v0.2.3

.github/workflows/build-docker.yml

@@ -168,7 +168,7 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: server
-          file: server/Dockerfile.aetherlite-dev
+          file: server/Dockerfile.aetherlite
           platforms: linux/amd64,linux/arm64
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}

.github/workflows/integration.yml

@@ -95,9 +95,9 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with:
-          go-version: '1.25.12'
+          go-version: '1.25.14'
           cache-dependency-path: server/go.sum
 
       - name: Run integration tests
@@ -113,9 +113,9 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with:
-          go-version: '1.25.12'
+          go-version: '1.25.14'
           cache-dependency-path: server/go.sum
 
       # The e2e suite spawns aetherlite as a subprocess and exercises the
@@ -132,4 +132,3 @@ jobs:
         # t.Parallel tunnel tests concurrently against the shared gateway causes
         # tunnel-lifecycle races (PEER_RESET) under 2-core-runner load. Serialize.
         run: go test -tags=e2e -count=1 -p 1 -parallel 1 -timeout 360s ./internal/proxysidecar/integration_e2e/...
-

.github/workflows/proto-check.yml

@@ -28,7 +28,7 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.25.12'
+          go-version: '1.25.14'
           cache: false
 
       - name: Install protoc

.github/workflows/publish-go.yml

@@ -17,18 +17,18 @@ jobs:
     uses: ./.github/workflows/test-go.yml
 
   module-tags:
-    name: Verify Go module tags
+    name: Publish Go module tags
     runs-on: ubuntu-latest
     needs: [ tests ]
     permissions:
-      contents: read
+      contents: write
     steps:
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
           fetch-tags: true
 
-      - name: Verify per-module tags
+      - name: Reconcile per-module tags
         env:
           MODULE_DIRS: "api sdk/go server"
         run: |
@@ -42,13 +42,17 @@ jobs:
             tag="$dir/$VERSION"
             have="$(git rev-list -n1 "$tag" 2>/dev/null || true)"
             if [ -z "$have" ]; then
-              echo "::error::missing tag $tag — Go cannot resolve this module at $VERSION"
-              bad=1
+              echo "::notice::creating $tag at $sha"
+              git tag "$tag" "$sha"
+              new="$new $tag"
             elif [ "$have" != "$sha" ]; then
-              echo "::error::$tag points at $have but the release tag is $sha"
+              echo "::error::$tag exists at $have but the release tag is $sha"
               bad=1
             else
-              echo "$tag ok"
+              echo "$tag already correct"
             fi
           done
+          if [ -n "$new" ]; then
+            git push origin $new
+          fi
           [ "$bad" = 0 ]

.github/workflows/test-go.yml

@@ -33,7 +33,7 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.25.12'
+          go-version: '1.25.14'
           cache-dependency-path: api/go.sum
 
       - name: go vet
@@ -60,7 +60,7 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.25.12'
+          go-version: '1.25.14'
           cache-dependency-path: api/go.sum
 
       - name: golangci-lint
@@ -77,7 +77,7 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.25.12'
+          go-version: '1.25.14'
           cache-dependency-path: api/go.sum
 
       - name: Install govulncheck
@@ -130,7 +130,7 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.25.12'
+          go-version: '1.25.14'
           cache-dependency-path: server/go.sum
 
       - name: go vet
@@ -157,7 +157,7 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.25.12'
+          go-version: '1.25.14'
           cache-dependency-path: server/go.sum
 
       - name: golangci-lint
@@ -174,7 +174,7 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.25.12'
+          go-version: '1.25.14'
           cache-dependency-path: server/go.sum
 
       - name: Install govulncheck
@@ -227,7 +227,7 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.25.12'
+          go-version: '1.25.14'
           cache-dependency-path: sdk/go/go.sum
 
       - name: go vet
@@ -254,7 +254,7 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.25.12'
+          go-version: '1.25.14'
           cache-dependency-path: sdk/go/go.sum
 
       - name: golangci-lint
@@ -271,7 +271,7 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.25.12'
+          go-version: '1.25.14'
           cache-dependency-path: sdk/go/go.sum
 
       - name: Install govulncheck
@@ -280,11 +280,9 @@ jobs:
       - name: Run govulncheck
         working-directory: sdk/go
         env:
-          # GO-2026-4887: docker/docker <= v28.5.2; no upstream fix; see SECURITY.md
-          # GO-2026-4883: docker/docker <= v28.5.2; no upstream fix; see SECURITY.md
-          # GO-2026-5617: docker cp bind-mount redirection race; no upstream fix; see SECURITY.md
-          # GO-2026-5668: docker cp symlink-swap empty-file race; no upstream fix; see SECURITY.md
-          IGNORED_ADVISORIES: "GO-2026-4887 GO-2026-4883 GO-2026-5617 GO-2026-5668"
+          # GO-2026-4887: legacy docker client module; Engine-only advisory; see SECURITY.md
+          # GO-2026-4883: legacy docker client module; Engine-only advisory; see SECURITY.md
+          IGNORED_ADVISORIES: "GO-2026-4887 GO-2026-4883"
         run: |
           set -uo pipefail
           report="$RUNNER_TEMP/govulncheck-aether-sdk-go.json"

CLAUDE.md

@@ -84,6 +84,27 @@ toolchain), plus a virtualenv with the pinned `grpcio-tools` and
 `npm install` in `sdk/typescript`. If repo-tools runs outside that virtualenv,
 point it at the right interpreter with `--python .venv/bin/python`.
 
