chore(release): prepare v0.1.0-alpha.3

CHANGELOG.md

@@ -6,6 +6,43 @@ All notable changes are recorded here. The format follows
 
 ## [Unreleased] — on `pre-release`
 
+## [0.1.0-alpha.3] — 2026-11-10
+
+Third alpha, published as a GitHub pre-release. Not for production. It is
+mostly a correctness release: a review of the code found ten defects in
+placement, the scheduler, the reconciler and the clients, and each is fixed
+with a test that fails on the old behaviour. The default build is cut to the
+adapters that have run against real backends, and the release workflow now
+runs the checks before it publishes.
+
+What has not run for this release: the end-to-end suite and the live adapter
+tests. They last ran on the code before these changes (see `Verified` under
+0.1.0-alpha.2 and the sections below). The fixes are covered by in-process
+tests and, for the store, by the Postgres conformance job in CI.
+
+Upgrading from 0.1.0-alpha.2:
+
+- A config file or API call that names one of the 13 experimental adapter
+  kinds is refused by the published image (first section below).
+- A client that lists sandboxes by status needs to add `pausing`.
+- `PATCH /v1/sandboxes/{id}` with `ttlSeconds: 0` answers 400; use `DELETE`.
+
+### Documentation and CI
+
+- The SDK READMEs install the SDKs from this repository. Neither is
+  published: `pip install differently` installs an unrelated project of that
+  name, and `npm install @differently/sdk` finds nothing. Their method
+  tables no longer list `admin.agents.list`, which does not exist.
+- `make vet` and CI compile and vet the end-to-end and live test files
+  (`-tags "e2e live"`), which no job runs, so they cannot stop compiling
+  unnoticed.
+- The release workflow runs gofmt, vet, the Go tests (default and
+  experimental builds) and the Helm lint before it publishes binaries, the
+  chart or images.
+- The chart's `appVersion` names this release, so installing the chart from
+  a checkout pulls an image that exists. It used to name `0.1.0`, which was
+  never published; the air-gapped and day-2 guides named the same tag.
+
 ### Changed (breaking): the default build holds only the verified adapters
 
 The published image, the release binaries and `make build` now contain the
@@ -549,6 +586,7 @@ OpenSandbox server on its Docker runtime.
     beyond unit and in-process API tests: no live provider account, real
     cluster or multi-replica run yet.
 
-[Unreleased]: https://github.com/different-ai/differently/compare/v0.1.0-alpha.2...pre-release
+[Unreleased]: https://github.com/different-ai/differently/compare/v0.1.0-alpha.3...pre-release
+[0.1.0-alpha.3]: https://github.com/different-ai/differently/releases/tag/v0.1.0-alpha.3
 [0.1.0-alpha.2]: https://github.com/different-ai/differently/releases/tag/v0.1.0-alpha.2
 [0.1.0-alpha.1]: https://github.com/different-ai/differently/releases/tag/v0.1.0-alpha.1

README.md

@@ -45,7 +45,7 @@ Apache-2.0, fully self-hosted, no telemetry. Built by the
   <br><sub>▶ <a href="https://different-ai.github.io/differently/#video">Watch the 36-second intro</a></sub>
 </p>
 
-> **Pre-release ([`v0.1.0-alpha.2`](https://github.com/different-ai/differently/releases)).**
+> **Pre-release ([`v0.1.0-alpha.3`](https://github.com/different-ai/differently/releases)).**
 > The whole platform is implemented and tested end to end against real
 > OpenSandbox servers (Docker, Kubernetes and Fast Sandbox microVM
 > runtimes). It isn't ready for production workloads yet: see

deploy/helm/differently/Chart.yaml

@@ -6,7 +6,7 @@ description: >-
   OpenSandbox server, installed separately, as its default private pool.
 type: application
 version: 0.3.0
-appVersion: "0.1.0"
+appVersion: "0.1.0-alpha.3"
 kubeVersion: ">=1.29.0-0"
 home: https://github.com/different-ai/differently
 sources:

docs/deploy/air-gapped.md

@@ -22,8 +22,8 @@ network, is for its documentation to answer; it has not been checked here.
 
 | Image | Needed for |
 |---|---|
-| `ghcr.io/different-ai/differently-server:0.1.0` | Control plane, migrations, preflight |
-| `ghcr.io/different-ai/differently-cli:0.1.0` | `helm test` only |
+| `ghcr.io/different-ai/differently-server:0.1.0-alpha.3` | Control plane, migrations, preflight |
+| `ghcr.io/different-ai/differently-cli:0.1.0-alpha.3` | `helm test` only |
 | `docker.io/library/postgres:17` | Only with the evaluation-only `postgresql.embedded` |
 | `docker.io/library/busybox:1.37` | Only for the `kubectl debug` checks in these guides |
 | OpenSandbox's server, `execd` and other component images | Your OpenSandbox installation; see step 3 |
@@ -35,9 +35,9 @@ Copy by digest so the internal tags point at exactly what you reviewed. Use
 ```sh
 REG=registry.internal.example.com
 for img in differently-server differently-cli; do
-  skopeo copy --all docker://ghcr.io/different-ai/$img:0.1.0 docker://$REG/different-ai/$img:0.1.0
+  skopeo copy --all docker://ghcr.io/different-ai/$img:0.1.0-alpha.3 docker://$REG/different-ai/$img:0.1.0-alpha.3
 done
-skopeo inspect docker://$REG/different-ai/differently-server:0.1.0 | jq -r .Digest
+skopeo inspect docker://$REG/different-ai/differently-server:0.1.0-alpha.3 | jq -r .Digest
 ```
 
