[bonk-ai]

What and why

The v1.0.0 agentd release asset reports 0.1.0 in GET /v1/health, the microvms-agentd-version header, /v1/schema's daemon_version and the agentd listening log line, while docs/STABILITY.md gives the daemon the release number. crates/agentd/src/routes.rs sets VERSION from CARGO_PKG_VERSION, crates/agentd/Cargo.toml stayed at 0.1.0 through every release, and tag_version_skew in tools/check-publishable.py compared only the published crates, so nothing caught it.

• crates/agentd/Cargo.toml is 1.0.0. docs/schema.json (daemon_version), Cargo.lock and crates/agentd/fuzz/Cargo.lock are regenerated, and crates/model-conformance/Cargo.toml's path requirement on agentd moves to 1.0.0, since ^0.1.0 doesn't match a 1.0.0 crate.
• tag_version_skew compares RELEASED, the published crates plus agentd, with the tag. release:tag and release.yml's guard job run it with --tag, so a release whose daemon version differs from the tag is refused before the tag exists. agentd-model stays out.
• New tools/test_check_publishable.py, run first in publish:check: the daemon at another version fails, agentd-model at another version passes, each published crate and both binding manifests are compared, and this tree agrees with a tag of its own release number. That last test fails on main.
• CONTRIBUTING.md's release steps name crates/agentd/Cargo.toml among the manifests the release PR bumps, and docs/schema.json and the fuzz lock among the files it regenerates. The version_skew live lane's docstring says the daemon's version follows the release from agentd reports version 0.1.0 in the 1.0.0 release #592 on; its code already reads the version from the manifest at each tree.
• PROTOCOL_VERSION stays 2. Only daemon_version changes, and crates/protocol/src/lib.rs tells a client to proceed when only that differs. schema:compat against v1.0.0 passes.

Verified offline only: no live run. The next live run on main exercises it through the version_skew section, where this tree's daemon should report 1.0.0 and v1.0.0's 0.1.0.

Fixes #592

Evidence

• mise run check: exit 0 in 309 s at 25baf74 (2026-10-12). fail-to-pass:check reported "this fix changes no product source", changelog:check "1 fragments in changelog.d/, and they build", guards:list 1323 faults registered.
• mise run schema:compat: exit 0, "docs/schema.json against v1.0.0:docs/schema.json (protocol_version 2 -> 2) compatible".
• mise run publish:check: exit 0, 7 tests passed, then "publishable: 6 crates, metadata complete".
• ./tools/check-publishable.py --tag=v1.0.0: exit 0, "every published manifest and the daemon's agree with tag v1.0.0".
• ./tools/check-lint-coverage.py && mise exec -- ruff check . && mise exec -- ruff format --check .: passed in the pre-commit hook.

Parity

• No public name changed on any surface (core, CLI commands, microvms.pyi, index.d.ts).

Guards

• publishable-tag-skips-daemon (new, verify/guards/faults/script-gates.toml): sets RELEASED = PUBLISHED in tools/check-publishable.py, which is the comparison v1.0.0 shipped with, and test_the_daemon_at_another_version_fails fails. ./tools/check-guards-fire.py fire --only publishable-tag-skips-daemon printed fired: publishable-tag-skips-daemon and "restored, every command passes again".
• By hand: with crates/agentd/Cargo.toml set back to 0.1.0 (and model-conformance's requirement with it), ./tools/check-publishable.py --tag=v1.0.0 exited 1 with "agentd is version 0.1.0 and the tag says 1.0.0", and test_this_tree_agrees_with_a_tag_of_its_own_release_number and the command test failed. With the files restored, the gate exited 0 again.
• The fix changes no .rs product source, so fail-to-pass:check has no Rust test to prove; the Python suite above is the regression test.

Follow-ups

None.

Platform claims

• Not applicable: this changes no claim about AWS behavior.

Scope

• This is not an orchestrator or a fork implementation
  (see docs/STRATEGY.md).

[laithalsaadoon]

LGTM