chore: prepare 1.0.1 release

CHANGELOG.md

@@ -13,6 +13,17 @@ CONTRIBUTING.md, "Changelog", says how to write one.
 
 <!-- towncrier release notes start -->
 
+## [1.0.1] - 2026-10-12
+
+### Fixed
+
+- **The daemon reports the release number as its version (#592).** The 1.0.0 `agentd` reported
+  `0.1.0` in `GET /v1/health`, the `microvms-agentd-version` header, `/v1/schema`'s
+  `daemon_version` and its startup log, because its crate version never moved with a release. It
+  now carries the release number, and `release:tag` refuses a release whose daemon version
+  differs from the tag. `PROTOCOL_VERSION` stays 2, so a client that compares only it proceeds
+  as before.
+
 ## [1.0.0] - 2026-10-11
 
 ### Changed

bindings/microvms-js/Cargo.toml

@@ -17,11 +17,11 @@ crate-type = ["cdylib"]
 
 [dependencies]
 # The only thing being wrapped. No edge to `microvms-cli` (BIND-1).
-microvms-core = { version = "1.0.0", path = "../../crates/microvms-core" }
+microvms-core = { version = "1.0.1", path = "../../crates/microvms-core" }
 # The wire types the core's public signatures already answer with. See the same
 # entry in `bindings/microvms-py/Cargo.toml` for why naming the crate beats re-declaring
 # the shapes (ARCH-2).
-protocol = { package = "microvms-protocol", version = "1.0.0", path = "../../crates/protocol" }
+protocol = { package = "microvms-protocol", version = "1.0.1", path = "../../crates/protocol" }
 # `async` pulls in `tokio_rt`: an exported `#[napi] pub async fn` then runs on
 # napi's managed runtime and returns a JavaScript Promise, with `Err` rejecting
 # it. That is why this side needs no `block_on` bridge at all — Node is

bindings/microvms-js/package.json

@@ -1,6 +1,6 @@
 {
   "name": "microvms",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Node.js and TypeScript client for AWS Lambda MicroVMs",
   "license": "Apache-2.0",
   "author": "Laith Al-Saadoon",

bindings/microvms-py/Cargo.toml

@@ -23,13 +23,13 @@ crate-type = ["cdylib", "rlib"]
 # (BIND-1): a binding that depended on the CLI would be a binding whose surface
 # is whatever the CLI happened to expose, and the CLI is a consumer of this same
 # core rather than a layer above it.
-microvms-core = { version = "1.0.0", path = "../../crates/microvms-core" }
+microvms-core = { version = "1.0.1", path = "../../crates/microvms-core" }
 # The wire types the session surface already answers with (`Health`, `Phase`,
 # `Outcome`, `ExitEvent`). Not a new dependency in substance: `microvms-core`'s
 # public signatures return these, so a binding that mapped them without naming
 # the crate would have to re-declare their fields — which is exactly the drift
 # `protocol` was extracted to make impossible (ARCH-2).
-protocol = { package = "microvms-protocol", version = "1.0.0", path = "../../crates/protocol" }
+protocol = { package = "microvms-protocol", version = "1.0.1", path = "../../crates/protocol" }
 # Name records cross the binding as JSON (`NameRecord.to_dict`/`from_dict`).
 serde_json = "1"
 # No `extension-module` feature. It is deprecated, and enabling it disables

bindings/microvms-py/microvms.pyi

@@ -3771,7 +3771,7 @@ def wrap_dockerfile(task_dockerfile: str, *, port: int |None = None, workdir: st
 # `microvms_core::VERSION`, added by the module's `#[pymodule_init]`. The **core's**
 # version and not this crate's: what a caller needs to know is which client they are
 # talking through.
-__version__: Final[str] = "1.0.0"
+__version__: Final[str] = "1.0.1"
 
 class MicrovmError(Exception):
     """

bindings/microvms-py/pyproject.toml

@@ -10,7 +10,7 @@ build-backend = "maturin"
 
