From a5e7f3f35cc081f1af188ed51fa2b5cbc9a7d6a8 Mon Sep 17 00:00:00 2001
From: Ant Somers <antsomers@gmail.com>
Date: Wed, 14 Oct 2026 17:48:32 +0300
Subject: [PATCH 1/3] chore: pin decdn to v0.1.0

Move every decdn/decdn pin from v0.0.4 to v0.1.0 (538bf319631cb37854819e43998e4a73da06fd5c):
the role default, the onramp's installer pin, the Compose image digest, the
chart's appVersion and Artifact Hub image, the inventory and cloud-init
examples, AGENTS.md's pinned version and the generated mirrors. The PR body
lists anything left.
---
 AGENTS.md                                                   | 2 +-
 ansible/inventory/group_vars/sponsord_onramp_hosts.yml      | 2 +-
 ansible/inventory/host_vars/decdn-node-1/main.yml           | 4 ++--
 ansible/inventory/host_vars/origin-1/main.yml               | 4 ++--
 ansible/molecule/validation-sponsord/converge.yml           | 2 +-
 ansible/roles/decdn_node/defaults/main.yml                  | 2 +-
 ansible/roles/decdn_node/vars/main/networks.yml             | 2 +-
 ansible/roles/sponsord/vars/main/networks.yml               | 2 +-
 ansible/roles/sponsord_onramp/defaults/main.yml             | 6 +++---
 ansible/roles/sponsord_onramp/vars/main/networks.yml        | 2 +-
 charts/decdn-node/Chart.yaml                                | 4 ++--
 charts/decdn-node/values.yaml                               | 4 ++--
 cloud-init/user-data-publisher.yaml                         | 2 +-
 compose/.env.example                                        | 4 ++--
 compose/sponsord-onramp.env.example                         | 6 +++---
 .../inventory/group_vars/sponsord_onramp_hosts.yml          | 2 +-
 .../inventory/host_vars/decdn-node-1/main.yml               | 4 ++--
 .../collection-fleet/inventory/host_vars/origin-1/main.yml  | 4 ++--
 18 files changed, 29 insertions(+), 29 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 20edca2..2b7af91 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -142,7 +142,7 @@ test-scripts` fails while the committed file differs from a fresh render, and `m
 lint-alloy` validates and runs it.
 
