@devrouter/cli 0.0.67 → 0.0.69

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devrouter/cli",
-  "version": "0.0.67",
+  "version": "0.0.69",
   "description": "Local dev routing CLI with shared Traefik reverse proxy",
   "author": "Roland Schlaefli",
   "homepage": "https://github.com/rschlaefli/devrouter#readme",
@@ -48,6 +48,7 @@
     "test": "vitest run && pnpm test:process",
     "test:package": "./scripts/package-smoke.sh",
     "qualify:lifecycle": "node --import tsx scripts/qualify-lifecycle.ts",
+    "qualify:capacity": "node --import tsx scripts/qualify-capacity.ts",
     "qualify:controller": "node --import tsx scripts/qualify-controller.ts",
     "qualify:stop-drift": "node --import tsx scripts/qualify-config-drift-stop.ts",
     "test:process": "bash scripts/test-devrouter-process.sh",

package/upgrade-prompts/0.0.68.md

@@ -0,0 +1,51 @@
+# Upgrade to devrouter 0.0.68
+
+This patch release adds opt-in capacity admission for enrolled managed
+checkouts and makes lock failures actionable. Machines without an enabled
+capacity policy keep the current manual lifecycle unchanged.
+
+## What changed
+
+- **Capacity admission (opt-in).** With an explicitly enabled
+  `capacity-policy.json` under Devrouter home and an enrolled checkout, the
+  controller admits `ensure` and `exec` before dispatch. The CLI follows the
+  decision with bounded reconnecting waits that survive controller restarts
+  while the request stays queued, worker results are journalled atomically, and
+  `stop` bypasses admission. Without an enabled policy, behavior is unchanged
+  (ADR 0008).
+- **Actionable lock diagnostics.** A lock that cannot prove its owner now names
+  the failing inspection stage, the activity, the exact lock path, a portable
+  reproduction command (`LC_ALL=C ps -o lstart= -o command= -p <any-live-pid>`),
+  and the permitted-host-context remediation. Locks stay fail-closed and no
+  identity fallback is attempted. `devrouter controller` commands additionally
+  print the underlying failure cause on stderr while keeping the stable
+  `controller-unavailable` JSON contract on stdout.
+
+This release does not prevent host OOM and does not perform autonomous agent
+recovery. Capacity admission bounds what Devrouter starts when an operator
+enables it; it is not a memory guarantee.
+
+## Task
+
+Install the published release and update `.devrouter.yml` `devrouter.version`
+to 0.0.68. No schema migration or configuration change is required. Do not
+create a capacity policy, enroll a checkout, or change machine policy unless the
+operator asks for it. Do not hand-edit `~/.config/devrouter`.
+
+## Validation
+
+Confirm ordinary behavior is unchanged on a machine without
+`capacity-policy.json`: run `devrouter ensure <path> --json`, then
+`devrouter stop <path>`, and confirm routes publish and release as before.
+Confirm `devrouter doctor --repo <repo>` reports no new failures. If an operator
+has enrolled a checkout, confirm `ensure` and `exec` follow the reported
+admission decision and that `stop` still bypasses admission. If a lock cannot
+prove its owner, confirm the error names the inspection stage, the lock path,
+and the remediation command instead of a bare refusal.
+
+## Report
+
+Report the tested CLI version, the exact workspace path or synthetic fixture,
+each command result (ensure, stop, and doctor) with route state after the run,
+whether a capacity policy was enabled or absent, any diagnostic failure output
+verbatim, and whether admission or only the unchanged manual path was exercised.

package/upgrade-prompts/0.0.69.md

@@ -0,0 +1,41 @@
+# Upgrade to devrouter 0.0.69
+
+This patch release teaches managed `ensure` to refuse — in seconds, with
+attribution — when a consumer-declared fixed published host port is already
+bound by another running container, and adds a read-only doctor check for the
+same drift. It exists because two workspaces collided on one fixed binding and
+the second burned a full provider bootstrap before failing with Docker's raw
+"port is already allocated" and no holder attribution.
+
+## Task
+
+Install the published release and update `.devrouter.yml` devrouter.version to
+0.0.69. No schema migration or configuration change is required. Do not rewrite
+consumer compose files, host ports, or environment defaults to satisfy the
+check: the refusal is intentional, and devrouter never regenerates or offsets
+consumer-declared bindings. When an ensure is refused, resolve the collision on
+the holding side — stop the named workspace with `devrouter stop <path>`, or
+change the consumer's own binding through its declared escape hatch (for
+example its compose interpolation variable) — then run ensure again.
+
+## Validation
+
+On a repository whose managed overlay declares a fixed binding (for example
+`127.0.0.1:${SOME_HOST_PORT:-10003}:10000`), run
+`devrouter doctor --repo <path> --json`: with no live holder,
+`repo.host-port-claims` is `ok`; with another workspace already bound to that
+port it is `error` naming the holding container and owning workspace; with
+Docker unavailable it is `warn` without failing doctor. While the port is
+held, run `devrouter ensure <path> --json`: it must refuse within seconds with
+`hostPortConflicts` populated and a nonzero exit, and no provider bootstrap may
+start. Free or override the port and re-run: ensure completes with routes as
+before. Confirm repositories without fixed published bindings and non-managed
+repositories behave exactly as before.
+
+## Report
+
+Report the tested CLI version, the repository and binding exercised, the
+doctor check level and details before and after, the ensure refusal JSON
+(`hostPortConflicts`) or its absence, the remediation used (stop versus env
+override), and whether any fixed-binding or non-managed regression was
+observed.