+### Releasing
+
+A release is one action: push the root tag. Everything else is CI.
+
+```bash
+# versions.yaml already holds the version; sync-versions keeps manifests in step
+git checkout main && git pull
+git tag v0.2.3 && git push origin v0.2.3
+```
+
+That single tag triggers `publish-python`, `publish-npm`, `publish-go` and
+`build-docker`. `publish-go` creates and pushes the `api/`, `sdk/go/` and
+`server/` tags that Go resolves nested modules by — they are the artifact of a
+release, not the trigger for one, and nothing keys off them.
+
+Push **only** the root tag. GitHub creates no push event when more than three
+tags arrive at once, so pushing the module tags yourself alongside it silently
+fires no workflows at all.
+
+There is no tag-release script any more; `publish-go` replaced it.
+
 ### Docker Build
 ```bash
 # Build context is the repo root

SECURITY.md

@@ -49,16 +49,14 @@ Out of scope:
 
 ## Known Issues
 
-The following vulnerabilities are tracked but unresolved at the time of the current release because no upstream fix is yet available. They are reachable from the published Go SDK (`github.com/scitrera/aether/sdk/go`) via the Docker-based orchestrator (`sdk/go/orchestrators/docker`):
+The following Docker Engine advisories are tracked for the published Go SDK (`github.com/scitrera/aether/sdk/go`) because it imports the legacy `github.com/docker/docker` client module. Aether uses the client packages, not the affected Engine plugin implementation, but the Go vulnerability records do not provide symbol-level data or a fixed version for this legacy module path, so `govulncheck` conservatively reports them as reachable:
 
 | Advisory | Affected | Status |
 |---|---|---|
-| [GO-2026-4887](https://pkg.go.dev/vuln/GO-2026-4887) | `github.com/docker/docker` ≤ v28.5.2 | No upstream fix released. Tracking. |
-| [GO-2026-4883](https://pkg.go.dev/vuln/GO-2026-4883) | `github.com/docker/docker` ≤ v28.5.2 | No upstream fix released. Tracking. |
-| [GO-2026-5617](https://pkg.go.dev/vuln/GO-2026-5617) | `github.com/docker/docker` ≤ v28.5.2 | `docker cp` bind-mount redirection race. No upstream fix released. Tracking. |
-| [GO-2026-5668](https://pkg.go.dev/vuln/GO-2026-5668) | `github.com/docker/docker` ≤ v28.5.2 | `docker cp` symlink-swap arbitrary-empty-file race. No upstream fix released. Tracking. |
+| [GO-2026-4887](https://pkg.go.dev/vuln/GO-2026-4887) | Docker Engine < 29.3.1; legacy Go module has no fixed release | Engine AuthZ-plugin bypass; Aether imports only the Docker API client. Tracking migration to `github.com/moby/moby/client`. |
+| [GO-2026-4883](https://pkg.go.dev/vuln/GO-2026-4883) | Docker Engine < 29.3.1; legacy Go module has no fixed release | Engine plugin privilege-validation issue; Aether imports only the Docker API client. Tracking migration to `github.com/moby/moby/client`. |
 
-Mitigation: callers that don't need the Docker orchestrator can build their applications without importing `sdk/go/orchestrators/docker`. We will bump the dependency immediately when upstream ships fixed releases.
+Mitigation: callers that don't need the Docker orchestrator can build their applications without importing `sdk/go/orchestrators/docker`. We will migrate to the separately versioned Moby client module once compatibility is validated.
 
 ## Security Best Practices
 

api/go.mod

@@ -1,15 +1,15 @@
 module github.com/scitrera/aether/api
 
-go 1.25.12
+go 1.25.14
 
 require (
-	google.golang.org/grpc v1.81.1
+	google.golang.org/grpc v1.82.1
 	google.golang.org/protobuf v1.36.11
 )
 
 require (
-	golang.org/x/net v0.54.0 // indirect
-	golang.org/x/sys v0.44.0 // indirect
+	golang.org/x/net v0.55.0 // indirect
+	golang.org/x/sys v0.45.0 // indirect
 	golang.org/x/text v0.37.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
 )

api/go.sum

@@ -22,17 +22,17 @@ go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfC
 go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
 go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
 go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
-golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
-golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
-golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
-golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
+golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
 golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 h1:ggcbiqK8WWh6l1dnltU4BgWGIGo+EVYxCaAPih/zQXQ=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ=
-google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 h1:RmoJA1ujG+/lRGNfUnOMfhCy5EipVMyvUE+KNbPbTlw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
+google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=