# mvirt 0.14.0

migrations: yes
wire: unchanged
rev: 7323531df6dde99f917c78cdb03302cbd5fbffe8

v0.14.0 — the setup hold, the self-healing tunnel, and the vhost-blk hardening

A small release that hardens the control-plane boot and the stor-agent northbound
and tightens what "initialized" means. The setup hold now provisions no platform
substrate before the platform manifest is known; the reverse tunnel derives its
rejoin semantics from committed membership and never exits on a missing leader;
and the vhost-user-blk northbound rejects hostile descriptor chains.

What changed since v0.13.0:
- cplane: "initialized" now means the platform manifest was applied; the setup
  hold provisions no substrate before the platform knows what it is (closes #191).
- cplane boot: rejoin semantics derived from committed membership, never exits on
  no leader (#189); explicit cache semantics for the console bundle.
- cplane: managed ACME switched to Let's Encrypt's shortlived profile (6-day
  certs); orphaned import Tasks + pods swept (ADR-0080 D1, the deleted-template
  case); imports-network egress profile + template import-Task surface.
- stor-agent: vhost-blk northbound hardened against hostile descriptor chains
  (closes #167, #168, #169); the source-URL import pipeline removed (the import is
  a platform-issued Task, ADR-0080 D5).
- objstore: S3 credentials accepted as separate access/secret key fields.
- gw-agent: HSTS on the control-plane host edge; Envoy bumped off the EOL 1.31
  line to 1.39 everywhere.
- One schema migration (0135_acme_profile).


## Upgrading

Point your flake's `mvirt` input at this release and redeploy the control-plane
host first, then each node in turn:

```
nix run .#colmena -- apply boot --reboot --on <control-plane host>
nix run .#colmena -- apply boot --reboot --on <node>   # one at a time
```

**This release migrates the store.** Once the control plane has started, the
previous version will refuse to run against it — migrations are forward-only, so
rolling the control-plane host back means restoring a backup, with data loss back
to the backup point. The control plane writes a backup immediately before it
applies migrations; nodes roll back freely by booting the previous generation.