 **Pinned upstream releases.** One decdn/decdn release (`decdn_node_version`, today
-`0.0.4`) and one decdn/sponsord release (`sponsord_version` = `sponsord_onramp_version`,
+`0.1.0`) and one decdn/sponsord release (`sponsord_version` = `sponsord_onramp_version`,
 today `0.0.4`; decdn/sponsord tags its whole workspace `vX.Y.Z`, there are no per-crate
 tags) are pinned across every path: the role defaults, the onramp's installer pin
 (`sponsord_onramp_decdn_release` + `_decdn_sums_sha256`, copied into
diff --git a/ansible/inventory/group_vars/sponsord_onramp_hosts.yml b/ansible/inventory/group_vars/sponsord_onramp_hosts.yml
index fab1c96..e101132 100644
--- a/ansible/inventory/group_vars/sponsord_onramp_hosts.yml
+++ b/ansible/inventory/group_vars/sponsord_onramp_hosts.yml
@@ -35,6 +35,6 @@
 # The decdn release the installers install defaults to the role's pin (decdn/decdn
 # v<decdn_node_version>), with the SHA-256 of its SHA256SUMS. To serve another,
 # set both:
-# sponsord_onramp_decdn_release: v0.0.4
+# sponsord_onramp_decdn_release: v0.1.0
 # sponsord_onramp_decdn_sums_sha256: "…"
 # CapacityBond and SlashJudge come from sponsord_network (group_vars/sponsord_hosts.yml).
diff --git a/ansible/inventory/host_vars/decdn-node-1/main.yml b/ansible/inventory/host_vars/decdn-node-1/main.yml
index fa4838e..c1739ac 100644
--- a/ansible/inventory/host_vars/decdn-node-1/main.yml
+++ b/ansible/inventory/host_vars/decdn-node-1/main.yml
@@ -23,13 +23,13 @@
 # the GPG-signed SHA256SUMS manifest. The version defaults to the decdn/decdn release
 # the role pins; set it only to hold a node on another one.
 decdn_node_install_method: release
-# decdn_node_version: "0.0.4"
+# decdn_node_version: "0.1.0"
 #
 # Alternative: build on the node from a git ref (any tag, branch or SHA), as an
 # unprivileged build user with a pinned toolchain (decdn_node_version is not checked
 # in this mode):
 #     decdn_node_install_method: source
-#     decdn_node_source_ref: v0.0.4
+#     decdn_node_source_ref: v0.1.0
 # Alternative: copy binaries built on this control machine
 # (`cargo build --release -p decdn-node -p decdn-cli` in a decdn/decdn checkout):
 #     decdn_node_install_method: manual
diff --git a/ansible/inventory/host_vars/origin-1/main.yml b/ansible/inventory/host_vars/origin-1/main.yml
index 05bbbf5..01cae67 100644
--- a/ansible/inventory/host_vars/origin-1/main.yml
+++ b/ansible/inventory/host_vars/origin-1/main.yml
@@ -25,13 +25,13 @@
 # the GPG-signed SHA256SUMS manifest. The version defaults to the decdn/decdn release
 # the role pins; set it only to hold a node on another one.
 decdn_node_install_method: release
-# decdn_node_version: "0.0.4"
+# decdn_node_version: "0.1.0"
 #
 # Alternative: build on the node from a git ref (any tag, branch or SHA), as an
 # unprivileged build user with a pinned toolchain (decdn_node_version is not checked
 # in this mode):
 #     decdn_node_install_method: source
-#     decdn_node_source_ref: v0.0.4
+#     decdn_node_source_ref: v0.1.0
 # Alternative: copy binaries built on this control machine
 # (`cargo build --release -p decdn-node -p decdn-cli` in a decdn/decdn checkout):
 #     decdn_node_install_method: manual
diff --git a/ansible/molecule/validation-sponsord/converge.yml b/ansible/molecule/validation-sponsord/converge.yml
index fcf77a9..7474dfb 100644
--- a/ansible/molecule/validation-sponsord/converge.yml
+++ b/ansible/molecule/validation-sponsord/converge.yml
@@ -948,7 +948,7 @@
           ansible.builtin.include_role:
             name: sponsord_onramp
           vars:
-            sponsord_onramp_decdn_sums_sha256: bc295285109e2189331e57d9cb51d214113cba332bd08a2777866a7a1cec2951
+            sponsord_onramp_decdn_sums_sha256: c88ad5479f31bb0857db2c0205c54b240cbceb33a96724e4f8a288b6d866ab66
       rescue:
         - name: Record onramp-pin-pair rejection (only if its assert failed)
           ansible.builtin.set_fact:
diff --git a/ansible/roles/decdn_node/defaults/main.yml b/ansible/roles/decdn_node/defaults/main.yml
index a17a53e..55e215d 100644
--- a/ansible/roles/decdn_node/defaults/main.yml
+++ b/ansible/roles/decdn_node/defaults/main.yml
@@ -61,7 +61,7 @@ decdn_rustup_sha256:
 # also moves the generated mirrors, the onramp's decdn pin (role default and
 # compose/sponsord-onramp.env.example), the Compose image digest and the chart's
 # appVersion (README.md, "Bumping the decdn release").
-decdn_node_version: "0.0.4"       # asserted non-empty in "release" mode
+decdn_node_version: "0.1.0"       # asserted non-empty in "release" mode
 # Release target triple. Derived from the host's gathered architecture (x86_64 or
 # aarch64, see vars/main/arch.yml), so arm64 hosts (Graviton, Ampere, Hetzner CAX)
 # get the aarch64 tarball with no inventory change. Needs facts: a play with
diff --git a/ansible/roles/decdn_node/vars/main/networks.yml b/ansible/roles/decdn_node/vars/main/networks.yml
index af7fbfa..49a770a 100644
--- a/ansible/roles/decdn_node/vars/main/networks.yml
+++ b/ansible/roles/decdn_node/vars/main/networks.yml
@@ -1,6 +1,6 @@
 ---
 # GENERATED by scripts/sync-network-profiles.py -- do not hand-edit.
-# Source: decdn/decdn @ 2a75f663ebd5fcb87ada4c024918a0b94bc5524d
+# Source: decdn/decdn @ 538bf319631cb37854819e43998e4a73da06fd5c
 #   crates/cli/src/known_chains.rs (KNOWN_CHAINS, KnownChain::addresses)
 #   + contracts/deployments/<chainId>.json
 #
diff --git a/ansible/roles/sponsord/vars/main/networks.yml b/ansible/roles/sponsord/vars/main/networks.yml
index 35fcf7c..b0a0405 100644
--- a/ansible/roles/sponsord/vars/main/networks.yml
+++ b/ansible/roles/sponsord/vars/main/networks.yml
@@ -1,6 +1,6 @@
 ---
 # GENERATED by scripts/sync-network-profiles.py -- do not hand-edit.
-# Source: decdn/decdn @ 2a75f663ebd5fcb87ada4c024918a0b94bc5524d
+# Source: decdn/decdn @ 538bf319631cb37854819e43998e4a73da06fd5c
 #   crates/cli/src/known_chains.rs (KNOWN_CHAINS, KnownChain::addresses)
 #   + contracts/deployments/<chainId>.json
 #
diff --git a/ansible/roles/sponsord_onramp/defaults/main.yml b/ansible/roles/sponsord_onramp/defaults/main.yml
index 6ea2caa..37e8615 100644
--- a/ansible/roles/sponsord_onramp/defaults/main.yml
+++ b/ansible/roles/sponsord_onramp/defaults/main.yml
@@ -138,10 +138,10 @@ sponsord_onramp_gate_template_src: ""
 # --- Release the installers install --------------------------------------------
 # The decdn/decdn release the installers download `decdn` from: a tag and the
 # SHA-256 of that release's SHA256SUMS file (`sha256sum SHA256SUMS` after
-# verifying its .asc). Default: decdn/decdn v0.0.4. Override the tag together with
+# verifying its .asc). Default: decdn/decdn v0.1.0. Override the tag together with
 # its digest: preflight refuses a pair where only one half moved.
-sponsord_onramp_decdn_release: v0.0.4     # decdn/decdn tag
-sponsord_onramp_decdn_sums_sha256: bc295285109e2189331e57d9cb51d214113cba332bd08a2777866a7a1cec2951
+sponsord_onramp_decdn_release: v0.1.0     # decdn/decdn tag
+sponsord_onramp_decdn_sums_sha256: c88ad5479f31bb0857db2c0205c54b240cbceb33a96724e4f8a288b6d866ab66
 sponsord_onramp_releases_base: ""         # [https://github.com/decdn]
 
