# mvirt 0.18.5

migrations: no
wire: unchanged
rev: ac32394ddb26b4978c6b7fe7fa195cdf29c14eab

v0.18.5 — the service-account API key you can actually read

Minting an API key for a service account in the console opened the "shown once"
modal on an empty secret. `http.post` resolves to the `{ data, etag, next }`
envelope, and the mint handed that envelope straight to the modal under a cast
that silenced the type error, so the token rendered as `undefined`. The key was
always created and always valid — it was only ever unreadable, and being
one-time, unrecoverable afterwards. Present since the button shipped in 0.10.0.

Keys minted through the console before this release cannot be recovered; revoke
them and mint again.

What changed:

- console: unwrap the response envelope at the service-account key mint, the
  shape the S3 access-key mint already used (#294). Console-only — the control
  plane already returned a real token.
- meta-plane: the signup/login IdP hints and the ADR-0085 stage-0 vocabulary.
  The meta-plane deploys as an App, not as part of the node closure, so this
  reaches no fleet through this release.
- docs: ADR-0085 (Installation / Region / AZ / Reservation).


## Upgrading

Point your flake's `mvirt` input at this release and redeploy the control-plane
host first, then each node in turn:

```
nix run .#colmena -- apply boot --reboot --on <control-plane host>
nix run .#colmena -- apply boot --reboot --on <node>   # one at a time
```

This release adds no migrations, so the control-plane host rolls back the same way
a node does: boot the previous NixOS generation.