| 1 | { |
| 2 | "//": "For the changelog: each release-note bullet's bold lead, mapped to the branches behind it. Kept by hand, one release at a time, as step 10 of the release recipe in the README. go run ./cmd/changelog fails on a lead no bullet has, or a branch that did not land in that release.", |
| 3 | "v0.28.7": { |
| 4 | "`carlos logs` now shows each run.": [ |
| 5 | "run-lifecycle-logs-325" |
| 6 | ], |
| 7 | "An app can ask for one uploaded object to be scanned.": [ |
| 8 | "scan-demand-revival" |
| 9 | ], |
| 10 | "The console's account switcher has a search box.": [ |
| 11 | "console-switcher-filter" |
| 12 | ], |
| 13 | "An offline move can copy most of its data before the instance goes offline.": [ |
| 14 | "moves-offline-precopy" |
| 15 | ], |
| 16 | "Every box in both regions must run this release before `stage` works.": [ |
| 17 | "moves-offline-precopy" |
| 18 | ], |
| 19 | "Moves and replica copies now run eight object copies at once.": [ |
| 20 | "moves-offline-precopy" |
| 21 | ], |
| 22 | "On-demand scanning needs `CARLOS_SCAN_WEBHOOK_KEY` only for callbacks.": [ |
| 23 | "scan-demand-revival" |
| 24 | ] |
| 25 | }, |
| 26 | "v0.28.6": { |
| 27 | "A guard-armed box's protected console can now be replaced.": [ |
| 28 | "install-console-upgrade" |
| 29 | ], |
| 30 | "A nested instance's `config.env` is written as soon as its directory appears.": [ |
| 31 | "moves-offline-fixes" |
| 32 | ], |
| 33 | "Each offline move step now sees a current box report.": [ |
| 34 | "moves-offline-fixes" |
| 35 | ], |
| 36 | "A source box's scheduler leaves a moved instance alone.": [ |
| 37 | "moves-offline-fixes" |
| 38 | ] |
| 39 | }, |
| 40 | "v0.28.5": { |
| 41 | "`carlos move offline` moves one instance to another region, with planned downtime.": [ |
| 42 | "moves-offline" |
| 43 | ], |
| 44 | "Roll every box in both regions before you start an offline move.": [ |
| 45 | "moves-offline" |
| 46 | ], |
| 47 | "A box whose guard is armed on v0.28.4 needs one update by hand.": [ |
| 48 | "armed-box-updates" |
| 49 | ], |
| 50 | "The guarded updater reads only what a candidate writes to standard output.": [ |
| 51 | "armed-box-updates" |
| 52 | ], |
| 53 | "`carlos system guard-arm` makes its directories readable whatever your umask is.": [ |
| 54 | "claim-guard-umask" |
| 55 | ], |
| 56 | "Routes with their own unit now restart on boxes whose agent doesn't run as root.": [ |
| 57 | "adopt-unit-root-pass-315" |
| 58 | ], |
| 59 | "`carlos system status` warns when a new box would boot an older build.": [ |
| 60 | "bootstrap-carlos-follows-316" |
| 61 | ] |
| 62 | }, |
| 63 | "v0.28.4": { |
| 64 | "Console invites now arrive.": [ |
| 65 | "design-console-invite-delivery" |
| 66 | ], |
| 67 | "An account can have 20 invites waiting at most, and send 20 an hour.": [ |
| 68 | "design-console-invite-delivery" |
| 69 | ], |
| 70 | "Console email can switch itself on.": [ |
| 71 | "design-console-invite-delivery" |
| 72 | ], |
| 73 | "Sending also needs a grant that is off by default.": [ |