 # --- Limits ("" = the onramp's own default, shown in brackets) -----------------
diff --git a/ansible/roles/sponsord_onramp/vars/main/networks.yml b/ansible/roles/sponsord_onramp/vars/main/networks.yml
index 816bd85..63f107b 100644
--- a/ansible/roles/sponsord_onramp/vars/main/networks.yml
+++ b/ansible/roles/sponsord_onramp/vars/main/networks.yml
@@ -1,6 +1,6 @@
 ---
 # GENERATED by scripts/sync-network-profiles.py -- do not hand-edit.
-# Source: decdn/decdn @ 2a75f663ebd5fcb87ada4c024918a0b94bc5524d
+# Source: decdn/decdn @ 538bf319631cb37854819e43998e4a73da06fd5c
 #   crates/cli/src/known_chains.rs (KNOWN_CHAINS, KnownChain::addresses)
 #   + contracts/deployments/<chainId>.json
 #
diff --git a/charts/decdn-node/Chart.yaml b/charts/decdn-node/Chart.yaml
index 0146d3e..5c99e5e 100644
--- a/charts/decdn-node/Chart.yaml
+++ b/charts/decdn-node/Chart.yaml
@@ -13,7 +13,7 @@ version: 0.1.3
 # image tag used when neither image.tag nor image.digest is set. Keep it equal to
 # the decdn_node role's decdn_node_version, and the tag of the one image in the
 # artifacthub.io/images annotation below (make test-scripts checks both).
-appVersion: "0.0.4"
+appVersion: "0.1.0"
 kubeVersion: ">=1.25.0-0"
 home: https://decdn.org
 icon: https://decdn.org/icon.svg
@@ -37,7 +37,7 @@ annotations:
   artifacthub.io/license: MIT
   artifacthub.io/images: |
     - name: decdn-node
-      image: ghcr.io/decdn/decdn-node:0.0.4
+      image: ghcr.io/decdn/decdn-node:0.1.0
   artifacthub.io/links: |
     - name: Chart source
       url: https://github.com/decdn/devops/tree/main/charts/decdn-node
diff --git a/charts/decdn-node/values.yaml b/charts/decdn-node/values.yaml
index 8713b14..e5928bc 100644
--- a/charts/decdn-node/values.yaml
+++ b/charts/decdn-node/values.yaml
@@ -13,8 +13,8 @@ image:
   tag: ""
   # sha256:... — takes precedence over tag when set. Prefer it: a tag can be moved.
   # Take it from the release's signed decdn-node-image-digest.txt (v0.0.1:
-  # image-digest.txt), e.g. for v0.0.4
-  # sha256:7c303b6105a1b419c0f7e3ef57d8ad3ba23d07cccba0d42332699fd409133f0a
+  # image-digest.txt), e.g. for v0.1.0
+  # sha256:848532722735b4a115aca9606230d951c25f2dab06a7345305ecf67c7a0244b5
   digest: ""
   pullPolicy: IfNotPresent
 
diff --git a/cloud-init/user-data-publisher.yaml b/cloud-init/user-data-publisher.yaml
index 4176beb..3c0aea9 100644
--- a/cloud-init/user-data-publisher.yaml
+++ b/cloud-init/user-data-publisher.yaml
@@ -140,7 +140,7 @@ write_files:
           # DEVOPS_REF (sponsord_onramp_decdn_release, with the SHA-256 of that release's
           # SHA256SUMS: take `sha256sum SHA256SUMS` once its SHA256SUMS.asc verifies).
           # Override both together, e.g.:
-          # sponsord_onramp_decdn_release: "v0.0.4"
+          # sponsord_onramp_decdn_release: "v0.1.0"
           # sponsord_onramp_decdn_sums_sha256: "<64 lowercase hex>"
 
   # What an interactive login prints while the bootstrap is unfinished. It is written
diff --git a/compose/.env.example b/compose/.env.example
index bca4c88..a4ed905 100644
--- a/compose/.env.example
+++ b/compose/.env.example
@@ -28,8 +28,8 @@ COMPOSE_PROFILES=node
 # releases the Ansible roles pin (README.md, the node's "Operate").
 
