@devrouter/cli 0.0.63 → 0.0.65

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devrouter/cli",
-  "version": "0.0.63",
+  "version": "0.0.65",
   "description": "Local dev routing CLI with shared Traefik reverse proxy",
   "author": "Roland Schlaefli",
   "homepage": "https://github.com/rschlaefli/devrouter#readme",

package/upgrade-prompts/0.0.64.md

@@ -0,0 +1,34 @@
+# Upgrade to devrouter 0.0.64
+
+This patch lets canonical ensure wait for healthy lifecycle work on the same
+checkout and clarifies process-inspection permission failures.
+
+## Task
+
+Install the published patch and update `.devrouter.yml` devrouter.version to
+0.0.64. No schema migration or runtime restart is required. Refresh distributed
+agent guidance through the existing repository workflow.
+
+## Validation
+
+Confirm the installed version. On an authorized runtime, invoke ensure while a
+bounded tooling command is active. Verify waiting, preserved tooling exit status
+and successful ensure after completion when the lifecycle fence stays unchanged.
+Verify the exact runtime stops with zero routes and retained data when finished.
+A waiting exec refreshes runtime proof before admission; ensure establishes its
+runtime inside the worker. Stop or another fence change cancels the waiting
+invocation. Never replay an uncertain command.
+
+## Limits
+
+Waiting is bounded to thirty minutes, with no FIFO guarantee or persistent queue.
+Permission diagnostics direct agents to a permitted host context; they do not
+repair operating-system permissions or authorize lock removal. This patch does
+not solve network exhaustion, activate capacity admission, or claim complete OOM
+protection or autonomous agent recovery.
+
+## Report
+
+Report installed version, exact checkout/provider, command outcomes, retained
+runtime/data evidence and final runtime/route state. Separate published source,
+synthetic checks and live consumer acceptance.

package/upgrade-prompts/0.0.65.md

@@ -0,0 +1,39 @@
+# Upgrade to devrouter 0.0.65
+
+This feature release adds managed-workspace network capacity support: read-only
+capacity and retained-ownership diagnostics plus opt-in daemon-bound subnet
+allocation for new managed linked-workspace Compose networks.
+
+## Task
+
+Install the published release and update `.devrouter.yml` devrouter.version to
+0.0.65. No schema migration is required. Opting a repository in needs two
+operator steps: install `~/.config/devrouter/network-policy.json` naming
+private pools, exclusions and permitted prefixes for the exact Docker daemon,
+then add `managedRuntime.network` to the repository configuration. Repository
+configuration cannot select address ranges. Adding a policy changes nothing for
+existing workspaces, networks or provider registrations.
+
+## Validation
+
+Run `devrouter doctor --repo <checkout> --json` and confirm the read-only
+network capacity report. On an authorized runtime with a valid policy, start a
+new managed linked workspace and verify the ignored generated Compose overlay,
+the persisted subnet claim, exact provider destination reuse, and subnet
+retention across stop and resume. Verify failure paths retain claims and never
+delete networks, containers or workspaces. Stop the exact runtime afterwards
+and confirm zero routes with retained data.
+
+## Limits
+
+Allocation requires complete route and daemon evidence; virtualized contexts
+such as OrbStack stay diagnostics-only until guest routes are qualified.
+Existing `/24` networks are never subdivided or migrated. Stopping a workspace
+or removing its worktree does not release a subnet, and cleanup remains
+report-only. Without a policy, allocation behavior is unchanged.
+
+## Report
+
+Report installed version, policy presence without its contents, diagnostic
+output, allocation outcomes with synthetic receipts, and any retained claims or
+resources. Separate published source, synthetic checks and live runtime proof.