chore(master): release 0.8.0

[arcbox-labs]

🤖 I have created a release beep boop

0.8.0 (2026-09-27)

⚠ BREAKING CHANGES

• computer: the runtime stops naming an adapter, and the last two exceptions retire (#687)

Features

• agent: attach stdin and host control to piped machine exec (638a998)
• agent: drive the publish mirror from Docker container events (faab65d)
• agent: export each running container's rootfs over NFS (f2bcd1a)
• agent: honour machine exec flow control (e001cde)
• agent: mirror host-address-pinned publishes for the inbound relay (465821e)
• agent: mount container rootfs with nfs-exportable overlay options (ec679cc)
• agent: pick a container domain's HTTP port from what it listens on (9676968)
• agent: read machine exec host frames beside the PTY output pump (6711d7e)
• agent: relay TCP connections from inside the machine (a3c8ea9)
• agent: relay the container ssh-auth socket over vsock (f6d64ad)
• agent: report the signal that ended a machine exec process (ccf20dc)
• agent: rescan a started container's listeners while its server binds (85a811e)
• agent: route a container domain's port 80 to its labelled HTTP port (5ee5073)
• agent: run k3s servicelb and list LoadBalancer Services (d5b441a)
• agent: run login machine exec requests as sshd-style sessions (99be9c5)
• agent: terminate TLS for container domains with the local CA (00c5b70)
• api: serve System VM resources over Connect and abctl (49cf273)
• cli: add abctl ssh install to include ArcBox's SSH config (1822555)
• cli: add abctl tls trust/untrust for the local CA (8e7380a)
• computer: make a handover a lifecycle transition of its own (b424490)
• computer: SandboxEvent carries a monotonic sequence number (#695) (b38e943)
• computer: storage_bytes meters the retained footprint in every state (#692) (468ed81)
• computer: the startup sweep adopts a live sandbox instead of killing it (#674) (8e832e5)
• constants: reserve the ssh-auth socket path and relay port (ec0d3ce)
• core: forward Kubernetes LoadBalancer ports to the host (6a09b61)
• core: generate the local CA before the System VM boots (ab5fd1f)
• core: resize the System VM and persist the size to config.toml (89470a3)
• daemon: forward ssh-agent into containers over a vsock slot pool (561ee79)
• daemon: keep LoadBalancer listeners in step with the cluster (9d1df4f)
• daemon: reclaim freed disk space on idle and per machine (0b4dfe8)
• daemon: serve ssh <machine>@arcbox on a loopback port (10fd1eb)
• docker: let operators configure the guest dockerd (2b55f17)
• docker: let operators keep published ports off the LAN (514666c)
• engine: deliver signals through machine exec sessions (3ab1c7e)
• engine: flow-control machine exec sessions and always drain them (95021b0)
• engine: let the Kubernetes hold be observed (d92f6bc)
• engine: let the System VM's CPU and memory limits change at runtime (2a2d8ee)
• engine: open TCP connections inside machines as flow-controlled sessions (49919a6)
• fc-driver: the Firecracker adapter for the VM driver port (R1, part 1) (#658) (4024577)
• local-ca: generate a name-constrained CA for container domains (b362ae5)
• local-ca: mint a certificate per server name from the CA (068e8cc)
• net: make guest egress proxying an explicit policy (1f1d629), closes #315
• protocol: add flow-control windows to machine exec sessions (099f83a)
• protocol: add login, attached-stdin and signal fields to machine exec (82c73a5)
• protocol: open TCP connections inside machines and mark output EOF (6e495ff)
• pty: carry an account's supplementary groups into the privilege drop (2897308)
• rpc: add a LoadBalancer Service listing to the agent protocol (5aaabf6)
• snapshot: a live sandbox's CoW survives the startup sweep (#672) (2be3830)
• snapshot: add a util-linux BlockTools backend (6dfa93b)
• ssh: add the arcbox-ssh crate with its keys and login targets (01fda00)
• ssh: carry signals to session processes and report signal deaths (9e1b568)
• ssh: forward direct-tcpip channels to ports inside the machine (3cad4a3)
• ssh: honour pty-req, window-change and env in sessions (a9eb45c)
• ssh: run shell and exec sessions over the machine exec path (218262e)
• ssh: serve SSH connections that authenticate with the daemon's key (ece4247)
• ssh: serve the sftp subsystem with the machine's own sftp-server (264e96d)
• ssh: write the OpenSSH client config for the server (cb2c8a4)
• tap-net: add an nftables PacketFilter backend (fb8f4cd)
• vm-driver: a guest network can adopt a lease whose guest still runs (#670) (8fbca3f)
• vm-driver: a prepared VM can stage its own files (R3, PR-G1) (#676) (e4d168a)
• vm-driver: add the VM port crate (R0 of the VM stack redesign) (#656) (1c2800c)
• vm-driver: close the three GuestNetwork gaps the manager conversion needs (R2, part 2) (#667) (e0b0c12)
• vm-driver: the process record names the jail its VMM runs in (595376f)
• vm: make the dmsetup search list configuration (#653) (ddf66b8)
• vmm: punch DISCARDed ranges on the HVC block fast path (3f2048d)
• vmm: return reported guest pages to the host on the HV backend (8787141)
• xtask: check-layers, a cargo-metadata gate for the layer rules (#655) (97a4328)

Bug Fixes

• a startup read that cannot parse one record holds it instead of bricking the host (#684) (ce4f4e7)
• agent: close four gaps in the live-export watcher (663c94f)
• agent: give sysvinit machines a boot-completion hook (306da7d)
• agent: keep the boot-done hook out of systemd's preset policy (5317190)
• agent: read machine addresses off the interfaces, not hostname (9613298)
• agent: report Kubernetes ready only once its kubeconfig exists (b992009)
• agent: serve only RPC inside distro machines (5305f47)
• agent: supervise the watcher without a check-then-act window (0a70beb)
• agent: trim data disks with FITRIM instead of a missing fstrim (7584f62)
• ci: finish the stable-1.98 clippy sweep the macOS job walks (ef12b7c)
• ci: let the fleet-agent release builds run to completion (#712) (d8f02a6)
• ci: master builds again under the current stable clippy (db671a9)
• clippy: appease stable 1.98 lints the macOS job reaches (35cfa59)
• computer: drop the guest agent before the handover, not after (005c5ba)
• computer: journal the jail so an adopted Computer stays jailed (cd0bdb5)
• computer: journal the socket on every path that holds a VMM (c46ad8b)
• computer: journal the VMM's socket so an adopt can reach it (b193d05)
• computer: keep a handed-over computer out of three paths that still reached it (38f3a6d)
• computer: let the handover answer for itself, and bound its port call (910bd1f)
• computer: make a refused handover legible in the failure it is reported through (732730c)
• computer: make one handover pass not cost the guests behind it (4ea4a9f)
• computer: refuse a sandbox id the jailer will not exec (#680) (b5bac73)
• computer: route detach_all through the per-computer actor (773f67c)
• config: read the documented ~/.config/arcbox/config.toml (f250bc4)
• daemon: boot on the HV backend without asking it for sandbox cleanup (b2b30f1)
• dns: follow the host resolver across network changes (e2a46f3), closes #714
• docker: carry attach half-close in-band over the vsock channel (1dad10e), closes #268
• e2e: assert both overlay options land on one mount (a8b08c3)
• e2e: preserve the data dir when readiness fails (c9d7874)
• engine: end a machine exec session when its consumer goes away (ab109d9)
• engine: keep kernel NIC names in distro machines (6684ecc)
• fc-driver: adopt yields a kill-able handle even when the orphan's API is dead (#666) (bb02640)
• snapshot: attach loop devices the way busybox losetup actually works (#665) (59655de)
• snapshot: fail a CoW setup whose device has no node (507517e)
• snapshot: make the dm node exist where udev will not make it (522cc84)
• snapshot: reclaim the device when a setup fails before its node (7c96ce1)
• ssh: never hold the connection for input while output needs it (4d5fd38)
• tap-net: resolve the doc links off Linux, and tighten two test helpers (ce8a07f)
• vm-driver: refuse path-shaped ids and make the restore contract check distinguishing (#661) (7f016f1)
• xtask: a dependency carrying the crate's own name is not a layer edge (#662) (fd9daec)