 # --- node -----------------------------------------------------------------------
-# decdn/decdn v0.0.4
-DECDN_IMAGE_DIGEST=sha256:7c303b6105a1b419c0f7e3ef57d8ad3ba23d07cccba0d42332699fd409133f0a
+# decdn/decdn v0.1.0
+DECDN_IMAGE_DIGEST=sha256:848532722735b4a115aca9606230d951c25f2dab06a7345305ecf67c7a0244b5
 # DECDN_IMAGE_REPO=ghcr.io/decdn/decdn-node
 
 # uid/gid of the host's dedicated `decdn` system account, which owns /var/lib/decdn
diff --git a/compose/sponsord-onramp.env.example b/compose/sponsord-onramp.env.example
index c8f63e7..5503ace 100644
--- a/compose/sponsord-onramp.env.example
+++ b/compose/sponsord-onramp.env.example
@@ -20,9 +20,9 @@ ONRAMP_GATE=turnstile
 ONRAMP_TURNSTILE_SITEKEY=
 # The decdn release the installers install: a decdn/decdn vX.Y.Z tag and the
 # SHA-256 of that release's SHA256SUMS file (`sha256sum SHA256SUMS` once its .asc
-# verifies). This is the pin the Ansible role defaults to: decdn/decdn v0.0.4.
-ONRAMP_DECDN_RELEASE=v0.0.4
-ONRAMP_DECDN_SUMS_SHA256=bc295285109e2189331e57d9cb51d214113cba332bd08a2777866a7a1cec2951
+# verifies). This is the pin the Ansible role defaults to: decdn/decdn v0.1.0.
+ONRAMP_DECDN_RELEASE=v0.1.0
+ONRAMP_DECDN_SUMS_SHA256=c88ad5479f31bb0857db2c0205c54b240cbceb33a96724e4f8a288b6d866ab66
 
 # --- Client address ---------------------------------------------------------------
 # The header the proxy puts the client address in; the onramp rate limits by it.
diff --git a/examples/collection-fleet/inventory/group_vars/sponsord_onramp_hosts.yml b/examples/collection-fleet/inventory/group_vars/sponsord_onramp_hosts.yml
index fab1c96..e101132 100644
--- a/examples/collection-fleet/inventory/group_vars/sponsord_onramp_hosts.yml
+++ b/examples/collection-fleet/inventory/group_vars/sponsord_onramp_hosts.yml
@@ -35,6 +35,6 @@
 # The decdn release the installers install defaults to the role's pin (decdn/decdn
 # v<decdn_node_version>), with the SHA-256 of its SHA256SUMS. To serve another,
 # set both:
-# sponsord_onramp_decdn_release: v0.0.4
+# sponsord_onramp_decdn_release: v0.1.0
 # sponsord_onramp_decdn_sums_sha256: "…"
 # CapacityBond and SlashJudge come from sponsord_network (group_vars/sponsord_hosts.yml).
diff --git a/examples/collection-fleet/inventory/host_vars/decdn-node-1/main.yml b/examples/collection-fleet/inventory/host_vars/decdn-node-1/main.yml
index fa4838e..c1739ac 100644
--- a/examples/collection-fleet/inventory/host_vars/decdn-node-1/main.yml
+++ b/examples/collection-fleet/inventory/host_vars/decdn-node-1/main.yml
@@ -23,13 +23,13 @@
 # the GPG-signed SHA256SUMS manifest. The version defaults to the decdn/decdn release
 # the role pins; set it only to hold a node on another one.
 decdn_node_install_method: release
-# decdn_node_version: "0.0.4"
+# decdn_node_version: "0.1.0"
 #
 # Alternative: build on the node from a git ref (any tag, branch or SHA), as an
 # unprivileged build user with a pinned toolchain (decdn_node_version is not checked
 # in this mode):
 #     decdn_node_install_method: source
-#     decdn_node_source_ref: v0.0.4
+#     decdn_node_source_ref: v0.1.0
 # Alternative: copy binaries built on this control machine
 # (`cargo build --release -p decdn-node -p decdn-cli` in a decdn/decdn checkout):
 #     decdn_node_install_method: manual
diff --git a/examples/collection-fleet/inventory/host_vars/origin-1/main.yml b/examples/collection-fleet/inventory/host_vars/origin-1/main.yml
index 05bbbf5..01cae67 100644
--- a/examples/collection-fleet/inventory/host_vars/origin-1/main.yml
+++ b/examples/collection-fleet/inventory/host_vars/origin-1/main.yml
@@ -25,13 +25,13 @@
 # the GPG-signed SHA256SUMS manifest. The version defaults to the decdn/decdn release
 # the role pins; set it only to hold a node on another one.
 decdn_node_install_method: release
-# decdn_node_version: "0.0.4"
+# decdn_node_version: "0.1.0"
 #
 # Alternative: build on the node from a git ref (any tag, branch or SHA), as an
 # unprivileged build user with a pinned toolchain (decdn_node_version is not checked
 # in this mode):
 #     decdn_node_install_method: source
-#     decdn_node_source_ref: v0.0.4
+#     decdn_node_source_ref: v0.1.0
 # Alternative: copy binaries built on this control machine
 # (`cargo build --release -p decdn-node -p decdn-cli` in a decdn/decdn checkout):
 #     decdn_node_install_method: manual

