[AlanD20]

Goal

Make v0.3.0 a clean-break security foundation: operators use one mvm binary and an unprivileged CLI, with narrowly typed operations through the verified root-owned system installation.

A clean installation is required. Legacy databases and runtime state are not migrated.

Implemented

• Mandatory Jailer, matched Firecracker/Jailer 1.17.0, isolated VM identities and root-owned lifecycle authority.
• Protected active disks, consistent attached-volume snapshots, raw data volumes and typed LoopMount operations.
• Per-VM network namespaces, direct Go nftables enforcement and default-deny same-network/cross-network traffic.
• Separate traffic and exec policies, with explicit VM/network-to-host gateway TCP/UDP grants.
• Pressure-only memory control, bounded CPU/swap/PID controls, verified status/reconciliation and structured JSON.
• Environment volumes, policies, readiness and checked cleanup; local image-import resume and identical-kernel reimport.
• Networkless cloud-init, provisioning progress, runner readiness and same-IP neighbor-recreation fixes.
• Confirmed administrator uninstall through typed cleanup and host reset; preserve external mirrors and original files.
• Reset accepts terminal networkless history and exactly bound empty prior-boot firewall history, retaining current absence checks.
• Align operator docs and package dependencies; publish the public guides and pipe-friendly install/uninstall launchers.

Verification

• Accepted historical x86_64 qualification: 528/528 source-bound cases, including host reboot PRE/POST.
• Subsequent focused runtime checks, including the earlier f28e9a2c installed smoke: 4/4 passed.
• Uninstaller/reset coverage: 18 Python cases, focused Go cases and real two-operator cleanup, reinstall and guest exec in mvmctl-030-test.
• Complete clean-checkout Go CI sequence and full root-Jailer package on 49282ff8. The final follow-up changes only generated-coverage ignore and checklist text. Two direct crash-worker entry points skip intentionally; their parent crash tests pass.
• Remote CI passes on final head 4f007f88.
• Paired 0.3.0 candidate built from the clean 4f007f88 checkout; version and source/artifact receipt retained.
• Public-site build, deployed downloads and 10 launcher cases pass, including piped terminal confirmation.

Latest local candidate SHA-256: 42a0fee12eb2052d83d21191df3fcc51c15c9c95338c4aead403410b3344ca71.
Its source binding is recorded in the clean-checkout build receipt; embedded VCS fields are absent from this local build.

The historical 528-case result is an accepted mixed-source evidence join, not a claim that every case ran against the latest binary. Original receipts and later focused results retain separate identities. See qualification limits.

Breaking changes and limits

• One trusted system installation, operator enrollment and mandatory Jailer/cgroup v2/kernel nftables support replace legacy raw-sudo/direct-launch paths. The nft and iptables CLIs are not runtime dependencies.
• Same-network VM traffic needs a grant. Traffic and execution authority are separate; the old service-access and VM --allow-remote-exec interfaces are removed.
• Attached-volume growth and forced removal require the relevant VM stopped. Legacy state is not adopted automatically.
• Memory pressure checks passed, but the original VMM kill remains unattributed; host/ancestor OOM immunity is not promised.
• aarch64 runtime qualification remains deferred. Cross-builds do not qualify runtime behavior; recorded adversarial/fault limits remain explicit.

Deferred by the user

• Merge PR Release 0.3.0: VM isolation and typed host authority #7 — do not merge yet.
• Tag v0.3.0 and publish release artifacts — do not tag or publish yet.
• Date the release changelog and update AUR version/checksums when publication is approved and artifacts exist.

Pre-tag closeout is complete; these publication actions remain separate approvals.