Performance Improvements

• daemon: poll LoadBalancers over one kept agent connection (6258585)

Code Refactoring

• agent: author the containerd config as TOML, not a Rust string (d2be452)
• agent: hold container rules as tagged per-container sets (0243dc5)
• agent: move machine exec exit frames and signalling into session.rs (a2e05cd)
• agent: move the tagged-rule iptables helpers into their own module (e846efa)
• agent: resolve machine exec requests into one process spec (09637e8)
• agent: run interactive machine exec sessions through the same loop (a0e4230)
• agent: run piped machine exec sessions through a channel-fed loop (5bf1363)
• balloon: release pages through a host-owned PageReleaser (8b8f2ac)
• computer: extract the GuestAgent port (R3, PR-D) (#673) (e7756d7)
• computer: move the sandbox runtime to computer/arcbox-computer-runtime (R3, part 2) (#671) (cdfcbc5)
• computer: refuse a handed-over computer at the door, not per command (18d8c53)
• computer: the computer lifecycle as a statig state machine (R3, PR-E) (#675) (c7b5d08)
• computer: the manager drives one actor per computer (R3, PR-F2) (#678) (ab5f401)
• computer: the per-computer lifecycle actor and its sub-tasks (R3, PR-F1) (#677) (d1c77ea)
• computer: the runtime stages through the port, and a jail goes with its grip (R3, PR-G2) (#681) (a2ba44f)
• computer: the runtime stops building its own VMM; the guest agent composes (#685) (80513be)
• computer: the runtime stops naming an adapter, and the last two exceptions retire (#687) (86ac9e1)
• computer: the sweep and pause reach a VM's area through the port (#686) (54c78f0)
• core: read host listener owners through one helper (b67588e)
• engine: give machine exec sessions an output type of their own (e86c0e2)
• engine: move machine exec sessions into their own module (85d0382)
• fc: a layout is built from a jail, not an isolation spec (f3b0788)
• snapshot: one file per BlockTools implementation (331db6e)
• snapshot: put block-device tooling behind a BlockTools seam (#650) (e9055a5)
• tap-net: make the packet-filter seam ready for a second backend (7c378f5)
• tap-net: move the sandbox TAP network into its own crate behind GuestNetwork (#663) (c1b16a8)
• vm: attach guest networks through the driver port's GuestNetwork (R2, part 3) (#669) (2e810aa)
• vm: extract the runtime's pure core (R3, part 1) (#668) (b4015b7)
• vm: move the sandbox rootfs builder into arcbox-vm with composer-supplied paths (#652) (054015f)
• vm: put the invariant translation's netfilter rendering behind a PacketFilter seam (#651) (25ab5a9)
• vm: reach the guest agent through the driver port's Vsock capability (#657) (e5c75d5)
• vm: split vm-agent and its wire vocabulary out of arcbox-vm (#649) (fda85db)
• vm: the sandbox manager owns its VMs through the driver port (R1, part 2) (#664) (86fb360)

Tests

• agent: adoption is exercised jailed, the mode the bug lived in (286fc55)
• agent: cover machine exec flow-control accounting (c220169)
• agent: give the host test build the toml its tests parse (4221445)
• agent: relay a TCP peer both ways through its half-closes (59674fa)
• api: ignore the dockerhub org icon lookup CI runners cannot resolve (55b384b)
• api: resolve the official-image icon fixture through redis, not nginx (1d63f6c)
• balloon: cover the release seam and host-page alignment (b8b43a6)
• computer: drive the manager real flows over the fakes (R3, PR-F3) (#682) (d5f69dc)
• computer: make the block-tools skips fail where both userlands exist (5c22782)
• core: cover the Kubernetes LoadBalancer reconcile (e87e351)
• e2e: cover Kubernetes LoadBalancer forwarding to the host (d4d54b6)
• e2e: cover stdin EOF in the smoke suite and serve with nc (beb2289)
• e2e: stage every runtime companion asset from the installed app (c025087)
• engine: drive machine exec flow control against a fake agent (1133e63)
• snapshot: cover the block-tools error paths nothing reached (07c345f)
• snapshot: wait out the ETXTBSY window for every stand-in binary (26955a1)
• ssh: drive exec sessions against a scripted machine (0e96b42)
• ssh: pin down when session input may hold the connection (b2b69b6)
• tap-net: prove the nftables rendering against a real kernel (9db4510)
• vm-driver: an adopted vm has to be usable, not merely alive (7de86bd)

Documentation

• agent: describe container domains served without a port (9604b03)
• agents: fold CLAUDE.md into AGENTS.md; land changes on master directly (d5bf9f3)
• agents: record what the distro tests and the parallel work taught (b122010)
• computer: describe the computer runtime crate and what binds only it (9de0396)
• describe HTTPS for container domains and abctl tls trust (f2ca88c)
• disk: add the post-change reclaim matrix and trim I/O numbers (ca18e28)
• disk: record the reclaim matrix and the HV fast-path gap (fb3b5cf)
• docker: correct two stale compatibility claims (#647) (876f70a)
• engine: say what the discovery probe prevents, not what it does (5497046)
• readme: list the machine distros that work today (8ca31a6)
• snapshot: name what losetup's " (lost)" marker actually means (4bbe07e)

Styles

• e2e: rustfmt the overlay options probe docker args (95b37f3)

Miscellaneous Chores

• assets: move host CLI and guest runtime to Docker 29.7.2 (#634) (a215d91)
• assets: pin boot bundle 0.8.6 (patched containerd) (#654) (db44b71)
• master: release fleet-agent 0.1.5 (#707) (16be5eb)

---

This PR was generated with Release Please. See documentation.

[pullfrog]

Your Claude subscription has hit its usage limit. It resets at 9pm (UTC). Re-trigger Pullfrog after the reset, or add an ANTHROPIC_API_KEY repo secret — Pullfrog routes around an exhausted subscription automatically when one is present.

Add repo secret → · Model settings → · Setup docs → · Ask in Discord →

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}

[greptile-apps]

Confidence Score: 3/5

[Low risk] Version bump and changelog for release.

The PR is not ready to merge because the pinned boot bundle cannot deliver the advertised HV reclamation, and an unresponsive machine can stall the trim sweep.

Findings

1.  SSH command renders incorrectly ▶

Summary

The release updates ArcBox to 0.8.0 and documents its changes. Since the previous review, it also adds guest FITRIM handling, host-driven disk-reclaim scheduling, an on-demand machine compact command, and HV block DISCARD support.

• The pinned boot bundle predates the guest support needed for HV reclamation.
• An unresponsive machine can stall the serial trim sweep, and a failed idle-VM trim has no retry while the VM remains idle.

