Skip to content

BaseHarbor v0.4.22

Release date: 2026-10-06. Release umbrella: #570. Implementation: #790.

Machine operations

Supported business operations share the existing operator authorization boundary across CLI, JSON and MCP. Stable application identity, managed-environment policy, ownership, explicit destructive approval and secret-safe results apply before mutation. Host shell sessions, long-running transports and binary self-replacement remain explicit local modes.

The generated coverage matrix and MCP registry cover discovery and supported operation modes. Automation examples show concrete calls for application intent, workspaces, protected secrets and public host trust.

Extension verification and public conformance

Versioned descriptors cover six neutral extension families. Content verification recomputes immutable digests, verifies signatures against operator-configured keys and checks digest-bound in-toto/SBOM/provenance evidence. Verification and publisher/deployment trust policy remain separate; no signer vendor is required. Unavailable evidence never becomes verified evidence.

External implementations can import conformance/provider/v1 and run the public lifecycle or full profile. The full profile reuses the existing harness and adds drift, faults, recovery, foreign ownership, sibling isolation and repeated destroy checks. An independent external module exercises the exported API without internal imports. See artifact trust and public conformance.

Repository adoption and lifecycle fixes

  • Quick init preserves detected HTTP/HTTPS exposure contracts. Ambiguous target ports fail before the manifest is written.
  • Repeated quick init leaves the existing contract unchanged and reports that result; it does not silently approve repository evolution.
  • Standalone preflight uses the same workload contract gate as lifecycle mutation. Repository up checks that contract before starting the control plane.
  • Configuration records are configured, not applying. Failed apply preflight produces a non-ready failure observation without a successful verification timestamp.
  • Target teardown preserves application intent, source and inputs. It marks a registration not applied only when its application runtime directory and matching runtime containers are absent. Partial or live application state remains available for recovery.
  • Application help lists new once.
  • Generated Go applications import the native clients and TLS helpers required by messaging, document databases and durable key-value storage. Repository capability validation explicitly reports that it has not compiled the project; real builds cover individual and combined capabilities.
  • Control-plane memory planning reads the selected standard or HA topology, includes all members and transient admin/bootstrap services, and labels planning budgets ESTIMATED. Container count is not a measured memory multiplier.
  • Fresh control planes default to one native PostgreSQL server and one OpenBao server with authoritative PostgreSQL storage, TLS and stable endpoints. Explicit HA retains three members. Retained topology conflicts fail before mutation; no pre-freeze migration or legacy compatibility is provided.
  • Shared PostgreSQL follows SQL availability intent: the default is a single native, non-root PostgreSQL service; explicit HA retains the provider-native cluster. A retained provider rejects incompatible member requirements before mutation. Its pre-freeze state contract is replaced directly, without migration or legacy support. Status reports actual members and topology.

Target and installation destruction preview the concrete owned containers, networks and volumes. Resource results and residues are returned through CLI, JSON and MCP. Shared providers are removed after their application consumers are gone; external source/data and recovery files are explicitly preserved. Container removal includes associated anonymous volumes, while declared external volumes remain outside the deletion scope.