Skip to content

Release 2.1.2 (2026-06-04)

Documentation

  • normalize identities.toml keys to vergil- (#1370) Identity keys become vergil-user/vergil-audit so the key equals the vm_instance base. App credential names (-vergil-), vm_instance values, and VRG_IDENTITY_MODE role values are unchanged. Tracks vergil-vm#99.

  • document list observability columns (#1370) list --help defines AGENTS (harness instances) vs HUMANS (open human-held interactive shells; a count of shells, not people) and the SPEC states (ok/NEEDS-REBUILD/not-created/orphaned/under). Tracks vergil-vm#99.

Features

  • parse repo [vm] cascade in vergil.toml (#1370) Add VmStanza/RoleOverlay and parse_vm_stanza for the [vm] + [vm.] cascade; allow the [vm] section in the config allow-list with key validation delegated to the stanza parser. Tracks vergil-vm#99.

  • parse nested host-override tables in identities.toml (#1370) Identity gains an overrides map keyed by (org, repo), populated from nested [identities...] tables; org-level scalars and scalar identity fields are skipped. Tracks vergil-vm#99.

  • add compose_vm_spec five-tier overlay (#1370) ComposedSpec + compose_vm_spec overlay base -> repo [vm] -> [vm.] -> host override; packages union, scalars last-wins. The under flag measures a host override against the REPO-declared floor (tiers 3+4), not the base, so overriding below base on a repo with no [vm] is not flagged. Shared _apply_overlay helper. Tracks vergil-vm#99.

  • add reversible -- instance-name codec (#1370) instance_name/parse_instance_name use -- as the tier delimiter so identity/org/repo round-trip exactly; bare identity denotes the base box. Tracks vergil-vm#99.

  • add composed-spec fingerprint (#1370) spec_fingerprint hashes the declaration (footprint + sorted package set + provision-hook content hash, path fallback + stale_days), excluding derived under/dedicated; order-independent for packages. Drives the rebuild/drift gate. Tracks vergil-vm#99.

  • thread profile packages/hook/fingerprint into create_vm (#1370) create_vm gains packages/provision_hook/fingerprint kwargs, passed to the template via --set=.param.*; base creates (params None) emit no extra --set, keeping behaviour unchanged. Tests mock Path.home to avoid host-dir side effects. Tracks vergil-vm#99.

  • add fingerprint read + drift status (#1370) read_fingerprint reads /etc/vergil/vm-spec.fingerprint (None when absent or empty); vm_spec_status compares against the expected composed fingerprint -> ok | needs-rebuild. Tracks vergil-vm#99.

  • add _resolve_target base-vs-dedicated resolution (#1370) VergilConfig.vm surfaces the parsed [vm] stanza. _resolve_target: no workspace -> base VM; a spec'd repo -> dedicated instance with composed footprint, packages, provision hook (content-hashed into the fingerprint), and instance name. A repo without vergil.toml resolves to base. Per-command CLI positionals land with their command wiring in later tasks. Tracks vergil-vm#99.

  • build dedicated VMs from the composed spec (#1370) create/rebuild route through _resolve_target and a shared _create_from_target: dedicated boxes pass composed footprint + packages + provision hook + fingerprint; the base path is unchanged. create/rebuild accept the / positional. Tracks vergil-vm#99.

  • add session/start abort gate, tunable staleness, under-warning (#1370) session/start preflight a dedicated target: missing -> abort with create; drift -> abort with rebuild; below-declared host override -> loud warning (sovereign, not blocked). Staleness uses the composed stale_days. _workspace_org_repo keeps the 1-level/'.' session convention on base while exact org/repo drives dedicated. Tracks vergil-vm#99.

  • route stop/restart/destroy/update through the resolved instance (#1370) All lifecycle commands accept the optional / positional. _resolve_instance names the dedicated instance directly (no vergil.toml read), so an orphaned VM whose repo dropped its [vm] is still reachable by destroy. Subsumes Plan 3 Task 4. Tracks vergil-vm#99.

  • add process-tree AGENTS/HUMANS occupancy (#1370) vm_occupancy runs an in-VM classifier that walks each logind user tty/pty session's subtree for claude, counting agent vs human sessions directly (no subtraction); returns (0,0) on failure. Tracks vergil-vm#99.

  • discover dedicated VMs and orphans (#1370) discover_dedicated reconciles --* instances with spec-bearing repos under projects_dir: present / orphaned (instance without a usable spec) / not-created (spec without instance). Uses read_config's directory signature. Tracks vergil-vm#99.

  • rewrite list with footprint, occupancy, and SPEC columns (#1370) Default list view shows IDENTITY/SCOPE/STATUS/CPUS/MEM/DISK/AGENTS/HUMANS/SPEC: composed footprint, process-tree occupancy for running VMs, and SPEC states ok/NEEDS-REBUILD/not-created/orphaned plus the under flag. Shared _with_provision_hash means the drift check content-hashes the hook the same way the build did, so hooked repos do not falsely read NEEDS-REBUILD. --sessions unchanged. Tracks vergil-vm#99.