_{Reviews (55) · Last reviewed commit: "chore: update lockfiles for release"}

[pullfrog]

Your Claude subscription has hit its usage limit. It resets at 9pm (UTC). Re-trigger Pullfrog after the reset, or add an ANTHROPIC_API_KEY repo secret — Pullfrog routes around an exhausted subscription automatically when one is present.

Add repo secret → · Model settings → · Setup docs → · Ask in Discord →

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

Your Claude subscription has hit its usage limit. It resets at 3:20pm (UTC). Re-trigger Pullfrog after the reset, or add an ANTHROPIC_API_KEY repo secret — Pullfrog routes around an exhausted subscription automatically when one is present.

Add repo secret → · Model settings → · Setup docs → · Ask in Discord →

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

Your Claude subscription has hit its usage limit. It resets at 3:20pm (UTC). Re-trigger Pullfrog after the reset, or add an ANTHROPIC_API_KEY repo secret — Pullfrog routes around an exhausted subscription automatically when one is present.

Add repo secret → · Model settings → · Setup docs → · Ask in Discord →

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

Your Claude subscription has hit its usage limit. It resets at 3:20pm (UTC). Re-trigger Pullfrog after the reset, or add an ANTHROPIC_API_KEY repo secret — Pullfrog routes around an exhausted subscription automatically when one is present.

Add repo secret → · Model settings → · Setup docs → · Ask in Discord →

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

Your Claude subscription has hit its usage limit. It resets at 3:20pm (UTC). Re-trigger Pullfrog after the reset, or add an ANTHROPIC_API_KEY repo secret — Pullfrog routes around an exhausted subscription automatically when one is present.

Add repo secret → · Model settings → · Setup docs → · Ask in Discord →

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

Your Claude subscription has hit its usage limit. It resets at 3:20pm (UTC). Re-trigger Pullfrog after the reset, or add an ANTHROPIC_API_KEY repo secret — Pullfrog routes around an exhausted subscription automatically when one is present.

Add repo secret → · Model settings → · Setup docs → · Ask in Discord →

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes — no prior pullfrog review existed on this PR, so this run covers it end to end: the release-please commit plus the follow-up lockfile regeneration.

• Cut 0.7.0 → 0.7.1 across the manifest and workspace — .release-please-manifest.json's "." entry, workspace.package.version, and every # x-release-please-version dep pin in Cargo.toml moved together.
• Generated the 0.7.1 changelog section — 8 entries spanning one feature, four refactors, one doc fix, and two asset chores.
• Regenerated Cargo.lock for the bump — a pure version-line change (59 insertions / 59 deletions) covering every workspace member.

What I checked, since a release PR's failure mode is an omission rather than a bad line:

• Changelog completeness — all 8 non-merge commits landed on master since 4261efff ("release 0.7.0") are present (#647, #634, #649, #650, #651, #652, #653, #654). Nothing missing, nothing extra.
• Bump correctness — 0.7.1 is a patch despite feat(vm) (#653) because release-please-config.json sets bump-patch-for-minor-pre-major: true. That matches the configured intent rather than misclassifying the feature.
• Version consistency — no # x-release-please-version line is left at 0.7.0, and the only two version = "0.7.0" entries remaining in Cargo.lock are the third-party rustls-platform-verifier and system-configuration. sdk/rust (published as arcbox) rides version.workspace and moved with the rest.
• Independent cadences held still, correctly — arcbox-hv (0.3.20), arcbox-helper (1.1.0), and arcbox-fleet-agent (0.1.4) all stayed put, as did the fleet / sdk/typescript / sdk/python manifest entries.
• Release config untouched — draft and force-tag-creation are still set on the root package only, so the documented draft-until-assets-exist ordering is intact.

ℹ️ Nitpicks

• The #653 changelog line reads "make the dmsetup search list configuration" where "configurable" was clearly intended. It mirrors the merged commit subject verbatim, so release-please will regenerate it and an edit to CHANGELOG.md on this branch wouldn't survive another bot run — the durable place to correct it is the draft GitHub release body, which stays editable until the tarball is attached and the release publishes.

  ^{｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

Your Claude subscription has hit its usage limit. It resets at 4:10am (UTC). Re-trigger Pullfrog after the reset, or add an ANTHROPIC_API_KEY repo secret — Pullfrog routes around an exhausted subscription automatically when one is present.

Add repo secret → · Model settings → · Setup docs → · Ask in Discord →

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

Your Claude subscription has hit its usage limit. It resets at 4:10am (UTC). Re-trigger Pullfrog after the reset, or add an ANTHROPIC_API_KEY repo secret — Pullfrog routes around an exhausted subscription automatically when one is present.

Add repo secret → · Model settings → · Setup docs → · Ask in Discord →

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

Your Claude subscription has hit its usage limit. It resets at 4:10am (UTC). Re-trigger Pullfrog after the reset, or add an ANTHROPIC_API_KEY repo secret — Pullfrog routes around an exhausted subscription automatically when one is present.

Add repo secret → · Model settings → · Setup docs → · Ask in Discord →

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

Your Claude subscription has hit its usage limit. It resets at 4:10am (UTC). Re-trigger Pullfrog after the reset, or add an ANTHROPIC_API_KEY repo secret — Pullfrog routes around an exhausted subscription automatically when one is present.

Add repo secret → · Model settings → · Setup docs → · Ask in Discord →

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

Your Claude subscription has hit its usage limit. It resets at 4:10am (UTC). Re-trigger Pullfrog after the reset, or add an ANTHROPIC_API_KEY repo secret — Pullfrog routes around an exhausted subscription automatically when one is present.

Add repo secret → · Model settings → · Setup docs → · Ask in Discord →

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes — the delta since my prior review (4c3aad78, sixteenth) is eight changelog entries plus a date move; the manifest, Cargo.toml, and Cargo.lock are unchanged in shape.

• Eight handover-lifecycle commits joined the 0.8.0 section (68 bullets total, up from 60) — one Features entry (b4244907, feat(computer): make a handover a lifecycle transition of its own), six Bug Fixes (773f67c, 38f3a6d, 005c5ba, 732730c, 4ea4a9f, 910bd1f), and one Code Refactoring (18d8c53). Each is filed under the section its conventional-commit type implies.
• Release date moved 2026-08-20 → 2026-08-21 — matching today.

What I verified, since a release PR's failure mode is an omission rather than a bad line:

• Changelog completeness. git log --no-merges b38e9435..origin/master returns exactly those 8 commits, mapping 1:1 onto the 8 added entries — nothing extra, nothing missing, no mis-sectioning. git merge-base origin/master HEAD == origin/master == 910bd1fd, so the section is complete as of the branch's base. b4244907 carries no ! breaking marker, so the single BREAKING CHANGES entry (#687) stays correct.
• The delta touched no manifest, no lockfile, no protos, and no new files — 17 modified .rs files, all under computer/arcbox-computer-runtime. Member count holds at 65, the six first-time crates.io crates are unchanged, and the seventh-new-crate rate-limit threshold is not crossed. Every crate the delta touches is a first-time 0.8.0 publish, so no already-published API breaks.
• Version sweep re-checked. Workspace version and all 53 # x-release-please-version pins at 0.8.0; the three independent cadences (arcbox-hv 0.3.20, arcbox-helper 1.1.0, arcbox-fleet-agent 0.1.4) correctly left off the sweep. Zero 0.7.x remains in Cargo.toml except third-party tokio-util 0.7.18; the only 0.7.0 left in Cargo.lock is the documented third-party rustls-platform-verifier / system-configuration pair.
• Lockfile fidelity. Cargo.lock is a clean 62 + / 62 -, every changed line a standalone version = "0.8.0"; Cargo.toml is 54 changed pairs with zero non-version lines.
• release-please-config.json untouched — draft + force-tag-creation remain on the root package only.

