From 991acd2ba69b8f07dbaec972b6f9f19452cbe56e Mon Sep 17 00:00:00 2001 From: dan-claude-bot Date: Tue, 21 Jul 2026 14:49:51 +0000 Subject: [PATCH 1/2] release: 0.9.0 --- CHANGELOG.md | 2 ++ VERSION | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index fdee79f..47c930c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,8 @@ which records not just what changed but what each drill run proved. ## Unreleased +## 0.9.0 — 2026-07-21 + ### Added - `box import` stamps the trip, leaving the artifact's own mint stamp intact diff --git a/VERSION b/VERSION index d182dc9..ac39a10 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -0.8.1-dev +0.9.0 From 2c3b329b8f55dfafdfda5b0ced6adadc4cb126d8 Mon Sep 17 00:00:00 2001 From: dan-claude-bot Date: Tue, 21 Jul 2026 17:17:06 +0000 Subject: [PATCH 2/2] docs: record the 0.9.0 drill as waived, with what that leaves unproven --- drills/0.9.0.md | 57 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100644 drills/0.9.0.md diff --git a/drills/0.9.0.md b/drills/0.9.0.md new file mode 100644 index 0000000..99f87a3 --- /dev/null +++ b/drills/0.9.0.md @@ -0,0 +1,57 @@ +# box 0.9.0 — release drill + +**WAIVED. No drill was run for this release.** + +Waived by the maintainer (@danmt) on 2026-07-21. This file exists because the +gate requires a *record*, not a passing result — so a skip is a line in a diff +somebody reviewed, rather than the silence that let 0.7.0, 0.8.0 and every +release before them ship unproven. + +## Why + +The drill harness is not in a state to produce a trustworthy run. box has the +only real harness in the family (`drill/drill.sh`, ~85 probes), but the +procedure around it — standing up the substrate, pinning the release +candidates, capturing the result — was undocumented and assembled by hand. +rig and cast have no harness at all. A run improvised under those conditions +produces numbers nobody should rely on, and `drills/` is worth nothing if it +fills with records like that. + +Deferred deliberately, and tracked: #155. + +## What this release therefore does NOT prove + +Stated plainly so it is not rediscovered as a surprise: + +- **The VM trust boundary.** `ci.yml` says it in its own words: *"What + container mode canNOT validate is the VM trust boundary itself; that stays a + real-hardware ritual."* That is exactly the delta a release drill adds, and + it is exactly what is missing here. +- **The isolation contract on real hardware** — egress, the sibling drop, DNS + enumeration, IPv6 off, inbound drop — as measured by `drill/drill.sh` against + real VMs rather than containers. +- **The combination users receive.** A released box still resolves `RIG_REF` to + `main` (#150), so even a passing drill would have proven a pair that drifts + the moment rig's main moves. + +## What CI did prove on this tree + +Not nothing, and worth recording so the gap is precise rather than total: + +| Job | Result | +|---|---| +| `rehearsal` — multi-user tier on a real Incus | pass | +| `scope` | pass | +| `reconcile` | pass | +| `test/cli.sh` | 653 passed, 0 failed | +| `test/release.sh` | 173 passed, 0 failed | +| `test/labels-reconcile.sh` | 72 passed, 0 failed | +| `shellcheck -x bin/* **/*.sh` | clean | + +The tier's semantics are covered. The boundary is not. + +## The commitment + +The next release carries a real drill record at `drills/.md` — what +ran, on what host, the pinned refs and SHAs, the numbers, and what failed. A +failed drill is a valid record; another waiver is not. Tracked in #155.