From 8e38770440fea20a1856c4b37ac9c6dcc456e41d Mon Sep 17 00:00:00 2001
From: Ant Somers <ant@decdn.org>
Date: Wed, 14 Oct 2026 20:04:59 +0300
Subject: [PATCH 2/3] test(molecule): move the onramp's explicit decdn pin
 fixture off v0.1.0

v0.1.0 is now the role default, so the fixture's dummy digest tripped the
tag-and-digest-move-together guard. v9.9.9 stays clear of any real default.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 ansible/molecule/sponsord-onramp-caddy/molecule.yml     | 2 +-
 ansible/molecule/sponsord-onramp-lifecycle/molecule.yml | 2 +-
 ansible/molecule/sponsord-onramp-source/molecule.yml    | 2 +-
 ansible/molecule/sponsord-onramp/molecule.yml           | 2 +-
 ansible/molecule/validation-sponsord/converge.yml       | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/ansible/molecule/sponsord-onramp-caddy/molecule.yml b/ansible/molecule/sponsord-onramp-caddy/molecule.yml
index 3f37031..51a9e69 100644
--- a/ansible/molecule/sponsord-onramp-caddy/molecule.yml
+++ b/ansible/molecule/sponsord-onramp-caddy/molecule.yml
@@ -87,7 +87,7 @@ provisioner:
         # Must equal EXPECTED_BRAND in ../sponsord-onramp/files/sponsord-onramp-stub:
         # quotes and a dollar sign prove the env file's quoting ($$ is molecule's escape).
         sponsord_onramp_brand_name: 'deCDN "molecule" $$HOME'
-        sponsord_onramp_decdn_release: v0.1.0
+        sponsord_onramp_decdn_release: v9.9.9
         sponsord_onramp_decdn_sums_sha256: "1111111111111111111111111111111111111111111111111111111111111111"
         sponsord_onramp_fund_rate_per_min: 0
         sponsord_onramp_readiness_retries: 10
diff --git a/ansible/molecule/sponsord-onramp-lifecycle/molecule.yml b/ansible/molecule/sponsord-onramp-lifecycle/molecule.yml
index 34668d0..64a15af 100644
--- a/ansible/molecule/sponsord-onramp-lifecycle/molecule.yml
+++ b/ansible/molecule/sponsord-onramp-lifecycle/molecule.yml
@@ -77,7 +77,7 @@ provisioner:
         # Must equal EXPECTED_BRAND in ../sponsord-onramp/files/sponsord-onramp-stub:
         # quotes and a dollar sign prove the env file's quoting ($$ is molecule's escape).
         sponsord_onramp_brand_name: 'deCDN "molecule" $$HOME'
-        sponsord_onramp_decdn_release: v0.1.0
+        sponsord_onramp_decdn_release: v9.9.9
         sponsord_onramp_decdn_sums_sha256: "1111111111111111111111111111111111111111111111111111111111111111"
         sponsord_onramp_fund_rate_per_min: 0
         sponsord_onramp_readiness_retries: 10
diff --git a/ansible/molecule/sponsord-onramp-source/molecule.yml b/ansible/molecule/sponsord-onramp-source/molecule.yml
index 07ba670..a81a361 100644
--- a/ansible/molecule/sponsord-onramp-source/molecule.yml
+++ b/ansible/molecule/sponsord-onramp-source/molecule.yml
@@ -86,7 +86,7 @@ provisioner:
         # Must equal EXPECTED_BRAND in ../sponsord-onramp/files/sponsord-onramp-stub:
         # quotes and a dollar sign prove the env file's quoting ($$ is molecule's escape).
         sponsord_onramp_brand_name: 'deCDN "molecule" $$HOME'
-        sponsord_onramp_decdn_release: v0.1.0
+        sponsord_onramp_decdn_release: v9.9.9
         sponsord_onramp_decdn_sums_sha256: "1111111111111111111111111111111111111111111111111111111111111111"
         sponsord_onramp_fund_rate_per_min: 0
         sponsord_onramp_readiness_retries: 10
diff --git a/ansible/molecule/sponsord-onramp/molecule.yml b/ansible/molecule/sponsord-onramp/molecule.yml
index fcc545f..6233856 100644
--- a/ansible/molecule/sponsord-onramp/molecule.yml
+++ b/ansible/molecule/sponsord-onramp/molecule.yml
@@ -99,7 +99,7 @@ provisioner:
         # Must equal EXPECTED_BRAND in files/sponsord-onramp-stub: quotes and a
         # dollar sign prove the env file's quoting ($$ is molecule's escape).
         sponsord_onramp_brand_name: 'deCDN "molecule" $$HOME'
-        sponsord_onramp_decdn_release: v0.1.0
+        sponsord_onramp_decdn_release: v9.9.9
         sponsord_onramp_decdn_sums_sha256: "1111111111111111111111111111111111111111111111111111111111111111"
         sponsord_onramp_fund_rate_per_min: 0
         sponsord_onramp_readiness_retries: 10
diff --git a/ansible/molecule/validation-sponsord/converge.yml b/ansible/molecule/validation-sponsord/converge.yml
index 7474dfb..0d36d5d 100644
--- a/ansible/molecule/validation-sponsord/converge.yml
+++ b/ansible/molecule/validation-sponsord/converge.yml
@@ -693,7 +693,7 @@
     sponsord_onramp_rpc_url: https://sepolia-rollup.arbitrum.io/rpc
     sponsord_onramp_domain: onramp.validation.test
     sponsord_onramp_turnstile_sitekey: 1x00000000000000000000AA
-    sponsord_onramp_decdn_release: v0.1.0
+    sponsord_onramp_decdn_release: v9.9.9
     sponsord_onramp_decdn_sums_sha256: "1111111111111111111111111111111111111111111111111111111111111111"
   tasks:
     # --- sponsord_onramp: each case breaks ONE input over the valid baseline in play