ℹ️ Unlinked-commit count grew 20 → 28

All eight commits in this delta were pushed straight to master without a pull request, so none carries a (#NNN) link — the same process observation as before, now at 28 of 68 entries. None of the new commits touches a manifest or lockfile, and the handover lifecycle work they represent is confined to arcbox-computer-runtime, so this remains a maintainer process note rather than a defect in the release payload. The durable place to describe the new handover behavior for users is the draft release body, which stays editable until the tarball attaches.

  ^{｜ View workflow run ｜ Using openai-compatible/@cf/deepseek-ai/deepseek-v4-flash-0731 ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes — the delta since my prior review (e32d340b, seventeenth) is 14 changelog entries plus a date move; the manifest, Cargo.toml, and Cargo.lock are unchanged in shape.

• Fourteen commits that landed on master since the last review joined the 0.8.0 section (82 bullets total, up from 68) — nine Bug Fixes (cd0bdb5/c46ad8b/b193d05 journaling fixes, 507517e/522cc84/7c96ce1 snapshot CoW-device fixes, ef12b7c/db671a9 CI clippy sweeps, 35cfa59 clippy), one Code Refactoring (f3b0788, fc layout), three Tests (286fc55, 55b384b, 7de86bd), and one Feature (595376ff, the process record names the jail its VMM runs in). Each is filed under the section its conventional-commit type implies.
• Release date moved 2026-08-21 → 2026-08-28 — matching today; the compare link is still v0.7.0...v0.8.0.

What I verified, since a release PR's failure mode is an omission rather than a bad line:

• Changelog completeness. git log --no-merges 910bd1fd..origin/master returns exactly those 14 commits, mapping 1:1 onto the 14 added entries — nothing extra, nothing missing, no mis-sectioning. git merge-base origin/master HEAD == origin/master == 55b384b, so the section is complete as of the branch's base.
• The BREAKING CHANGES section correctly still carries only #687. The new feat(vm-driver) (595376ff) carries no ! and no BREAKING CHANGE footer — the JailRecord field is additive and defaults to None, per its own commit body — and f3b0788 is an explicit no-behaviour-change refactor.
• The delta touches no per-crate manifest, no lockfile, and no protos — all 14 commits modify existing files only (.rs plus one workflow and one root-manifest line from ef12b7c, which adds unused_async_trait_impl = "allow" to [workspace.lints.clippy] and changes no dependency graph). Member count holds at 65, the six first-time crates.io crates are unchanged, and the seventh-new-crate rate-limit threshold is not crossed.
• No published API breaks. The delta's only feature touches first-time-publish crates (arcbox-fc-driver, arcbox-vm-driver, arcbox-computer-runtime); the already-published crates it reaches (arcbox-snapshot, arcbox-fs, arcbox-hypervisor, arcbox-virtio-balloon, arcbox-virtio-blk, arcbox-pty, arcbox-net) get only bug fixes and lint appeasement, which a minor bump covers.
• Version sweep re-checked. Workspace version and all 53 # x-release-please-version dep pins at 0.8.0; the three independent cadences (arcbox-hv 0.3.20, arcbox-helper 1.1.0, arcbox-fleet-agent 0.1.4) correctly left off. The lockfile is a clean 62 + / 62 − (65 members − 3 cadences), every changed line a standalone version = "0.8.0"; the only 0.7.0 left in the lock is the documented third-party rustls-platform-verifier / system-configuration pair, and the only 0.7.x in any Cargo.toml is third-party tokio-util 0.7.18.
• release-please-config.json untouched — draft + force-tag-creation remain on the root package only.

One rolling process note, carried forward rather than raised: none of the 14 new commits carries a (#NNN) link, taking the unlinked count from 28 to 42 of 82 entries.

  ^{｜ View workflow run ｜ Using openai-compatible/@cf/zai-org/glm-5.3-flash ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes — the delta since my last review (c4bcff35, 2026‑08‑28) is a single generated line: the range‑diff contains only the changelog date move, so this run re‑verified the regenerated release pair against the new master tip rather than re‑reviewing content.

• Release date re‑rendered 2026‑08‑28 → 2026‑09‑11 — release‑please force‑pushes the pair on every master merge and stamps the run date; the 0.8.0 section's 82 bullets are otherwise unchanged.
• .release-please-manifest.json, Cargo.toml and Cargo.lock are byte‑identical to the already‑cleared cut — manifest at 0.8.0 with fleet/sdk entries untouched, 54 changed Cargo.toml pairs (workspace version + 53 pins), a clean 62 + / 62 − lockfile bump, and arcbox-hv 0.3.20 / arcbox-helper 1.1.0 still riding their own cadences.
• Changelog completeness holds under the new master commits — master gained exactly three commits since the last regen (ed5249cf, e2851032, 86f22a89, all feat(fleet-agent) under fleet/), and they are correctly absent from the root changelog: the root package config sets "exclude-paths": ["fleet", "sdk/typescript", "sdk/python"] with "separate-pull-requests": true, so those entries belong to a separate fleet release PR (0.1.4 → 0.2.0 pending there), not this one.

git merge-base origin/master HEAD == origin/master == 86f22a89, so the branch contains all of master, and release-please-config.json — with draft + force-tag-creation on the root package only — is untouched.

  ^{｜ View workflow run ｜ Using openai-compatible/@cf/zai-org/glm-5.3-flash ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes — the delta since my last review (c60aeb72, 2026‑09‑11) is one generated changelog bullet: release-please force-pushed the release pair onto the new master tip, and this run re-verified the regenerated files rather than re-reviewing content. Note the usual head-SHA drift: the payload named 60fc3e92, but the reviewed tip is b74c7061 (chore: update lockfiles for release lands after the webhook fires).

• One new ### Miscellaneous Chores entry — **master:** release fleet-agent 0.1.5 (#707) (16be5eb), taking the 0.8.0 section from 82 to 83 bullets. It maps 1:1 onto the single commit master gained since the last regen, and the entry type is long-established in this changelog (the 0.6.x sections carry release fleet-agent 0.1.4 (#638), release sdk-typescript 0.1.3 (#615), release sdk-python 0.1.2 (#580)).
• .release-please-manifest.json — "." → 0.8.0 remains the PR's only manifest change; the fleet entry moved to unchanged context at 0.1.5 because the folded-in master commit is itself the fleet release commit: it bumps fleet in the root manifest plus fleet/CHANGELOG.md and the fleet-agent crate version. The root manifest is not under the root package's exclude-paths, which is exactly why release-please lists the commit in the root changelog. The fleet bump touches a publish = false crate on its own cadence and does not perturb the 0.8.0 cut.
• Cargo.toml and Cargo.lock re-verified byte-clean — 54 changed Cargo.toml pairs (the [workspace.package] version + 53 # x-release-please-version pins) and a clean 62 + / 62 − lockfile, every changed line a standalone version = "0.8.0", zero non-version lines; arcbox-hv 0.3.20 and arcbox-helper 1.1.0 still ride their own cadences as unchanged context.
• Release date and compare link unchanged — still 2026‑09‑11 and v0.7.0...v0.8.0; the BREAKING CHANGES section still carries only #687.

Changelog completeness holds: git log 86f22a89..origin/master returns exactly that one fleet release commit, and git merge-base origin/master HEAD == origin/master == 16be5eb, so the branch contains all of master and the section is complete as of the branch's base. release-please-config.json is untouched. No review threads exist to retire — all nineteen prior reviews were body-only.