| 74 | "design-console-invite-delivery" |
| 75 | ], |
| 76 | "With `CARLOS_HOST_CLAIM` on, the console sends no email.": [ |
| 77 | "design-console-invite-delivery" |
| 78 | ], |
| 79 | "`carlos system install-channel --policy` now also takes `--identity`.": [ |
| 80 | "claim-untagged-pointer" |
| 81 | ] |
| 82 | }, |
| 83 | "v0.28.3": { |
| 84 | "`carlos system install-channel --policy` prepares a box that is already running for host claims.": [ |
| 85 | "claim-prev-rehearsal" |
| 86 | ] |
| 87 | }, |
| 88 | "v0.28.2": { |
| 89 | "Three new `carlos system claims` commands prepare a box for host claims.": [ |
| 90 | "claim-step6-artifacts" |
| 91 | ] |
| 92 | }, |
| 93 | "v0.28.1": { |
| 94 | "A box can publish its identity record by hand.": [ |
| 95 | "box-publish-record" |
| 96 | ], |
| 97 | "A box that has not reported for a day drops out of status.": [ |
| 98 | "region-ha-2b-build" |
| 99 | ], |
| 100 | "Each box gets an idle join unit.": [ |
| 101 | "region-ha-2b-build" |
| 102 | ] |
| 103 | }, |
| 104 | "v0.28.0": { |
| 105 | "`carlos run` runs one of your app's commands against one instance.": [ |
| 106 | "carlos-run" |
| 107 | ], |
| 108 | "New instances can start from a copy of another instance's database.": [ |
| 109 | "seeded-instances" |
| 110 | ], |
| 111 | "The download is smaller again.": [ |
| 112 | "fix-binary-size-275" |
| 113 | ], |
| 114 | "Roll the boxes first, then every console.": [ |
| 115 | "carlos-run" |
| 116 | ], |
| 117 | "Give the console room for run uploads.": [ |
| 118 | "carlos-run" |
| 119 | ], |
| 120 | "Seeded instances stay off until you publish the seeds floor.": [ |
| 121 | "seeded-instances" |
| 122 | ], |
| 123 | "The host claim is still off.": [ |
| 124 | "feat/claim-root-trusted-state-p3", |
| 125 | "feat/claim-files-backfill" |
| 126 | ] |
| 127 | }, |
| 128 | "v0.27.3": { |
| 129 | "Restarting the edge no longer leaves an instance unreachable for 15 minutes.": [ |
| 130 | "fix-shutdown-lease-292" |
| 131 | ], |
| 132 | "New accounts never get a reserved address.": [ |
| 133 | "reserved-sqids-285" |
| 134 | ], |
| 135 | "Instance control restarts with this update.": [ |
| 136 | "fix-shutdown-lease-292" |
| 137 | ], |
| 138 | "Roll the console as well as the boxes.": [ |
| 139 | "reserved-sqids-285" |
| 140 | ] |
| 141 | }, |
| 142 | "v0.27.2": { |
| 143 | "Two builds at once keeps each build's socket name.": [ |
| 144 | "zdd-gen-socket-names" |
| 145 | ], |
| 146 | "A long host name keeps stop-then-start updates.": [ |
| 147 | "zdd-gen-socket-names" |
| 148 | ] |
| 149 | }, |
| 150 | "v0.27.1": { |
| 151 | "A box with many instances no longer fails its update while it starts.": [ |
| 152 | "hotfix-startup-sweep-281" |
| 153 | ] |
| 154 | }, |
| 155 | "v0.27.0": { |
| 156 | "Root keeps its own record of each box's releases.": [ |
| 157 | "feat/claim-root-trusted-state" |
| 158 | ], |
| 159 | "`carlos __cgexec` can appear in `ps`.": [ |
| 160 | "zdd-flag-readiness-3" |
| 161 | ], |
