chore(release): v2.5.1 — programmable-CI SDK becomes a3s-box-sdk (#152)

Renames the programmable-CI pipeline crate a3s-box-ci -> a3s-box-sdk (the general
Rust SDK; pipeline API under `a3s_box_sdk::pipeline`, error `pipeline::PipelineError`),
and the former workload-execution a3s-box-sdk -> a3s-box-lambda (consumers update
`use a3s_box_sdk` -> `use a3s_box_lambda`). Adds a3s-box-sdk to the crates.io publish
list and bumps the workspace to 2.5.1. No runtime behavior change.

Co-authored-by: Roy Lin <roylin@a3s.box>

Author: ZhiXiao-Lin

.github/workflows/release.yml

@@ -296,8 +296,9 @@ jobs:
           echo "Publishing version $VERSION (in dependency order)"
           FAILED=""
           # Order matters: a dependent is published AFTER its internal deps so
-          # the index has them. runtime depends on core + netproxy + libkrun-sys.
-          for crate in a3s-libkrun-sys a3s-box-core a3s-box-netproxy a3s-box-runtime; do
+          # the index has them. runtime depends on core + netproxy + libkrun-sys;
+          # a3s-box-sdk is dependency-free (a thin CLI wrapper) so its position is free.
+          for crate in a3s-libkrun-sys a3s-box-core a3s-box-netproxy a3s-box-runtime a3s-box-sdk; do
             code=$(curl -s -o /dev/null -w '%{http_code}' "https://crates.io/api/v1/crates/$crate/$VERSION")
             if [ "$code" = "200" ]; then
               echo "✓ $crate@$VERSION already on crates.io — skipping"

CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to A3S Box will be documented in this file.
 
 ## [Unreleased]
 
+## [2.5.1] — 2026-06-22
+
+SDK crate naming. No runtime behavior change.
+
+### Changed
+
+- **`a3s-box-sdk` is now the general-purpose Rust SDK.** The programmable-CI pipeline
+  API (added in 2.5.0 as the `a3s-box-ci` crate) is now `a3s-box-sdk`, under the
+  `a3s_box_sdk::pipeline` module, so the SDK can grow beyond CI. The error type
+  `CiError` is now `pipeline::PipelineError`. **`a3s-box-sdk` is published to crates.io.**
+- **The former `a3s-box-sdk` (MicroVM workload-execution SDK for a3s-lambda) is renamed
+  to `a3s-box-lambda`.** Consumers (e.g. a3s-lambda) must update `use a3s_box_sdk::…` →
+  `use a3s_box_lambda::…`. It remains unpublished (path-only deps).
+
 ## [2.5.0] — 2026-06-22
 
 Programmable CI on a3s-box: copy-on-write snapshot restore — fork a warmed snapshot as

src/Cargo.lock

@@ -9,7 +9,7 @@ members = [
     "cri",
     "cli",
     "sdk",
-    "ci",
+    "lambda",
 ]
 resolver = "2"
 
@@ -23,7 +23,7 @@ resolver = "2"
 h2 = { path = "third_party/h2" }
 
 [workspace.package]
-version = "2.5.0"
+version = "2.5.1"
 edition = "2021"
 authors = ["A3S Lab Team"]
 license = "MIT"

src/Cargo.toml

@@ -0,0 +1,44 @@
+[package]
+name = "a3s-box-lambda"
+version.workspace = true
+edition = "2021"
+authors = ["A3S Lab"]
+license = "MIT"
+repository = "https://github.com/A3S-Lab/a3s"
+description = "A3S Box MicroVM workload-execution SDK (the VM-executor SDK for a3s-lambda)."
+
+[dependencies]
+# Box runtime for VM management
+a3s-box-runtime = { path = "../runtime", features = ["vm", "pool"] }
+
+# Core types
+a3s-box-core = { path = "../core" }
+
+# Async runtime
+tokio = { workspace = true }
+async-trait = { workspace = true }
+
+# Serialization
+serde = { workspace = true }
+serde_json = { workspace = true }
+
+# Time
+chrono = { workspace = true }
+
+# UUID
+uuid = { workspace = true }
+
+# Error handling
+thiserror = { workspace = true }
+
+# Logging
+tracing = { workspace = true }
+
+# TEE/Attestation
+sha2 = { workspace = true }
+
+# HTTP client
+reqwest = { workspace = true }
+
+# HTML parsing for web extract
+scraper = "0.24"

src/ci/Cargo.toml

@@ -0,0 +1,63 @@
+//! A3S Box workload-execution SDK — MicroVM workload execution for Lambda.
+//!
+//! (Formerly the `a3s-box-sdk` crate; renamed to `a3s-box-lambda` so `a3s-box-sdk`
+//! can be the general-purpose Rust SDK. The programmable-CI pipeline API now lives
+//! in `a3s-box-sdk`.)
+//!
+//! This crate provides the SDK interface for executing workloads inside
+//! isolated A3S Box MicroVMs. It wraps the lower-level a3s-box-runtime
+//! to provide a simple execution interface.
+//!
+//! # Core Concepts
+//!
+//! - **ExecutionRegistry**: Main entry point for workload execution
+//! - **ExecutionAdapter**: Pluggable backends for different execution modes
+//! - **BoxWorkloadEnvelope**: Workload specification (runtime, entrypoint, input)
+//!
+//! # Example
+//!
+//! ```rust,no_run
+//! use a3s_box_lambda::{ExecutionRegistry, BoxWorkloadEnvelope, RuntimeClass, WorkloadKind, BoxRuntimeSpec};
+//! use std::time::Duration;
+//!
+//! #[tokio::main]
+//! async fn main() -> Result<(), Box<dyn std::error::Error>> {
+//!     let registry = ExecutionRegistry::new();
+//!
+//!     let envelope = BoxWorkloadEnvelope {
+//!         runtime_class: RuntimeClass::A3sBox,
+//!         workload_kind: WorkloadKind::ExecutionTask,
+//!         runtime: BoxRuntimeSpec {
+//!             runtime: "a3s/executor/http".into(),
+//!             entrypoint: "a3s-executor".into(),
+//!             args: vec!["--executor".into(), "http".into(), "--handler".into(), "get".into()],
+//!             env: Default::default(),
+//!         },
+//!         input: serde_json::json!({"url": "https://example.com"}),
+//!         labels: Default::default(),
+//!     };
+//!
+//!     let result = registry.execute_box_workload(&envelope, Duration::from_secs(300)).await;
+//!     println!("Result: {:?}", result);
+//!     Ok(())
+//! }
+//! ```
+
+pub mod adapter;
+pub mod error;
+pub mod registry;
+pub mod vm;
+
+pub use adapter::{
+    CapabilityAccess, CapabilityRisk, ExecutionAdapter, ExecutionCapability,
+    ExecutionCapabilityGrant, HttpExecutionAdapter,
+};
+pub use error::SdkError;
+pub use registry::{
+    BoxRuntimePoolSnapshot, CapabilityMatchMode, ExecutionPolicy, ExecutionRegistry, Result,
+};
+pub use vm::{VmExecutor, VmPoolStats};
+
+pub use a3s_box_core::{
+    BoxRuntimeSpec, BoxWorkloadEnvelope, ExecutionLaunchMode, RuntimeClass, WorkloadKind,
+};