  ^{｜ View workflow run ｜ Using openai-compatible/@cf/zai-org/glm-5.3-flash ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes — the delta since my last review (b74c7061, re-rendered as 7f36f7e7 + fc443470 by release-please's force-push) is one generated changelog line; every other changed byte matches what I already cleared.

• CHANGELOG.md — one entry added under ### Bug Fixes: **ci:** let the fleet-agent release builds run to completion (#712, d8f02a6), taking the 0.8.0 section from 83 to 84 bullets (83 type + 1 breaking). Correct section for a fix(ci) type.
• Changelog completeness — git merge-base origin/master HEAD == origin/master == d8f02a6, and master gained exactly one commit since 16be5eb6, mapping 1:1 onto the added entry. The commit touches only .github/workflows/release-fleet-agent.yml (+2/−30), which sits at repo root — outside the root package's exclude-paths — so unlike its fleet/-scoped neighbours it IS listed. Section totals: Features 17, Bug Fixes 27, Code Refactoring 23, Tests 8, Documentation 4, Styles 1, Miscellaneous Chores 3; date 2026-09-11 == today; the BREAKING section still carries only #687; compare link still v0.7.0...v0.8.0.
• Cargo.lock — a clean 62 + / 62 -, every changed line a standalone version = "0.8.0" (62 == 65 workspace members − 3 independent cadences), with zero non-version lines in either direction (machine-checked).
• Cargo.toml — 54 changed pairs (the [workspace.package] version + 53 # x-release-please-version dep pins); every added line carries 0.8.0 and every removed line 0.7.0. arcbox-hv (0.3.20) and arcbox-helper (1.1.0) remain correctly untouched.
• .release-please-manifest.json — the single "." → 0.8.0 bump; fleet 0.1.5, sdk/typescript 0.1.3 and sdk/python 0.1.2 are unchanged context.
• Publish shape carries forward — the folded-in commit is CI-only for the fleet-agent release workflow (job timeout-minutes 30→60 on the macOS matrix and 20→30 on Linux, per-step build caps and both Cache cargo steps removed); it touches no manifest, lockfile, proto, or workspace member, so the member count (65) and the six-new-crates.io-crate set are unchanged, and it cannot perturb the 0.8.0 publish (release.yml untouched).
• release-please-config.json untouched — not among the four changed files, so draft + force-tag-creation remain on the root package only.

No review threads required retirement — the prior review, like all twenty before it, was body-only.

  ^{｜ View workflow run ｜ Using openai-compatible/@cf/zai-org/glm-5.3-flash ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes — delta since my last review (fc44347, twenty-first). Two notes up front: the synchronize payload's head_sha was 30d08756, but the chore: update lockfiles for release commit (2afce9f) landed after the webhook fired, so this review covers 2afce9f; and the supplied incremental range-diff's context lines are a mis-alignment artifact — the authoritative full diff shows the new entry inside ### Bug Fixes, not under the breaking header.

• One merged commit joined the 0.8.0 section — **agent:** report Kubernetes ready only once its kubeconfig exists (b992009, pushed straight to master, no PR link), taking the section to 85 bullets (84 type + 1 breaking; Bug Fixes 27→28). Filed under Bug Fixes, matching its fix type; it carries no ! and no BREAKING CHANGE footer, so the BREAKING section still holds only #687.
• Release date moved 2026-09-11 → 2026-09-18 (today); compare link still v0.7.0...v0.8.0.
• .release-please-manifest.json, Cargo.toml and Cargo.lock are byte-identical in shape to what I cleared last run — re-verified by machine this run (counts below).

What I verified, since a release PR's failure mode is an omission rather than a bad line:

• Changelog completeness. git merge-base origin/master HEAD == origin/master == b9920099; master gained exactly one commit since the previous changelog base d8f02a6e, mapping 1:1 onto the one added entry — nothing extra, nothing missing. guest/ is not among the root package's exclude-paths, so a root-changelog listing is correct.
• b9920099 is publish-neutral. One file changed — guest/arcbox-agent/src/agent/linux/kubernetes.rs (+13/−5). No manifest, lockfile, proto, or workspace member touched, so the member count (65), the six-new-crates.io-crate set, and the publish rate-limit headroom all carry forward untouched.
• Diff arithmetic, machine-checked. Cargo.lock: 62 added = 62 removed, every added line a standalone version = "0.8.0" (62 == 65 members − 3 independent cadences). Cargo.toml: 54 pairs, every added line carries 0.8.0 and every removed line 0.7.0. Manifest: the single "." bump; fleet 0.1.5 and both sdk entries are unchanged context. Changelog: 85 added bullets, 0 removed — exactly 1 more than the prior cut. Date matches today.
• release-please-config.json untouched — not among the four changed files, so draft + force-tag-creation remain on the root package only, and the documented draft-until-assets-exist ordering is intact.

No review threads required retirement — the prior review, like all twenty before it, was body-only, and thread state re-verified this run: 0 threads.

  ^{｜ View workflow run ｜ Using openai-compatible/@cf/zai-org/glm-5.3-flash ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes — delta since the prior pullfrog review (2afce9f, the twenty-second run): release-please force-pushed the pair onto master's new tip and re-rendered. Note the usual head-SHA drift: the synchronize payload carried 59dca9c, the reviewed tip is e520e60 (chore: update lockfiles for release landed after the webhook fired).

• 18 merged commits joined the 0.8.0 section, taking it to 103 bullets (102 type + 1 breaking; Features 17→26, Bug Fixes 28→32, Code Refactoring 23→24, Tests 8→11, Documentation 4→5; Styles and Miscellaneous Chores unchanged). The delta's headline items: the System VM resize path (feat(core)/feat(engine)/feat(api) plus abctl), returning reported guest pages to the host on HV (feat(vmm) + refactor(balloon) + its tests), guest egress proxying as an explicit policy (feat(net), closes #315 — default system = previous behavior), operator config for guest dockerd and keeping published ports off the LAN (feat(docker), default true = previous behavior), the Docker attach half-close carried in-band over vsock (fix(docker), closes #268 — AGENT_PROTOCOL_VERSION moves to 4), DNS following the host resolver across network changes (fix(dns), closes #714), reading the documented ~/.config/arcbox/config.toml (fix(config)), the agent publish mirror driven from Docker events (feat(agent) ×2), and the AGENTS.md/CLAUDE.md fold (docs(agents)).
• Release date moved 2026-09-18 → 2026-09-25 (today); compare link still v0.7.0...v0.8.0.
• .release-please-manifest.json, Cargo.toml and Cargo.lock are unchanged in shape from the cleared versions — re-verified by machine this run (counts below). The regen commit inherits master's dep-graph changes as context (arcbox-core gains arcbox-atomic-file/arcbox-fakeip/toml_edit 0.25.15, arcbox-fakeip gains thiserror, toml_edit 0.25.12→0.25.15 across dependents, plus arcbox-transport/tempfile additions) — all workspace entries carrying version beside path or crates.io pins, publish-safe, and none of it is PR diff content.