| 162 | "After the roll, check placement on each box.": [ |
| 163 | "zdd-flag-readiness-3" |
| 164 | ] |
| 165 | }, |
| 166 | "v0.26.0": { |
| 167 | "Two builds at once, off until your deployment turns it on.": [ |
| 168 | "zdd-1-generations", |
| 169 | "zdd-2-containment", |
| 170 | "zdd-3-swap", |
| 171 | "zdd-4-release-side", |
| 172 | "zdd-5-scheduler", |
| 173 | "zdd-6-surfaces", |
| 174 | "zdd-flag-readiness" |
| 175 | ], |
| 176 | "`carlos deploy` follows the rollout box by box.": [ |
| 177 | "zdd-6-surfaces", |
| 178 | "zdd-flag-readiness" |
| 179 | ], |
| 180 | "`carlos instances list` shows two builds.": [ |
| 181 | "zdd-4-release-side", |
| 182 | "zdd-6-surfaces" |
| 183 | ], |
| 184 | "Choose how each instance takes new builds.": [ |
| 185 | "settings-3-console-settings", |
| 186 | "settings-4-root-applies", |
| 187 | "settings-5-surfaces" |
| 188 | ], |
| 189 | "Read a database as it was.": [ |
| 190 | "db-pull-at", |
| 191 | "hibernate-retention" |
| 192 | ], |
| 193 | "Channel digests.": [ |
| 194 | "settings-1-pointer-digests" |
| 195 | ], |
| 196 | "`carlos releases authorize <app> <version>`, for operators.": [ |
| 197 | "settings-2-promotion-records" |
| 198 | ], |
| 199 | "What an instance is started with.": [ |
| 200 | "fix-roll-incident-256" |
| 201 | ], |
| 202 | "`carlos move`, off until your deployment turns moves on.": [ |
| 203 | "moves-phase1", |
| 204 | "moves-phase1-2", |
| 205 | "moves-phase1-3", |
| 206 | "moves-phase1-3b", |
| 207 | "moves-phase1-3c", |
| 208 | "moves-phase1-4", |
| 209 | "moves-phase1-5", |
| 210 | "moves-phase1-5b", |
| 211 | "moves-phase1-5c", |
| 212 | "moves-phase1-5d", |
| 213 | "moves-phase1-5e", |
| 214 | "moves-phase1-5f", |
| 215 | "moves-phase1-6", |
| 216 | "moves-phase1-7", |
| 217 | "moves-cut-guard" |
| 218 | ], |
| 219 | "Smaller fixes.": [ |
| 220 | "stage-stream-artifact", |
| 221 | "zdd-6-surfaces", |
| 222 | "setenv-box-route-error" |
| 223 | ], |
| 224 | "After each box updates, restart `carlos-instance-control.service` on it.": [ |
| 225 | "fix-roll-incident-256" |
| 226 | ], |
| 227 | "Before any box rolls, run the instance key checks.": [ |
| 228 | "instance-key-provision", |
| 229 | "instance-key-build" |
| 230 | ], |
| 231 | "Root ignores AWS profile, endpoint and trust-store settings.": [ |
| 232 | "fix/267-credentials", |
| 233 | "fix/267-adopt-writes", |
| 234 | "docs/267-remote-host" |
| 235 | ], |
| 236 | "Host claims: every roster reader first.": [ |
| 237 | "feat/hostclaim-home-region", |
| 238 | "fix/home-region-followups" |
| 239 | ], |
| 240 | "Digests: writers before readers.": [ |
| 241 | "settings-1-pointer-digests" |
| 242 | ], |
| 243 | "Instance update settings wait for every box.": [ |
| 244 | "settings-4-root-applies", |
| 245 | "settings-5-surfaces" |
| 246 | ], |
| 247 | "Remove the staging memory drop-ins after the roll.": [ |
| 248 | "stage-stream-artifact" |
| 249 | ], |
| 250 | "The `deployment-buckets` module now guards fence writes.": [ |
| 251 | "feat/hostclaim-activation" |
| 252 | ], |