From 1db2236911e429f26f16103739da3f31dd56cd5f Mon Sep 17 00:00:00 2001
From: Ant Somers <ant@decdn.org>
Date: Wed, 14 Oct 2026 20:08:29 +0300
Subject: [PATCH 3/3] chore: pin sponsord to v0.1.0

Moves sponsord_version and sponsord_onramp_version to 0.1.0 and the two
Compose image digests to the release's signed *-image-digest.txt (VALIDSIG
DA7515706F1873D274D8A3699E11A9FFD62DAADB against the vendored KEYS). KEYS and
crates/*/src/config.rs are unchanged since v0.0.4.

sponsord-onramp 0.1.0's installers run decdn get (decdn 0.1.0 replaced decdn
fetch and decdn bundle pull), so the docs that named those now say decdn get.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 AGENTS.md                                                     | 2 +-
 ansible/inventory/group_vars/sponsord_hosts.yml               | 4 ++--
 ansible/inventory/group_vars/sponsord_onramp_hosts.yml        | 4 ++--
 ansible/roles/decdn_node/defaults/main.yml                    | 2 +-
 ansible/roles/iroh_relay/README.md                            | 4 ++--
 ansible/roles/iroh_relay/defaults/main.yml                    | 2 +-
 ansible/roles/sponsord/defaults/main.yml                      | 2 +-
 ansible/roles/sponsord_onramp/README.md                       | 2 +-
 ansible/roles/sponsord_onramp/defaults/main.yml               | 2 +-
 compose/.env.example                                          | 4 ++--
 compose/README.md                                             | 2 +-
 .../collection-fleet/inventory/group_vars/sponsord_hosts.yml  | 4 ++--
 .../inventory/group_vars/sponsord_onramp_hosts.yml            | 4 ++--
 13 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 2b7af91..ee00b68 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -143,7 +143,7 @@ lint-alloy` validates and runs it.
 
 **Pinned upstream releases.** One decdn/decdn release (`decdn_node_version`, today
 `0.1.0`) and one decdn/sponsord release (`sponsord_version` = `sponsord_onramp_version`,
-today `0.0.4`; decdn/sponsord tags its whole workspace `vX.Y.Z`, there are no per-crate
+today `0.1.0`; decdn/sponsord tags its whole workspace `vX.Y.Z`, there are no per-crate
 tags) are pinned across every path: the role defaults, the onramp's installer pin
 (`sponsord_onramp_decdn_release` + `_decdn_sums_sha256`, copied into
 `compose/sponsord-onramp.env.example`), `compose/.env.example`'s image digests, the
diff --git a/ansible/inventory/group_vars/sponsord_hosts.yml b/ansible/inventory/group_vars/sponsord_hosts.yml
index 6680a40..7c86e36 100644
--- a/ansible/inventory/group_vars/sponsord_hosts.yml
+++ b/ansible/inventory/group_vars/sponsord_hosts.yml
@@ -14,11 +14,11 @@
 # The default method, "release", installs the decdn/sponsord release the role pins
 # (tag v<sponsord_version>); set it only to hold the host on another one, together
 # with sponsord_onramp_version:
-# sponsord_version: "0.0.4"
+# sponsord_version: "0.1.0"
 # Or build on the host from a git ref (tag, branch or SHA; sponsord_version is not
 # checked in this mode):
 # sponsord_install_method: source
-# sponsord_source_ref: v0.0.4
+# sponsord_source_ref: v0.1.0
 # Or copy a control-machine build: a decdn/sponsord checkout's target dir
 # (`cargo build --release -p sponsord`; the role checks the ELF matches the host).
 # sponsord_install_method: manual
diff --git a/ansible/inventory/group_vars/sponsord_onramp_hosts.yml b/ansible/inventory/group_vars/sponsord_onramp_hosts.yml
index e101132..78d281a 100644
--- a/ansible/inventory/group_vars/sponsord_onramp_hosts.yml
+++ b/ansible/inventory/group_vars/sponsord_onramp_hosts.yml
@@ -12,10 +12,10 @@
 # --- Binary ------------------------------------------------------------------------
 # The same three methods as sponsord. "release" (default) installs the same release
 # as the sponsord role; set both versions together to hold the host on another:
-# sponsord_onramp_version: "0.0.4"
+# sponsord_onramp_version: "0.1.0"
 # Or build on the host (its own checkout, so it may pin a different ref):
 # sponsord_onramp_install_method: source
-# sponsord_onramp_source_ref: v0.0.4
+# sponsord_onramp_source_ref: v0.1.0
 # Or manual, which follows sponsord_release_target_dir (`cargo build --release` in
 # a decdn/sponsord checkout builds both binaries):
 # sponsord_onramp_install_method: manual
diff --git a/ansible/roles/decdn_node/defaults/main.yml b/ansible/roles/decdn_node/defaults/main.yml
index 55e215d..523be9c 100644
--- a/ansible/roles/decdn_node/defaults/main.yml
+++ b/ansible/roles/decdn_node/defaults/main.yml
@@ -179,7 +179,7 @@ decdn_redeem_max_vouchers_per_tx: ""     # daemon dflt 300; > 0 — gas-bounded
 decdn_redeem_interval_secs: ""           # daemon dflt 300; range 1..=21600 — redeemer self-tick
 decdn_buyer_working_deposit_micro_usdc: ""  # daemon dflt 10_000_000 (10 USDC); > 0
 # bool; profile-dependent upstream — true for the daemon, false for the `decdn`
-# client (fetch / bundle pull). node.toml is deliberately shared with the CLI, so
+# client (decdn get). node.toml is deliberately shared with the CLI, so
 # pinning it here changes client behaviour too. One-time max USDC approval to PaymentPool.
 decdn_buyer_max_approve: ""
 decdn_pool_min_remaining_deposit_micro_usdc: ""  # daemon dflt 1_000_000 — solvency floor before a pool drains
diff --git a/ansible/roles/iroh_relay/README.md b/ansible/roles/iroh_relay/README.md
index 0cdfc0a..c6c1bf1 100644
--- a/ansible/roles/iroh_relay/README.md
+++ b/ansible/roles/iroh_relay/README.md
@@ -122,7 +122,7 @@ decdn_relay_urls:
 Setting `decdn_relay_urls` **replaces** n0's relays; it does not add to them. A node
 whose only relay is down has no fallback for peers it cannot hole-punch. Deploy
 **at least two** relays, preferably in different regions, before switching a fleet
-over. Clients (`decdn fetch`, `decdn probe --relay-url …`) take relays the same way,
+over. Clients (`decdn get`, `decdn probe --relay-url …`) take relays the same way,
 but a relay in the default `allowlist` mode refuses them (see below): point clients
 only at relays in `everyone` or `denylist` mode.
 