What I verified, since a release PR's failure mode is an omission rather than a bad line:

• Changelog completeness. git merge-base origin/master HEAD == origin/master == d5bf9f3; master gained exactly 18 non-merge commits since the previous changelog base b9920099, mapping 1:1 onto the 18 added entries — nothing extra, nothing missing, each filed under the section its conventional-commit type implies.
• No new breaking change. None of the 18 commits carries ! or a BREAKING CHANGE footer (the feat(net) policy and the feat(docker) knobs both default to today's behavior), so the BREAKING section still holds only #687.
• Diff arithmetic, machine-checked. Cargo.lock: 124 changed lines, zero of them anything but a standalone version line (62 + = 65 members − 3 independent cadences). Cargo.toml: 54 pairs, every changed line carries 0.8.0/0.7.0; 63 added version = "0.8.0" lines across the whole diff == 62 lock + 1 [workspace.package]. Manifest: the single "." bump; fleet 0.1.5 and both sdk entries unchanged context. Changelog: +136/−0. Date matches today.
• Publish shape unchanged. Master's range touches six member manifests (arcbox-core, arcbox-fakeip, arcbox-engine, arcbox-agent, arcbox-net, arcbox-vmm) but NOT the root Cargo.toml, so the member count stays 65, the six brand-new crates.io crates are unchanged, and the seventh-new-crate rate-limit threshold is still not crossed. The two workspace crates newly depended on — arcbox-atomic-file and arcbox-fakeip — both carry version beside path in the root pin, so the path strips at publish and the pin resolves.
• release-please-config.json untouched — not among the four changed files, so draft + force-tag-creation remain on the root package only, and the documented draft-until-assets-exist ordering is intact.

The artifacts visible in the incremental range-diff (new entries appearing to sit under ### ⚠ BREAKING CHANGES, and lock dep-list lines surfacing as changes) are the known context mis-alignment; the authoritative full diff places everything correctly, and the lock's dep-list shifts are master-inherited context, not PR changes.

No review threads required retirement — the prior review, like all twenty-one before it, was body-only.

  ^{｜ View workflow run ｜ Using openai-compatible/@cf/zai-org/glm-5.3-flash ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes — delta since my last review (e520e60, twenty-third run), covering the new head pair c505b0cd + afbfab0e:

• One commit joined the 0.8.0 section, taking it from 103 to 104 bullets — 1d63f6c (test(api), "resolve the official-image icon fixture through redis, not nginx"), filed under ### Tests, which matches its conventional-commit type. It maps 1:1 onto the one commit master gained since d5bf9f35. The commit itself is a 9-line fixture swap in app/arcbox-api/tests/icon_test.rs: nginx → redis because docker-library/docs replaced nginx's logo.png with logo.svg on 2026-09-21 and dimicon 0.2.0 only probes logo.png — the assertion still checks source == "docker_official_image", so the test stays falsifiable.
• Release-please re-cut the branch on the new master tip — regen pair (c505b0cd changelog/manifest/toml + afbfab0e lockfiles), release date moved to 2026-09-25 (today), everything else re-rendered identically in shape.

Mechanical re-verification of the re-cut, all clean:

• Changelog completeness — master gained exactly one commit (1d63f6c5) since d5bf9f35, and it is not under fleet/ or sdk/, so it belongs to the root changelog and maps 1:1 onto the one added entry; nothing missing, nothing extra. The BREAKING CHANGES section still carries only #687 (the new commit is a test with no ! and no footer). Section counts: Features 26, Bug Fixes 32, Code Refactoring 24, Tests 12, Documentation 5, Styles 1, Miscellaneous Chores 3, plus 1 breaking = 104.
• Diff arithmetic — plus 254 / minus 117, decomposing to changelog +137/−0, lock 62/62, toml 54/54, manifest 1/1; the 63 added version = "0.8.0" lines = 62 lock + 1 Cargo.toml [workspace.package]; zero ± lines in the lock and toml sections are anything but version lines; arcbox-hv (0.3.20) and arcbox-helper (1.1.0) correctly untouched.
• Publish shape — 1d63f6c5 touches only a test file; no manifest, lockfile, proto, or member manifest. Member count stays 65, the six-new-crates.io-crate set is unchanged, and the seventh-new-crate threshold stays uncrossed.

  ^{｜ View workflow run ｜ Using openai-compatible/@cf/zai-org/glm-5.3-flash ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes — delta since my last review (afbfab0, twenty-fourth run), covering the new head pair 704df000 + 7b9a2676. Note the usual head-SHA drift: the synchronize payload carried 704df00, but the lockfile commit (7b9a2676) landed after the webhook fired, so this review covers 7b9a267.

• Six commits joined the 0.8.0 section, taking it from 104 to 110 bullets — five ### Bug Fixes entries (306da7d give sysvinit machines a boot-completion hook, 5317190 keep the boot-done hook out of systemd's preset policy, 9613298 read machine addresses off the interfaces, 5305f47 serve only RPC inside distro machines, 6684ecc keep kernel NIC names in distro machines) and one ### Documentation entry (8ca31a6 list the machine distros that work today), each filed under the section its conventional-commit type implies.
• Release-please re-cut the branch on the new master tip — regen pair (704df000 changelog/manifest/toml + 7b9a2676 lockfiles), release date moved to 2026-09-26 (today), everything else re-rendered identically in shape.

Mechanical re-verification of the re-cut, all clean:

• Changelog completeness — master gained exactly six non-merge commits since 1d63f6c5 (306da7d, 5305f47, 6684ecc, 5317190, 9613298, 8ca31a6), mapping 1:1 onto the six added entries — nothing missing, nothing extra. None sits under fleet/ or sdk/, so the exclude-paths rule hides nothing, and git merge-base origin/master HEAD == origin/master == 8ca31a6, so the section is complete as of the branch's base. No new commit carries ! or a BREAKING CHANGE footer → the BREAKING section still carries only #687.
• Diff arithmetic — Cargo.lock: 124 changed lines, every one a standalone version = "0.8.0"/"0.7.0" line (zero non-version). Cargo.toml: 108 changed lines = 54 pairs, each carrying 0.7.0/0.8.0 (1 [workspace.package] + 53 dep pins). Manifest: the single "." bump. Changelog: +143/−0 (110 bullets + structural lines). 63 standalone +version = "0.8.0" lines == 62 lock + 1 workspace. arcbox-hv (0.3.20) and arcbox-helper (1.1.0) correctly untouched context.
• Publish shape unchanged — the six-commit master range touches 9 files, all modifications: README.md, engine/arcbox-engine/src/machine.rs, six files under guest/arcbox-agent/src/, and tests/e2e/tests/machine_network.rs. No manifest, no lockfile, no proto, no member manifest, no added or deleted files. Member count stays 65, the six brand-new crates.io crates are unchanged, and the seventh-new-crate rate-limit threshold stays uncrossed.

No review threads required retirement — the prior review, like all twenty-three before it, was body-only.

  ^{｜ View workflow run ｜ Using openai-compatible/@cf/zai-org/glm-5.3-flash ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes — delta since my last review (7b9a267, twenty-fifth run), covering the new head pair df7bfcb4 + 4d383f15. Note the usual head-SHA drift: the synchronize payload carried df7bfcb, but the lockfile commit (4d383f15) landed after the webhook fired, so this review covers 4d383f15.