| 253 | "Files left behind by earlier moves.": [ |
| 254 | "fix-roll-incident-256" |
| 255 | ] |
| 256 | }, |
| 257 | "v0.25.0": { |
| 258 | "Each instance runs in its own box.": [ |
| 259 | "tenant-iso-default-nested", |
| 260 | "tenant-iso-layout" |
| 261 | ], |
| 262 | "`carlos system layout`": [ |
| 263 | "tenant-iso-plan5" |
| 264 | ], |
| 265 | "Instances get CPU and IO limits": [ |
| 266 | "tenant-iso-hardening" |
| 267 | ], |
| 268 | "Custom domains can require proof.": [ |
| 269 | "tenant-iso-domains" |
| 270 | ], |
| 271 | "Only a platform operator can add an upstream address": [ |
| 272 | "tenant-iso-routes" |
| 273 | ], |
| 274 | "Cookies stay within their account.": [ |
| 275 | "tenant-iso-cookies" |
| 276 | ], |
| 277 | "Instance catch-all domains.": [ |
| 278 | "instance-catchall" |
| 279 | ], |
| 280 | "`carlos email test` sends HTML too.": [ |
| 281 | "multipart-email-support" |
| 282 | ], |
| 283 | "Smaller fixes.": [ |
| 284 | "first-route-wildcard", |
| 285 | "wildcard-zone-check" |
| 286 | ], |
| 287 | "Instances move to the nested layout on their own.": [ |
| 288 | "tenant-iso-default-nested" |
| 289 | ], |
| 290 | "Before rolling, check one box:": [ |
| 291 | "tenant-iso-layout", |
| 292 | "tenant-iso-hardening" |
| 293 | ], |
| 294 | "Roll the boxes before the console.": [ |
| 295 | "tenant-iso-routes" |
| 296 | ], |
| 297 | "Rolling back": [ |
| 298 | "tenant-iso-plan5" |
| 299 | ], |
| 300 | "Settings worth turning on": [ |
| 301 | "tenant-iso-domains" |
| 302 | ] |
| 303 | }, |
| 304 | "v0.24.2": { |
| 305 | "CI can deploy through the console.": [ |
| 306 | "design-deploy-credential" |
| 307 | ], |
| 308 | "A failed rollback says so.": [ |
| 309 | "fix-deploy-rollback-copy" |
| 310 | ], |
| 311 | "`carlos db` no longer panics.": [ |
| 312 | "feat/hostclaim-door" |
| 313 | ], |
| 314 | "The boxes come back onto the release train.": [ |
| 315 | "fix-stage-request-deferred" |
| 316 | ], |
| 317 | "Leave `CARLOS_HOST_CLAIM` unset on the console.": [ |
| 318 | "feat/hostclaim-door" |
| 319 | ], |
| 320 | "Do not set `CARLOS_REGION_HA` on a box yet.": [ |
| 321 | "design-region-ha" |
| 322 | ], |
| 323 | "Deploy credentials need the console's signing key.": [ |
| 324 | "design-deploy-credential" |
| 325 | ], |
| 326 | "Region HA foundations ship dormant.": [ |
| 327 | "design-region-ha", |
| 328 | "feat/hostclaim-library", |
| 329 | "feat/hostclaim-genselect", |
| 330 | "feat/hostclaim-boxguard", |
| 331 | "feat/hostclaim-park" |
| 332 | ], |
| 333 | "Read the plan before applying the infrastructure modules.": [ |
| 334 | "design-region-ha", |
| 335 | "feat/hostclaim-door" |
| 336 | ], |
| 337 | "The scanner host fix is in this release too.": [ |
| 338 | "fix/scanner-freshclam-apparmor" |
| 339 | ] |
| 340 | }, |
| 341 | "v0.24.0": { |
| 342 | "Canaries have a one-label address, and can be created again.": [ |
| 343 | "fix/canary-one-label" |
| 344 | ], |
| 345 | "Deploys reach running instances sooner on busy boxes.": [ |