@@ -155,7 +155,7 @@ anyone in every mode.
 - **`denylist`:** everyone except `iroh_relay_denylist`.
 - **`everyone`:** no restriction.
 
-**What allowlist mode costs.** decdn clients (`decdn fetch`, `decdn probe`, onramp
+**What allowlist mode costs.** decdn clients (`decdn get`, `decdn probe`, onramp
 users) use a fresh iroh key for every fetch, so they **can never be listed**. iroh
 hole-punches over a connection it already has, and a node behind NAT has no path
 but its relay, so a client reaches a node homed on an allowlisted relay **only if
diff --git a/ansible/roles/iroh_relay/defaults/main.yml b/ansible/roles/iroh_relay/defaults/main.yml
index 60e92cd..fbf1334 100644
--- a/ansible/roles/iroh_relay/defaults/main.yml
+++ b/ansible/roles/iroh_relay/defaults/main.yml
@@ -69,7 +69,7 @@ iroh_relay_metrics_port: 9092
 # anyone in every mode):
 #   "allowlist" (default): only the endpoint IDs below. The IDs of the inventory's
 #     deCDN nodes are added by playbooks/iroh_relay.yml (iroh_relay_allowlist_from_inventory).
-#     decdn clients (decdn fetch, onramp users) use a fresh key per fetch and can
+#     decdn clients (decdn get, onramp users) use a fresh key per fetch and can
 #     NEVER be listed, and iroh hole-punches over a connection it already has, so a
 #     client reaches a node homed here only if the node is directly reachable. A
 #     node behind NAT that serves clients needs its relays in "everyone" mode.
diff --git a/ansible/roles/sponsord/defaults/main.yml b/ansible/roles/sponsord/defaults/main.yml
index 8914d1a..d00b982 100644
--- a/ansible/roles/sponsord/defaults/main.yml
+++ b/ansible/roles/sponsord/defaults/main.yml
@@ -52,7 +52,7 @@ decdn_rustup_sha256:
 # The decdn/sponsord release (tag v<version>) this repo pins. Keep it equal to
 # sponsord_onramp_version: both come from one workspace release (README.md,
 # "Bumping the sponsord release"; make test-scripts checks the defaults agree).
-sponsord_version: "0.0.4"         # asserted non-empty in "release" mode
+sponsord_version: "0.1.0"         # asserted non-empty in "release" mode
 # Release target triple, derived from the host's gathered architecture (see
 # vars/main/arch.yml). Set it explicitly only for a play with gather_facts: false.
 sponsord_target: "{{ _sponsord_arch_targets.get(ansible_facts.get('architecture', ''), '') }}"
diff --git a/ansible/roles/sponsord_onramp/README.md b/ansible/roles/sponsord_onramp/README.md
index bf1b2e5..b23a555 100644
--- a/ansible/roles/sponsord_onramp/README.md
+++ b/ansible/roles/sponsord_onramp/README.md
@@ -7,7 +7,7 @@ the public side of the deCDN onboarding sponsor. It serves:
   their download;
 - the `decdn.sh` / `decdn.ps1` installers, which install `decdn` from a pinned
   release, make a throwaway download key, get the capability through the gate and
-  run `decdn bundle pull` with it;
+  run `decdn get` with it;
 - the API the installers poll for that capability.
 