• Joined the 0.8.0 section with 22 new entries, taking it from 110 to 132 bullets — 13 Features (the container-domain HTTP-port trio 9676968/85a811e/5ee5073, k3s servicelb d5b441a, TLS termination 00c5b70, abctl tls trust/untrust 8e7380a, LoadBalancer forwarding 6a09b61/9d1df4f, the local-CA generation before boot ab5fd1f, the local-ca crate pair b362ae5/068e8cc, the agent-protocol listing 5aaabf6, the Kubernetes hold d92f6bc), the first-ever Performance Improvements entry (6258585), 3 Code Refactoring (0243dc5, e846efa, b67588e), 3 Tests (4221445, e87e351, d4d54b6) and 2 Documentation (9604b03, f2ca88c) — each filed under the section its conventional-commit type implies.
• Re-cut the branch on the new master tip — regen pair (df7bfcb4 changelog/manifest/toml + 4d383f15 lockfiles), release date moved to 2026-09-26 (today), compare link v0.7.0...v0.8.0.
• Absorbed the first new workspace member in this PR's history — common/arcbox-local-ca (b362ae5, the HTTPS local CA for container domains) reached master and release-please folded it in: member count 65 → 66, a 54th # x-release-please-version dep pin, and a 63rd lockfile version pair.

Mechanical re-verification of the re-cut, all clean:

• Changelog completeness — master gained exactly 22 non-merge commits since 8ca31a6 (git log 8ca31a6..origin/master maps 1:1 onto the 22 added entries; git merge-base origin/master HEAD == origin/master == d4d54b6), none under fleet/ or sdk/, so exclude-paths hides nothing. No new commit carries ! or a BREAKING CHANGE footer → the BREAKING section still carries only #687. The Performance Improvements heading is configured, not a leak: release-please-config.json declares {"type": "perf", "section": "Performance Improvements"}.
• Diff arithmetic — Cargo.lock: 63 + / 63 −, every changed line a standalone version = "0.8.0"/"0.7.0" (zero non-version; 63 == 66 members − 3 independent cadences). Cargo.toml: 55/55 pairs = 1 [workspace.package] + 54 dep pins. Manifest: the single "." bump. Changelog: +169/−0. arcbox-hv (0.3.20) and arcbox-helper (1.1.0) correctly untouched context.
• Publish shape — the 22-commit range touches 59 files; the only manifest-affecting change is the arcbox-local-ca member itself, and it is publish-safe: explicit in members, version.workspace = true, no publish = false, no package.include, all-crates.io deps (rcgen, rustls, time — no git deps). The proto edits are additive (KubernetesLoadBalancers 0x0090/0x1090 per the request/response pair convention, host_ports on KubernetesStatusResponse), so the established descriptor/drift-check clearances carry forward.

ℹ️ The seventh-new-crate threshold flagged at eb7420f is now crossed — bounded

arcbox-local-ca 404s on the crates.io sparse index (re-verified all seven today), and release.yml:133 excludes only arcbox-hv, so the 0.8.0 tag now creates seven brand-new crates.io crates (the six carried through every prior review plus arcbox-local-ca) against 58 updates. PublishNew bursts at 5 and refills 1 per 600s while the retry loop clamps sleep at 300s (release.yml:177), so the two surplus new crates pay roughly 2 attempts and ~10 minutes of sleep each; the loop harvests published crates into --exclude per attempt (release.yml:151), so partial progress accumulates, and the worst case stays well inside max_attempts=60 / timeout-minutes: 90. Non-blocking for 0.8.0 — raising the clamp to ~610s would make the loop honour the server's own refill period instead of second-guessing it, and that belongs in a future release.yml PR, not this one.

  ^{｜ View workflow run ｜ Using openai-compatible/@cf/zai-org/glm-5.3-flash ｜ 𝕏}

[greptile-apps]

SSH command renders incorrectly The SSH entry makes @arcbox a link to github.com/arcbox instead of showing the literal command ssh <machine>@arcbox. This makes the new command harder for readers to recognize and copy.

Suggested change

	* **daemon:** serve ssh <machine>[@arcbox](https://github.com/arcbox) on a loopback port ([10fd1eb](https://github.com/arcboxlabs/arcbox/commit/10fd1eb5a50a4d0e16d66710f011241815640b3d))
	* **daemon:** serve `ssh <machine>@arcbox` on a loopback port ([10fd1eb](https://github.com/arcboxlabs/arcbox/commit/10fd1eb5a50a4d0e16d66710f011241815640b3d))

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[pullfrog]

✅ No new issues found.

Reviewed changes — delta since my last review (4d383f1, twenty-sixth run), covering the new head pair 256cd6d2 + 300fbe30, re-cut on the new master tip 264e96d9.

• Absorbed the SSH/machine-exec wave: 36 new entries, taking the 0.8.0 section from 132 to 168 bullets — 23 Features (the arcbox-ssh crate and its serving stack, abctl ssh install, the daemon loopback SSH service, the login/attached-stdin/signal protocol fields, flow-control windows, the machine-TCP relay, and the pty supplementary-groups change), 2 Bug Fixes (ab109d9, 4d5fd38), 6 Code Refactoring (the agent/engine machine-exec session-loop rework) and 5 Tests — each filed under the section its conventional-commit type implies.
• A second new workspace member in two deltas — app/arcbox-ssh (01fda00) reached master and release-please folded it in: member count 66 → 67, a 55th # x-release-please-version dep pin, a 64th lockfile version pair.
• Regenerated everything on the new tip — release date 2026-09-26 (today), compare link v0.7.0...v0.8.0 unchanged.

Mechanical re-verification of the re-cut, all clean:

• Changelog completeness — master gained exactly 36 non-merge commits since d4d54b6 (git log d4d54b6..origin/master maps 1:1 onto the 36 added entries by SHA; git merge-base origin/master HEAD == origin/master == 264e96d9), none under fleet/ or sdk/. No new commit carries ! or a BREAKING CHANGE footer → the BREAKING section still carries only #687.
• Diff arithmetic — Cargo.lock: 64 + / 64 −, every changed line a standalone version = "0.8.0"/"0.7.0" (zero non-version; 64 == 67 members − 3 independent cadences). Cargo.toml: 56/56 pairs = 1 [workspace.package] + 55 dep pins. Manifest: the single "." bump. Changelog: +205/−0. arcbox-hv (0.3.20) and arcbox-helper (1.1.0) correctly untouched context.
• Version consistency — no 0.7.0 remains anywhere in Cargo.toml; the only 0.7.0 entries left in Cargo.lock are the third-party rustls-platform-verifier and system-configuration.
• Publish shape — arcbox-ssh is publish-safe: version.workspace = true, no publish = false, no package.include, and all-crates.io dependencies (buffa, rand, russh — no git deps). The range's proto edits are purely additive (three new MachineExecRequest/MachineExecOutput field pairs at the next free numbers, three new agent.proto messages, four new wire.rs message types following the request/response pair convention), so the established descriptor clearances carry forward.

ℹ️ The eighth-new-crate threshold flagged at eb7420f is now crossed — bounded

arcbox-ssh 404s on the crates.io sparse index (arcbox-local-ca re-verified 404 today), and release.yml excludes only arcbox-hv, so the 0.8.0 tag now creates eight brand-new crates.io crates (the seven carried through the twenty-sixth review plus arcbox-ssh) against 58 updates. PublishNew bursts at 5 and refills 1 per 600s while the retry loop clamps sleep at 300s, so the three surplus new crates pay roughly 2 attempts and 10 minutes of sleep each (+6 attempts / +30 minutes worst case); the loop harvests published crates into --exclude per attempt, so partial progress accumulates, and the worst case stays well inside max_attempts=60 / timeout-minutes: 90. Non-blocking for 0.8.0 — same disposition as the twenty-sixth review.

  ^{｜ View workflow run ｜ Using openai-compatible/@cf/zai-org/glm-5.3-flash ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes — delta since the twenty-seventh review (300fbe3): master gained exactly one commit (b122010d), the regen absorbed it as one new ### Documentation entry, and the other three files are byte-identical to that review.