| 346 | "fix-converge-own-loop", |
| 347 | "fix-reconcile-listing", |
| 348 | "fix-reconcile-parallel-reads" |
| 349 | ], |
| 350 | "An instance never starts without its secrets.": [ |
| 351 | "fix/keyless-box-refuses" |
| 352 | ], |
| 353 | "One address, one app.": [ |
| 354 | "fix/canary-one-label" |
| 355 | ], |
| 356 | "Check every box's secrets key before rolling the boxes.": [ |
| 357 | "fix/keyless-box-refuses" |
| 358 | ], |
| 359 | "A box with no deployment store refuses exec instances.": [ |
| 360 | "fix/keyless-box-refuses" |
| 361 | ], |
| 362 | "Roll the console to this release before pointing it at a scanner host.": [ |
| 363 | "worktree-scanner-host" |
| 364 | ], |
| 365 | "Object-storage scanning has its own box.": [ |
| 366 | "worktree-scanner-host" |
| 367 | ], |
| 368 | "The app regions rollback floor is v0.23.0.": [ |
| 369 | "docs-regions-floor-v0.23.0" |
| 370 | ], |
| 371 | "Boxes can send alerts to SNS.": [ |
| 372 | "feat/alerts-sns" |
| 373 | ], |
| 374 | "Boxes list the bucket by app.": [ |
| 375 | "fix-reconcile-listing", |
| 376 | "fix-reconcile-parallel-reads" |
| 377 | ] |
| 378 | }, |
| 379 | "v0.23.0": { |
| 380 | "A deploy reaches a running instance in seconds.": [ |
| 381 | "fix-adopted-exec-restart" |
| 382 | ], |
| 383 | "Static sites show a deploy on the next page load.": [ |
| 384 | "static-cache-control" |
| 385 | ], |
| 386 | "Read a copy of an instance's database.": [ |
| 387 | "feat/carlos-db-read" |
| 388 | ], |
| 389 | "Region flags.": [ |
| 390 | "design-nearest-region" |
| 391 | ], |
| 392 | "Invite links ask before you join.": [ |
| 393 | "tenant-iso-leftovers" |
| 394 | ], |
| 395 | "Sending domains you did not set up.": [ |
| 396 | "tenant-iso-mail" |
| 397 | ], |
| 398 | "Stores no longer share a bucket by accident.": [ |
| 399 | "tenant-iso-objstore" |
| 400 | ], |
| 401 | "Platform domains.": [ |
| 402 | "platform-domain-claims-209" |
| 403 | ], |
| 404 | "Leave `CONSOLE_SECRETS_ENVELOPE_V2` off until every box runs v0.23.0.": [ |
| 405 | "tenant-iso-binding" |
| 406 | ], |
| 407 | "v0.23.0 is the first release that understands app regions.": [ |
| 408 | "design-nearest-region" |
| 409 | ], |
| 410 | "Boxes restart awake instances when they adopt a release.": [ |
| 411 | "fix-adopted-exec-restart" |
| 412 | ], |
| 413 | "Static responses change their headers.": [ |
| 414 | "static-cache-control" |
| 415 | ], |
| 416 | "Pin infrastructure modules to v0.23.0.": [ |
| 417 | "feat/hostclaim-storage" |
| 418 | ], |
| 419 | "Run `carlos accounts migrate` with a v0.23.0 CLI.": [ |
| 420 | "tenant-iso-binding" |
| 421 | ], |
| 422 | "Existing data is left in place.": [ |
| 423 | "tenant-iso-leftovers", |
| 424 | "tenant-iso-mail" |
| 425 | ] |
| 426 | }, |
| 427 | "v0.22.2": { |
| 428 | "Database size on the app Overview.": [ |
| 429 | "feature/instance-db-stats-card" |
| 430 | ], |
| 431 | "Busy and large instances can finish a move.": [ |
| 432 | "move-ready-delta-threshold" |
| 433 | ], |
| 434 | "A move becomes ready when little is left to copy.": [ |