 `global.imageRegistry` replaces only the registry part of each image, so keep
@@ -48,9 +48,9 @@ production.
 ## 2. Mirror the chart
 
 ```sh
-helm package deploy/helm/differently                 # differently-0.2.0.tgz
-helm push differently-0.2.0.tgz oci://$REG/charts    # or copy the .tgz across the gap
-helm show chart oci://$REG/charts/differently --version 0.2.0
+helm package deploy/helm/differently                 # differently-0.3.0.tgz
+helm push differently-0.3.0.tgz oci://$REG/charts    # or copy the .tgz across the gap
+helm show chart oci://$REG/charts/differently --version 0.3.0
 ```
 
 ## 3. Mirror and configure OpenSandbox
@@ -102,7 +102,7 @@ networkPolicy:
 ```
 
 ```sh
-helm install dly oci://$REG/charts/differently --version 0.2.0 -n differently -f values-airgap.yaml
+helm install dly oci://$REG/charts/differently --version 0.3.0 -n differently -f values-airgap.yaml
 ```
 
 With providers disabled, the server NetworkPolicy has no TCP 443 egress rule;

docs/deploy/day-2.md

@@ -164,7 +164,7 @@ spec:
       securityContext: {runAsNonRoot: true, runAsUser: 65532, seccompProfile: {type: RuntimeDefault}}
       containers:
         - name: migrate
-          image: ghcr.io/different-ai/differently-server:0.1.0
+          image: ghcr.io/different-ai/differently-server:0.1.0-alpha.3
           args: ["migrate", "--config", "/etc/differently/config.yaml"]
           env:
             - name: DIFFERENTLY_DATABASE_URL

docs/deploy/kubernetes.md

@@ -9,7 +9,7 @@ Cloud-specific notes are in [aws.md](aws.md), [gcp.md](gcp.md) and
 [bare-metal.md](bare-metal.md).
 
 Status: **documented**. These steps have not been run on a real cluster or
-against a live OpenSandbox server. The chart (version 0.2.0) passes `helm lint`
+against a live OpenSandbox server. The chart (version 0.3.0) passes `helm lint`
 and `helm template` locally for the value sets in `deploy/helm/differently/ci/`.
 
 The examples use namespace `differently`, release `dly` and the chart from

docs/deploy/single-vm.md

@@ -10,7 +10,7 @@ command that creates the VM differs.
 > OpenSandbox 1.2.0 and Differently `v0.1.0-alpha.1`. A sandbox ran within
 > about 2 s, and the end-to-end suite passed 12/12 against this setup; with
 > a snapshot registry, the ingress gateway and egress policy added
-> (2026-10-29), it passed 14/14. The commands below install `v0.1.0-alpha.2`,
+> (2026-10-29), it passed 14/14. The commands below install `v0.1.0-alpha.3`,
 > which has not itself been installed on this setup yet. The AWS, Google
 > Cloud and bare-metal commands are the equivalent steps, not yet run there.
 
@@ -156,7 +156,7 @@ Use the chart and images from the
 [latest release](https://github.com/different-ai/differently/releases):
 
 ```bash
-VERSION=0.1.0-alpha.2
+VERSION=0.1.0-alpha.3
 curl -fsSLO https://github.com/different-ai/differently/releases/download/v$VERSION/differently-$VERSION.tgz
 
 kubectl create namespace differently
@@ -201,7 +201,7 @@ kubectl -n differently port-forward svc/differently-server 8080:8080 &
 ```
 
 From your laptop, tunnel to it (`ssh -L 8080:localhost:8080 <vm>`) and use
-the CLI from the same release (`differently_v0.1.0-alpha.2_<os>_<arch>.tar.gz`):
+the CLI from the same release (`differently_v0.1.0-alpha.3_<os>_<arch>.tar.gz`):
 
 ```bash
 export DIFFERENTLY_URL=http://localhost:8080 DIFFERENTLY_API_KEY="$(cat operator-token)"

docs/maintaining.md

@@ -209,8 +209,10 @@ What the releases so far have shown:
   (`git tag -s vX.Y.Z-alpha.N -m vX.Y.Z-alpha.N <merge commit>`); the release
   workflow takes every version from the tag. `checksums.txt` covers the
   binary archives, not the chart.
-- A release prep PR changes the CHANGELOG and the version strings in the
-  docs and on the website (`site/src/pages/index.astro`). Merge it and push
+- A release prep PR changes the CHANGELOG, the chart's `appVersion`
+  (`deploy/helm/differently/Chart.yaml`, the image tag a checkout install
+  pulls) and the version strings in the docs and on the website
+  (`site/src/pages/index.astro`). Merge it and push
   the tag one after the other, so the website never names a release that
   is not published yet.
 - `main` follows `pre-release` through a PR titled

site/src/pages/index.astro

@@ -5,7 +5,7 @@ import { Code } from 'astro:components';
 const base = import.meta.env.BASE_URL.replace(/\/$/, '');
 const repo = 'https://github.com/different-ai/differently';
 const releases = `${repo}/releases`;
-const version = 'v0.1.0-alpha.2';
+const version = 'v0.1.0-alpha.3';
 
 // Launch video slot. Set videoSrc to a video URL (and optionally a poster image and a
 // WebVTT captions file) to show it under the hero. While videoSrc is '' nothing renders.