• One merged docs commit joined the 0.8.0 section, bringing it to 169 bullets (168 type + 1 breaking; Documentation 8 → 9) — docs(agents): record what the distro tests and the parallel work taught (b122010d, pushed straight to master, no PR link), correctly filed under ### Documentation.
• Release date and compare link unchanged — still 2026-09-26 and v0.7.0...v0.8.0.

What I verified, since a release PR's failure mode is an omission rather than a bad line:

• Changelog completeness. git merge-base HEAD origin/master == origin/master == b122010d, so the section is complete as of the branch's base, and 264e96d9..b122010d contains exactly that one commit, mapping 1:1 onto the one added entry.
• Publish shape carries forward. b122010d touches 6 files, all AGENTS.md (+170/−14) — no manifest, no lock, no proto, no member change. Member count stays 67, so the tag still creates 8 brand-new crates.io crates against 58 updates, and the publish-budget analysis from the twenty-sixth/twenty-seventh reviews stands unchanged.
• Diff arithmetic, machine-checked. Cargo.lock 64 + / 64 −, every changed line a standalone version = "0.8.0" (64 = 67 members − 3 independent cadences); Cargo.toml 56 pairs (1 workspace version + 55 pins) with arcbox-hv 0.3.20 and arcbox-helper 1.1.0 correctly untouched; manifest 1 pair; changelog +206/−0. The delta commit's body carries no ! and no BREAKING CHANGE footer — BREAKING still carries only #687.
• release-please-config.json untouched — not among the four changed files, so draft + force-tag-creation remain on the root package only and the documented draft-until-assets-exist ordering is intact.

Note the usual head-SHA drift: the synchronize payload named 8ca7d6e7, but chore: update lockfiles for release (bf0759be) landed after the webhook fired. This review covers bf0759be.

  ^{｜ View workflow run ｜ Using openai-compatible/@cf/zai-org/glm-5.3-flash ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes — delta since the twenty-eighth review (bf0759be): master gained exactly three commits and release-please re-rendered the release pair on that tip. Note the usual head-SHA drift: the synchronize payload named 30531990, but chore: update lockfiles for release (ebd9e39) landed after the webhook fired — this review covers ebd9e39.

• Three commits joined the 0.8.0 section, taking it from 169 to 172 bullets (Features 62 → 65) — all three under ### Features, completing the ssh-agent forwarding capability: 561ee79 (feat(daemon), forward ssh-agent into containers over a vsock slot pool — gated behind ARCBOX_SSH_AGENT_FORWARDING, so it ships opt-in and no default behavior rides the release), f6d64ad (feat(agent), relay the container ssh-auth socket over vsock), and ec0d3ce (feat(constants), reserve the ssh-auth socket path and relay port). The supplied incremental range-diff rendered all three under the BREAKING header — the known mis-alignment artifact; the authoritative full diff confirms they sit in Features and the BREAKING CHANGES section still carries only #687 (no ! and no BREAKING CHANGE footer in any of the three commit bodies).
• Release date moved 2026-09-26 → 2026-09-27 — matching today; compare link still v0.7.0...v0.8.0.
• .release-please-manifest.json, Cargo.toml and Cargo.lock unchanged in shape from the cleared cut — re-verified by machine this run (counts below).

What I verified, since a release PR's failure mode is an omission rather than a bad line:

• Changelog completeness. git merge-base origin/master HEAD == origin/master == 561ee79, and b122010d..origin/master contains exactly the three commits above — mapping 1:1 onto the three added entries; none sits under fleet/ or sdk/, so nothing on master is unaccounted for.
• Diff arithmetic, machine-checked. Cargo.lock 64 + / 64 −, every changed line a standalone version = "0.8.0" (64 = 67 members − 3 independent cadences), zero non-version ± lines; Cargo.toml 56/56 pairs with every ± line carrying the 0.7.0 → 0.8.0 pairing and zero non-version lines; manifest 1 pair; changelog +209/−0 (172 bullets). arcbox-hv (0.3.20) and arcbox-helper (1.1.0) correctly untouched.
• Publish shape carries forward. The three commits touch only .rs files (app/arcbox-daemon/src/main.rs, startup/pipeline.rs + new ssh_agent.rs; guest/arcbox-agent/src/main.rs + new ssh_auth.rs; common/arcbox-constants/src/paths.rs, ports.rs) — no member manifest, no lockfile content change, no protos, no wire vocabulary change. Member count stays 67, so the tag still creates 8 brand-new crates.io crates against 58 updates and the publish-budget analysis stands. Both new files sit in crates that carry no package.include, so packaging picks them up.
• release-please-config.json untouched — not among the four changed files, so draft + force-tag-creation remain on the root package only and the documented draft-until-assets-exist ordering is intact.

  ^{｜ View workflow run ｜ Using openai-compatible/@cf/zai-org/glm-5.3-flash ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes since my last review (ebd9e39, force-pushed by release-please). The delta is the disk-reclaim wave absorbed from master — five new changelog entries (2 Features, 1 Bug Fix, 2 Documentation), taking the 0.8.0 section from 172 to 177 bullets, plus the routine re-render. No manifest, Cargo.toml, or Cargo.lock shape change.

• Features +2 — daemon: reclaim freed disk space on idle and per machine (0b4dfe8), vmm: punch DISCARDed ranges on the HVC block fast path (3f2048d)
• Bug Fixes +1 — agent: trim data disks with FITRIM instead of a missing fstrim (7584f62)
• Documentation +2 — disk: add the post-change reclaim matrix and trim I/O numbers (ca18e28), disk: record the reclaim matrix and the HV fast-path gap (fb3b5cf)
• Release date is 2026-09-27 (today); compare link still v0.7.0...v0.8.0.

What I verified, since a release PR's failure mode is an omission rather than a bad line:

• Changelog completeness. git log --no-merges 561ee79..origin/master returns exactly those five commits, mapping 1:1 onto the five added entries — nothing extra, nothing missing, each filed under the section its conventional-commit type implies. git merge-base origin/master HEAD == origin/master == ca18e28, so the section is complete as of the branch's base; none of the five sits under fleet/ or sdk/.
• The 7584f62 proto edit is additive and wire-compatible. DiskTrimResponse gains bytes_trimmed = 2 (a new field); machine.proto's CompactDisk doc comment is reworded only; the regenerated descriptor and protoset ship in the same commit. No field removal or renumbering.
• Publish shape carries forward. None of the five commits touches any Cargo.toml or Cargo.lock, so the member count stays 67, the eighth-new-crate set is unchanged, and the publish-budget analysis from the 27th review stands. The delta's new files (app/arcbox-daemon/src/disk_reclaim.rs, three virt/arcbox-vmm modules, docs/disk-reclaim.md) sit in crates with no package.include, so packaging picks them up.
• BREAKING accounting unchanged. No ! in any of the five subjects and no BREAKING CHANGE footer in any body, so the BREAKING section still carries only #687.
• Version consistency, machine-checked. Cargo.lock is a clean 64 + / 64 − with zero changed lines that are not a standalone version pair (64 == 67 members − 3 independent cadences); Cargo.toml is 56 + / 56 −, all 0.7.0 → 0.8.0 (1 workspace version + 55 pins); the manifest's single "." pair moved. arcbox-hv (0.3.20) and arcbox-helper (1.1.0) appear only as untouched context; no changed line anywhere carries a stale version.

  ^{｜ View workflow run ｜ Using openai-compatible/@cf/zai-org/glm-5.3-flash ｜ 𝕏}