| 435 | "move-ready-delta-threshold" |
| 436 | ], |
| 437 | "Copy receipts in the source box's data bucket.": [ |
| 438 | "move-ready-delta-threshold" |
| 439 | ], |
| 440 | "The cut is still exact.": [ |
| 441 | "move-ready-delta-threshold" |
| 442 | ], |
| 443 | "The Database tile is console only.": [ |
| 444 | "feature/instance-db-stats-card" |
| 445 | ] |
| 446 | }, |
| 447 | "v0.22.0": { |
| 448 | "Availability, apart from errors.": [ |
| 449 | "availability-tab" |
| 450 | ], |
| 451 | "Errors is shorter.": [ |
| 452 | "availability-tab" |
| 453 | ], |
| 454 | "Replica instances.": [ |
| 455 | "edge-replica-placements" |
| 456 | ], |
| 457 | "Door keys.": [ |
| 458 | "instance-moves-p7" |
| 459 | ], |
| 460 | "Faster log reads.": [ |
| 461 | "parallel-chunk-read" |
| 462 | ], |
| 463 | "A restored app keeps its pipeline.": [ |
| 464 | "fix/preserve-adopted-app-pipeline" |
| 465 | ], |
| 466 | "Roll the console first, then the boxes, close together.": [ |
| 467 | "availability-tab" |
| 468 | ], |
| 469 | "A new CLI against an old console.": [ |
| 470 | "availability-tab", |
| 471 | "edge-replica-placements" |
| 472 | ], |
| 473 | "No replicas until every box has rolled.": [ |
| 474 | "edge-replica-placements" |
| 475 | ], |
| 476 | "Long polls show up in Availability.": [ |
| 477 | "availability-tab" |
| 478 | ], |
| 479 | "Tunnelled failures are filed once.": [ |
| 480 | "availability-tab" |
| 481 | ], |
| 482 | "Instance moves.": [ |
| 483 | "instance-moves-p0" |
| 484 | ], |
| 485 | "The edge-local door is off by default.": [ |
| 486 | "instance-moves-p7" |
| 487 | ], |
| 488 | "Each instance gets its own `/dev/shm`.": [ |
| 489 | "isolated-exec-probe-fixes" |
| 490 | ] |
| 491 | }, |
| 492 | "v0.21.0": { |
| 493 | "A new address is never a dead end.": [ |
| 494 | "edge-unknown-host-174" |
| 495 | ], |
| 496 | "The release recipe is in the README.": [ |
| 497 | "docs-release-recipe" |
| 498 | ] |
| 499 | }, |
| 500 | "v0.20.0": { |
| 501 | "Named deploy destinations.": [ |
| 502 | "config-destinations-cli", |
| 503 | "carlos-deploy-targets" |
| 504 | ], |
| 505 | "Sidecars.": [ |
| 506 | "sidecar-members", |
| 507 | "sidecar-engine-capability" |
| 508 | ], |
| 509 | "Email you can follow.": [ |
| 510 | "mail-events-log", |
| 511 | "mail-events-push" |
| 512 | ], |
| 513 | "A store per environment.": [ |
| 514 | "per-instance-store", |
| 515 | "412-storage-isolation-config" |
| 516 | ], |
| 517 | "Purge every host of an account at once.": [ |
| 518 | "edge-purge-hosts-173" |
| 519 | ], |
| 520 | "Faster edge start on distant boxes.": [ |
| 521 | "fix-edge-boot-refresh" |
| 522 | ] |
| 523 | }, |
| 524 | "v0.19.0": { |
| 525 | "Self-serve object storage.": [ |
| 526 | "worktree-store-self-serve" |
| 527 | ], |
| 528 | "Edge reads `s-maxage`": [ |
| 529 | "edge-s-maxage" |
| 530 | ], |
| 531 | "Maintenance worker.": [ |
| 532 | "feat-maintenance-worker", |
| 533 | "feat-launchctx-module" |
| 534 | ] |
| 535 | } |
| 536 | } |
| 537 | |
amadan