a73x

3113fc99

docs: v0.0.8 release notes, and the volumes page joins the index

a73x   2026-09-05 17:54

Commit message
docs: v0.0.8 release notes, and the volumes page joins the index
docs/README.md
Old New
@@ -33,6 +33,7 @@ By what you're trying to do:
33 - [connecting.md](connecting.md)—reaching a guest through the jump gate with 33 - [connecting.md](connecting.md)—reaching a guest through the jump gate with
34 your own tenant CA 34 your own tenant CA
35 - [networking.md](networking.md)—published ports, and a guest on your own LAN 35 - [networking.md](networking.md)—published ports, and a guest on your own LAN
36 - [volumes.md](volumes.md)—durable block storage a guest keeps past its VM
36 - [mcp.md](mcp.md)—`/mcp`, the endpoint that lets Claude drive VMs 37 - [mcp.md](mcp.md)—`/mcp`, the endpoint that lets Claude drive VMs
37 - [faq.md](faq.md)—guest networking, and the other sharp edges 38 - [faq.md](faq.md)—guest networking, and the other sharp edges
38 39
docs/releases.md
Old New
@@ -5,6 +5,66 @@ Tarballs and checksums for every release live at
5 newest. The [quickstart](quickstart.md) takes a release from download to a 5 newest. The [quickstart](quickstart.md) takes a release from download to a
6 running VM. 6 running VM.
7 7
8 ## v0.0.8
9
10 Storage that outlives the VM. A volume claim is a request for durable bytes;
11 the first VM that names the claim puts those bytes on a host and leaves them
12 there. Delete that VM, create another naming the same claim, and the data is
13 waiting — a checked-out repo, a database, a build cache, anything you would
14 have lost with the root disk. The guest sees a raw `/dev/vdc` and owns
15 everything above it: partition it, format it, mount it, exactly as you would a
16 disk you bought.
17
18 **A claim is yours; where it lands is the fleet's.** You ask for a name and a
19 size and get a claim back, pending. The first create that names it decides
20 which host materializes the bytes, and every later VM naming that claim is
21 placed on that host — data does not move between hosts, so the guests that use
22 it do not either. A create that names a different host is refused, and the
23 refusal says which host holds the claim.
24
25 **Nothing deletes a volume by accident.** A claim a VM still holds cannot be
26 deleted. A volume file the fleet does not recognize is reported and kept, never
27 reclaimed. A tombstoned claim's bytes go only after the grace period, and a
28 host that cannot answer whether a file exists is treated as a host that has not
29 answered — not as one whose disk is empty. Force-removing a host is the single
30 path that destroys volumes on purpose, and the audit record says how many it
31 took.
32
33 **A host that says nothing cannot vouch for its guests.** A VM whose host has
34 stopped reporting now reads `unreachable` rather than holding its last known
35 `running` or `creating` forever. The status you see is what a host actually
36 told the plane, and a host that went quiet says so instead of leaving stale
37 optimism on the page.
38
39 **Your cloud-init and eitri's both land.** A tenant document that writes files,
40 runs commands or sets users no longer displaces the CA trust file, the sshd
41 drop-in, the clock fix or the root grow that eitri needs — both parts merge,
42 your scalars win, and the boot gate proves it on every run rather than assuming
43 it.
44
45 Under it: the toolchain moved to Go 1.27, mutation testing is one make target
46 away and runs on every push, and a round of hardening tightened what an
47 unauthenticated stranger can learn from the plane, what a misconfigured agent
48 will start with, and which refusals name the fix.
49
50 **Known limits.**
51
52 - Volumes are attached at create and only at create. There is no detach, no
53 reattach to a running VM, and no way to move one between hosts.
54 - The surface is the HTTP API. Volumes have no console page, no CLI command
55 and no MCP tool yet; `POST /api/v1/volume-claims` and the `volume_claims`
56 field on create are the whole of it.
57 - A volume is exactly as durable as one host's disk. There is no replication
58 and no snapshot; a host that loses its disk loses every volume on it.
59 - Force-removing a host destroys its volumes. Their claims return to pending
60 rather than staying bound to a host that is gone.
61 - Rolling a server back below v0.0.8 leaves a host that holds volumes stuck in
62 decommissioning, with nothing said about why.
63 - A volume file that disappears from the host is re-created empty on the next
64 attach, and nothing alerts on it.
65 - A host running an agent older than v0.0.8 refuses volume-bearing creates
66 rather than booting the guest without its disk.
67
8 ## v0.0.7 68 ## v0.0.7
9 69
10 A VM can be a machine on your network. Declare a bridge on a Linux host, name 70 A VM can be a machine on your network. Declare a bridge on a Linux host, name
docs/volumes.md
Old New
@@ -1,4 +1,3 @@
1 <!-- DRAFT: voice not yet passed by the author -->
2 # Volumes 1 # Volumes
3 2
4 *Durable block storage that outlives the VM it is attached to* 3 *Durable block storage that outlives the VM it is attached to*