# mvirt 0.28.3

migrations: no
wire: unchanged
rev: 52204feb63b8558ea9d440ab845736aff51aed27

mvirt 0.28.3

The control plane stops trusting what nodes say about themselves, the KEK
can be rotated without bricking sealed secrets, and the repo's colmena
hive can no longer reboot production.

- cplane: every fact a node reports (underlay, storage facet, tunnel
  endpoint, REST URL, capacity) is screened before it is applied: no
  claiming another host's address, addresses must be the node's own,
  capacity is bounded. A refused claim keeps the previous value and shows
  on GET /v1/nodes as status.factRejections; it never takes a node
  offline. All three prod hosts' values pass (closes #128).
- cplane: KEK rotation with rewrap (ADR-0009). A versioned keyring
  (secret-kek.d/), a leader-side rewrap loop in bounded batches, and
  GET/POST /v1/platform/secrets/kek{,/activate,/retire} (new permission
  platform.kek). Inert until an operator activates a new key; procedure in
  ADR-0009 (closes #134).
- object storage: tenants see a notice on the bucket pages when the object
  gateway is not answering (GET /v1/projects/{p}/object-storage/status,
  boolean + fixed sentence); the setup wizard shows the admin message
  (refs #86).
- dist/fleet describes the fleet as installed and evaluates to the same
  derivations as the deployed fleet; a nix check keeps it that way
  (closes #88).
- colmena: the repo hive no longer targets the production hosts (a bare
  `apply` from CLAUDE.md would have rebooted them from the working tree);
  a nix check refuses any production address or name in it (closes #409).


## Upgrading

Point your flake's `mvirt` input at this release and redeploy the control-plane
host first, then each node in turn:

```
nix run .#colmena -- apply boot --reboot --on <control-plane host>
nix run .#colmena -- apply boot --reboot --on <node>   # one at a time
```

This release adds no migrations, so the control-plane host rolls back the same way
a node does: boot the previous NixOS generation.