 [project]
 name = "microvms"
-version = "1.0.0"
+version = "1.0.1"
 description = "Python client for AWS Lambda MicroVMs"
 requires-python = ">=3.9"
 readme = "README.md"

crates/agentd/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "agentd"
-version = "1.0.0"
+version = "1.0.1"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true
@@ -17,7 +17,7 @@ description = "Exec and file-transfer daemon for AWS Lambda MicroVMs"
 # know lives there, so a field renamed on one side fails to compile on the other —
 # which is earlier and cheaper than the schema artifact catching it in CI, and far
 # earlier than a consumer catching it at runtime.
-protocol = { package = "microvms-protocol", version = "1.0.0", path = "../protocol" }
+protocol = { package = "microvms-protocol", version = "1.0.1", path = "../protocol" }
 # `ws` is the TCP relay (`tunnel.rs`): the endpoint proxy carries a WebSocket to a
 # guest port but has no CONNECT method, so arbitrary TCP rides inside binary frames
 # (measured 2026-08-29 — see docs/PLATFORM.md). axum's own extractor rather than a

crates/microvms-app/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "microvms-app"
-version = "1.0.0"
+version = "1.0.1"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true
@@ -19,9 +19,9 @@ categories = ["virtualization"]
 [dependencies]
 # The wire contract, shared with the daemon (ARCH-2). A field renamed in `crates/protocol/` must break
 # this crate's build.
-protocol = { package = "microvms-protocol", version = "1.0.0", path = "../protocol" }
+protocol = { package = "microvms-protocol", version = "1.0.1", path = "../protocol" }
 # The rules and values, which do no I/O (ARCH-6).
-microvms-domain = { version = "1.0.0", path = "../microvms-domain" }
+microvms-domain = { version = "1.0.1", path = "../microvms-domain" }
 # The control plane's rest-json bodies and the session's wire payloads.
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

crates/microvms-cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "microvms-cli"
-version = "1.0.0"
+version = "1.0.1"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true
@@ -35,7 +35,7 @@ path = "src/main.rs"
 [dependencies]
 # The whole product surface. Every AWS call, every trap closure, the cost engine,
 # and the error taxonomy the exit table is a rendering of.
-microvms-core = { version = "1.0.0", path = "../microvms-core" }
+microvms-core = { version = "1.0.1", path = "../microvms-core" }
 # No direct `protocol` edge: the wire types are named through
 # `microvms_core::protocol::` (core's re-export), so this crate has exactly one
 # door to everything below it. The direct edge existed while core lacked the
@@ -111,7 +111,7 @@ pkg-fmt = "zip"
 # The same core, with the shared test doubles (`microvms_core::testing`) the guards script it
 # through. The version is here because `check-publishable.py` refuses a versionless path
 # dependency of any kind, and resolver 3 keeps the feature out of a normal build.
-microvms-core = { version = "1.0.0", path = "../microvms-core", features = ["test-support"] }
+microvms-core = { version = "1.0.1", path = "../microvms-core", features = ["test-support"] }
 # Temp files/dirs for the test suites: random names with O_EXCL creation and
 # guaranteed cleanup on drop. Replaces eight hand-rolled pid+thread-id helpers
 # that deleted-then-created by fixed name.

crates/microvms-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "microvms-core"
-version = "1.0.0"
+version = "1.0.1"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true
@@ -17,13 +17,13 @@ categories = ["api-bindings", "virtualization"]
 [dependencies]
 # The wire contract, shared with the daemon rather than mirrored (ARCH-2), and re-exported so
 # a consumer names wire types through this crate.
-protocol = { package = "microvms-protocol", version = "1.0.0", path = "../protocol" }
+protocol = { package = "microvms-protocol", version = "1.0.1", path = "../protocol" }
 # The rules and values, which do no I/O (ARCH-6).
-microvms-domain = { version = "1.0.0", path = "../microvms-domain" }
+microvms-domain = { version = "1.0.1", path = "../microvms-domain" }
 # The use cases, written against ports (ARCH-7).
-microvms-app = { version = "1.0.0", path = "../microvms-app" }
+microvms-app = { version = "1.0.1", path = "../microvms-app" }
 # The production port implementations, which `prelude` wires into the use cases.
-microvms-edges = { version = "1.0.0", path = "../microvms-edges" }
+microvms-edges = { version = "1.0.1", path = "../microvms-edges" }
 
 [features]
 # The shared test doubles in `microvms_core::testing`, for a dependent's `[dev-dependencies]`
@@ -36,7 +36,7 @@ test-support = ["microvms-app/test-support"]
 # dependency on this crate with `test-support`: `cargo publish` resolves a versioned
 # self-dependency against the registry, where the feature doesn't exist yet, and
 # `tools/check-publishable.py` refuses one.
-microvms-app = { version = "1.0.0", path = "../microvms-app", features = ["test-support"] }
+microvms-app = { version = "1.0.1", path = "../microvms-app", features = ["test-support"] }
 # What the integration tests build their fixtures from: the daemon's wire payloads, the tunnel's
 # WebSocket and Noise handshake, a context's zip and hash, and the scratch directories' names.
 # Test-only, so outside the placement set, which covers what ships.

