal: reword the min ls header rows and list warnings in plain language (#2182) (9db0c46)
minimal: reword the box-name rows, the names line and session start messages in plain language (#2183) (080797e)
minimal: skip the port-prompt subscription for a box with no host row (#2187) (4e168f6)
switch: raise the outbound tcp connect bound so a burst of connections stops timing out (#2184) (265081b)
minimald: elect one holder for a shared ingress port by creation order (#2185) (6f32545)
minimal: accept a sticky root-owned directory and check before changing the host (#2195) (acda93b)
minvmd: bind a waiting declared forward when the row holding its listener is withdrawn (#2186) (bfd0f99)
minimal: give each local-range alias a /32 mask (#2196) (6c235fe)
minimal: stop claiming a box name opens in any browser (#2211) (51f71f0)
promote: find the draft release by listing and publish it under its tag (c5073b0)
minimald: name the hand-over bind message in the actor's span (6e650e2)
minimald: spawn the forward-ported tasks through the traced helpers (b567cf6)
minvmd: say connection in the singular when the cap is one (5630f87)
otel: the nineteen review follow-ups deferred from the telemetry stack (#2202) (#2207) (6c6c39a)
cargo: remove the committed buf registry token (#2204) (813e4e5)
minimald: hold an OS-picked port in the answerer relocation test (#2237) (e57b5ed)
*...

minimal 0.8.0-dev.408.g1e236070

0.8.0

Features

Fixes

Uh oh!

minimal 0.8.0-dev.390.g47eba5d3

0.8.0

Features

Fixes

Uh oh!

minimal 0.8.0-dev.381.g3c2b2a73

0.8.0

Features

Fixes

Uh oh!

minimal 0.8.0-dev.376.g46d9e530

0.8.0

Features

Fixes

Uh oh!

minimal 0.8.0-dev.329.gf6fcbab7

0.8.0

Features

Fixes

Uh oh!

minimal 0.8.0-dev.319.g2d06816e

0.8.0

Features

Fixes

Uh oh!

minimal 0.8.0-dev.315.g6bddc077

0.8.0

Features

Fixes

Uh oh!

minimal 0.8.0-dev.298.ge0fb6403

0.8.0

Features

Fixes

Uh oh!

minimal 0.8.0-dev.293.g79c50305

0.8.0

Features

Fixes

Uh oh!

minimal 0.8.0-dev.274.g0be7561f

0.8.0

Features

Fixes

Uh oh!