Development snapshot: the Go 1.27 product surface

Piglet’s 2026-08-24 source snapshot has moved well beyond an initial QEMU spike. It now presents one coherent local-VM product: zero-configuration Quick, fixed-address private labs, 13 Piglet-owned profiles, an audited Pigsty inventory boundary, explicit persistence/state migration, diagnostics, and a reproducible release toolchain.

It is still a development snapshot—not a stable release.

One native runtime

Piglet directly drives native QEMU through HVF on macOS and KVM on Linux. It owns strict specification resolution, image/qcow2 verification, pure-Go NoCloud CIDATA, QMP/process identity, SSH readiness, atomic state, journals, events, repair, and bounded deletion. QEMU runs as the invoking user and never silently falls back to TCG.

There is no second provider/runtime path and no arbitrary QEMU-argument escape.

Quick on both Tier-1 hosts

The retained Go 1.27 Quick runs cover the public no-YAML path on macOS arm64 and Linux amd64. The contract is meta/dba, 2 vCPU, 4 GiB memory, 64 GiB root, sparse 64 GiB /data, user NAT, SSH, and four loopback forwarding conventions.

The product supports plan, up, status, SSH/exec, stop/start/restart, drift classification, guarded recreate/destroy, no-wait, persistent-disk retention, key retirement, logs, repair, and redacted debug bundles.

Those forwards do not install applications. Pigsty/PostgreSQL bootstrap remains a separate integration gate.

Private labs and host networking

Private mode now has public preflight/status/install/uninstall flows on both Tier-1 host families. macOS uses pinned socket_vmnet v1.2.2 with host mode by default and evidence-backed shared/FD paths. Linux uses a reversible systemd-networkd/NetworkManager/bridge-helper transaction. Both keep QEMU unprivileged and block uninstall while the global lease is active.

The default 10.10.10.0/24 can be replaced by one explicit canonical RFC1918 /24. Profile, host install, lease, state, node addresses, and Pigsty inventory must move together. No random collision escape is chosen.

Retained four-node full and MinIO runs exercised fixed IPs, control-only lateral SSH, management internet, storage identity, stop/start persistence, and clean destroy on both Tier-1 paths. Earlier runs also cover crash recovery and 30/30 soak. The MinIO profile runs validate 16 VM data disks, not the MinIO application.

Schema-3 owned profiles and Pigsty inventory

The 13 embedded profiles contain 85 nodes, all using dba. Ordinary nodes have one 128 GiB /data; MinIO nodes have four 32 GiB disks. Catalog schema 3 owns scalability, image policy, and Pigsty inventory binding, with direct and build_subset modes.

piglet pigsty inventory reads a real Pigsty source tree, classifies and validates host/VIP/admin/service address semantics, rebases a coordinated custom subnet, and can atomically publish a mode-0600 marker-owned output. pigsty-vm exposes the same profile, network, lifecycle, and inventory contract through a small typed environment.

The wrapper has no provider fallback. Operational rollback means a prior verified Piglet artifact plus matching state backup.

Persistence, upgrade, and automation

Disks marked persistent: true survive ordinary destroy and compatible recreate. The current safety contract requires an independent TTY phrase or destroy --force --delete-persistent --yes-delete-persistent; project keys have a separate default-dry-run project purge-keys --yes boundary.

Schema 0→1 migration is stopped-only, no-lease, backup-first, atomic, and explicit through project upgrade-state --dry-run|--yes. Newer schemas are refused rather than downgraded.

Private node selectors, --no-wait, stable JSON responses, typed exit classes, shell completion, SSH config, marker-owned hosts blocks, per-node logs, and redacted support bundles complete the current operator/automation surface.

Images and release mechanisms

The formal embedded image set is el9, el10, d12, d13, u22, u24, and u26 on both Tier-1 native architectures. Retained matrix records report 7/7 per architecture; EL8 was retired from v1 because its arm64 kernel cannot satisfy the tested native HVF contract. The entries remain testing pending a production image channel and custody.

The source tree can build and verify four native archives, a Homebrew formula, Linux amd64/arm64 RPM and DEB packages, checksums, SPDX SBOMs, a combined release assembly, and Cosign signature/SLSA-provenance positive and tamper tests. Isolated package install/verify/remove and two-run reproducibility passed for the tested snapshots. The checked-in release workflow has not executed for a real tag.

Evidence must follow exact bytes

At this snapshot, catalog schema 3 and inventory integration had changed the checked-in profile/resolved digests after the retained full/MinIO runs, so exact-current native refresh was still required. Custom-subnet hosts publishing, applied storage.data_root/ssh.wait_timeout, and generic Quick users were also open.

RC6 later closed those implementation and exact-profile gaps. Historical native runs remain valid only for the bytes and behavior they actually exercised.

What remains before v1.0

The snapshot’s exact-profile, Pigsty-bootstrap, and Rocky 9.8 private-host gates were later exercised. The current remaining gates are production image/manifest/release custody, durable runner ownership, literal reboot recovery, Tier-2 native smoke, published package consumption, and a real signed/attested tag-bound release.

See the current tutorial, design, and status for the maintained boundary.