crates/microvms-domain/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "microvms-domain"
-version = "1.0.0"
+version = "1.0.1"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true
@@ -18,7 +18,7 @@ categories = ["virtualization"]
 [dependencies]
 # The wire contract, shared with the daemon (ARCH-2). The identity seeds' validation lives
 # there so the host and the daemon can't disagree about what a seed is.
-protocol = { package = "microvms-protocol", version = "1.0.0", path = "../protocol" }
+protocol = { package = "microvms-protocol", version = "1.0.1", path = "../protocol" }
 # The error taxonomy's Display impls. 2.x rather than 1.x: `#[error]` on an enum
 # with `#[from]` is the same surface, and the 2.0 line is what receives fixes.
 thiserror = "2.0.19"

crates/microvms-edges/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "microvms-edges"
-version = "1.0.0"
+version = "1.0.1"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true
@@ -20,11 +20,11 @@ categories = ["api-bindings", "virtualization"]
 # `verify/arch/placement.toml`: this is where those crates belong. Each one implements a port that
 # `microvms-app` declares, and `microvms-core` wires them in.
 [dependencies]
-microvms-app = { version = "1.0.0", path = "../microvms-app" }
+microvms-app = { version = "1.0.1", path = "../microvms-app" }
 # The rules the fetch checks a binary against (`provision`'s ELF machine), which the app has no
 # use for and so doesn't re-export.
-microvms-domain = { version = "1.0.0", path = "../microvms-domain" }
-protocol = { package = "microvms-protocol", version = "1.0.0", path = "../protocol" }
+microvms-domain = { version = "1.0.1", path = "../microvms-domain" }
+protocol = { package = "microvms-protocol", version = "1.0.1", path = "../protocol" }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 
@@ -136,7 +136,7 @@ libc = "0.2"
 
 [dev-dependencies]
 # The app's shared test doubles, for the forwarder's and tunnel's tests.
-microvms-app = { version = "1.0.0", path = "../microvms-app", features = ["test-support"] }
+microvms-app = { version = "1.0.1", path = "../microvms-app", features = ["test-support"] }
 # `provision_fuzz`: `bolero::check!` runs as an ordinary `#[test]` on stable and as a
 # coverage-guided target under `cargo bolero test`.
 bolero = "0.13"

crates/model-conformance/Cargo.toml

@@ -19,7 +19,7 @@ publish = false
 agentd-model = { path = "../model", version = "0.1.0" }
 # `test-support` for the fake control plane the preflight rows and the lifecycle replay run
 # against.
-microvms-app = { path = "../microvms-app", version = "1.0.0", features = ["test-support"] }
+microvms-app = { path = "../microvms-app", version = "1.0.1", features = ["test-support"] }
 # The checker that walks the client lifecycle model for `tests/client_lifecycle.rs`:
 # `PathRecorder` and the BFS are stateright's, on the line the model is written against, so the
 # lockfile resolves one copy.
@@ -37,9 +37,9 @@ tokio = { version = "1.53", features = ["rt", "macros", "test-util", "net", "io-
 # The daemon's real `/v1/tcp` route and the client's real relay, for
 # `tests/tunnel_end_of_stream.rs`: the verified tunnel's end of stream is a contract between the
 # two, and a stand-in for either half would test the contract against itself.
-agentd = { path = "../agentd", version = "1.0.0" }
-microvms-edges = { path = "../microvms-edges", version = "1.0.0" }
-protocol = { package = "microvms-protocol", path = "../protocol", version = "1.0.0" }
+agentd = { path = "../agentd", version = "1.0.1" }
+microvms-edges = { path = "../microvms-edges", version = "1.0.1" }
+protocol = { package = "microvms-protocol", path = "../protocol", version = "1.0.1" }
 # The on-path party the tunnel test puts between them, which terminates the WebSocket as the
 # endpoint proxy does. The same line the client and the daemon's tests use.
 tokio-tungstenite = "0.30"

crates/protocol/Cargo.toml

@@ -5,7 +5,7 @@
 # source files that name it: the rename is a manifest concern and does not reach
 # the code.
 name = "microvms-protocol"
-version = "1.0.0"
+version = "1.0.1"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true

docs/manifest.json

@@ -4703,7 +4703,7 @@
         "type": "boolean"
       }
     ],
-    "version": "1.0.0"
+    "version": "1.0.1"
   },
   "status": "ok",
   "type": "microvm.manifest"

docs/schema.json

@@ -756,7 +756,7 @@
     "header": "authorization",
     "scheme": "bearer"
   },
-  "daemon_version": "1.0.0",
+  "daemon_version": "1.0.1",
   "definition_collisions": [],
   "generated_from": "the daemon's own serde types, via schemars",
   "hook_prefix": "/aws/lambda-microvms/runtime/v1",