 It holds no wallet. For each person who passes the gate it asks the
diff --git a/ansible/roles/sponsord_onramp/defaults/main.yml b/ansible/roles/sponsord_onramp/defaults/main.yml
index 37e8615..6c3ed58 100644
--- a/ansible/roles/sponsord_onramp/defaults/main.yml
+++ b/ansible/roles/sponsord_onramp/defaults/main.yml
@@ -50,7 +50,7 @@ decdn_rustup_sha256:
 # --- Release to install ("release" mode) ----------------------------------------
 # The decdn/sponsord release (tag v<version>) this repo pins, the
 # same one as the sponsord role's sponsord_version.
-sponsord_onramp_version: "0.0.4"         # asserted non-empty in "release" mode
+sponsord_onramp_version: "0.1.0"         # asserted non-empty in "release" mode
 # Derived from the host's gathered architecture (vars/main/arch.yml).
 sponsord_onramp_target: "{{ _sponsord_onramp_arch_targets.get(ansible_facts.get('architecture', ''), '') }}"
 sponsord_onramp_release_base: "https://github.com/decdn/sponsord/releases/download"
diff --git a/compose/.env.example b/compose/.env.example
index a4ed905..d929e5e 100644
--- a/compose/.env.example
+++ b/compose/.env.example
@@ -42,9 +42,9 @@ DECDN_ENV_FILE=/etc/decdn/decdn.env
 
 # --- sponsord and onramp ----------------------------------------------------------
 # The decdn/sponsord release sponsord_version pins: one release for both images
-SPONSORD_IMAGE_DIGEST=sha256:120982625257b28cf785c776cb2cc7a6c6cd8e2e5958b274f1a43d27ab857eea
+SPONSORD_IMAGE_DIGEST=sha256:8f82f8f88ce75be0072abc8f72e0462e03c0afba8035fe8671d6ee79ebbc930b
 # SPONSORD_IMAGE_REPO=ghcr.io/decdn/sponsord
-SPONSORD_ONRAMP_IMAGE_DIGEST=sha256:76362c0de04d3febf43b39ee1d00bd29d45a1b4338fc3f8fb0427d52d5b13805
+SPONSORD_ONRAMP_IMAGE_DIGEST=sha256:f0a2701a717c9cdd0ec0969866be30ccbf82773e08c7f25405413f543281a2df
 # SPONSORD_ONRAMP_IMAGE_REPO=ghcr.io/decdn/sponsord-onramp
 
 # uid/gid of the host's dedicated `sponsord` system account, which owns the
diff --git a/compose/README.md b/compose/README.md
index f7901e4..ea9e771 100644
--- a/compose/README.md
+++ b/compose/README.md
@@ -398,7 +398,7 @@ udp/7842 itself, so it cannot share a host with `onramp`, `caddy` or `dns`.
      `decdn whoami` as the node's user) and add each `node id` to `access` in the
      config. `check` refuses an empty list, which would admit nobody. Update every
      relay after adding a node or rotating its key, then `restart iroh-relay`.
-   - **What it costs:** decdn clients (`decdn fetch`, onramp users) use a fresh key
+   - **What it costs:** decdn clients (`decdn get`, onramp users) use a fresh key
      per fetch, so they can never be listed, and iroh hole-punches over a connection
      it already has. A client therefore reaches a node homed on an allowlisted relay
      only if the node is directly reachable. A node behind NAT that serves clients
diff --git a/examples/collection-fleet/inventory/group_vars/sponsord_hosts.yml b/examples/collection-fleet/inventory/group_vars/sponsord_hosts.yml
index 6680a40..7c86e36 100644
--- a/examples/collection-fleet/inventory/group_vars/sponsord_hosts.yml
+++ b/examples/collection-fleet/inventory/group_vars/sponsord_hosts.yml
@@ -14,11 +14,11 @@
 # The default method, "release", installs the decdn/sponsord release the role pins
 # (tag v<sponsord_version>); set it only to hold the host on another one, together
 # with sponsord_onramp_version:
-# sponsord_version: "0.0.4"
+# sponsord_version: "0.1.0"
 # Or build on the host from a git ref (tag, branch or SHA; sponsord_version is not
 # checked in this mode):
 # sponsord_install_method: source
-# sponsord_source_ref: v0.0.4
+# sponsord_source_ref: v0.1.0
 # Or copy a control-machine build: a decdn/sponsord checkout's target dir
 # (`cargo build --release -p sponsord`; the role checks the ELF matches the host).
 # sponsord_install_method: manual
diff --git a/examples/collection-fleet/inventory/group_vars/sponsord_onramp_hosts.yml b/examples/collection-fleet/inventory/group_vars/sponsord_onramp_hosts.yml
index e101132..78d281a 100644
--- a/examples/collection-fleet/inventory/group_vars/sponsord_onramp_hosts.yml
+++ b/examples/collection-fleet/inventory/group_vars/sponsord_onramp_hosts.yml
@@ -12,10 +12,10 @@
 # --- Binary ------------------------------------------------------------------------
 # The same three methods as sponsord. "release" (default) installs the same release
 # as the sponsord role; set both versions together to hold the host on another:
-# sponsord_onramp_version: "0.0.4"
+# sponsord_onramp_version: "0.1.0"
 # Or build on the host (its own checkout, so it may pin a different ref):
 # sponsord_onramp_install_method: source
-# sponsord_onramp_source_ref: v0.0.4
+# sponsord_onramp_source_ref: v0.1.0
 # Or manual, which follows sponsord_release_target_dir (`cargo build --release` in
 # a decdn/sponsord checkout builds both binaries):
 # sponsord_onramp_install_method: manual