@devrouter/cli 0.0.79 → 0.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devrouter/cli",
-  "version": "0.0.79",
+  "version": "0.1.0",
   "description": "Local dev routing CLI with shared Traefik reverse proxy",
   "author": "Roland Schlaefli",
   "homepage": "https://github.com/rschlaefli/devrouter#readme",
@@ -51,6 +51,9 @@
     "qualify:capacity": "node --import tsx scripts/qualify-capacity.ts",
     "qualify:controller": "node --import tsx scripts/qualify-controller.ts",
     "qualify:stop-drift": "node --import tsx scripts/qualify-config-drift-stop.ts",
+    "qualify:harness-journey": "./scripts/qualify-harness-journey.sh",
+    "qualify:codex-journey": "DR_JOURNEY_HARNESS=codex ./scripts/qualify-harness-journey.sh",
+    "qualify:non-node": "./scripts/qualify-non-node-consumer.sh",
     "test:process": "bash scripts/test-devrouter-process.sh",
     "check": "biome check .",
     "check:fix": "biome check --write .",

package/upgrade-prompts/0.0.80.md

@@ -0,0 +1,63 @@
+# Upgrade to devrouter 0.0.80
+
+This release makes Devsy maintenance routine instead of disruptive. Devrouter
+now supports installed Devsy releases in the range `>=1.16.2 <2.0.0`: an
+explicit `setup --workspace-runtime devsy` verifies the official Linux agent
+for the installed release against the SHA-256 digest GitHub publishes, records
+the manifest in Devrouter machine state, and injects it, while `doctor` and
+`ensure` stay network-free. An in-range release with no recorded manifest is
+accepted with a drift warning and nothing injected, so a Devsy update no longer
+blocks a managed start. The release also reworks the harness gate wait budget,
+adds a `devrouter capacity reconcile` recovery, names the router holder in
+host-port conflicts, accepts worktree-owned dependency-overlay upstreams, and
+adds the `global.cli-path` install comparison to `doctor`.
+
+## Task
+
+Use the published 0.0.80 CLI. Update the repository `devrouter.version`
+metadata only when consumer source changes are authorized, and refresh generated
+agent guidance only with its owner's authority. No schema, journal or
+configuration migration is needed.
+
+Operating changes that matter for scripts, agents and operators:
+
+- **Devsy agent.** Run `devrouter setup --yes --workspace-runtime devsy` once
+  per installed Devsy release, and rerun it after a Devsy update, to verify and
+  inject the official agent for that release. Until a release's manifest is
+  recorded, `doctor` reports `ready` with a drift warning and
+  `source=host`: the host CLI governs its own agent and Devrouter injects
+  nothing. A version outside the supported range, or an unparseable one, still
+  fails before the provider queue, and an explicit `DEVSY_AGENT_BINARY` must
+  match the official asset for the installed release.
+- **Harness gate.** A `PreToolUse` hook timeout must exceed
+  `--wait-budget-ms`. The budget now measures only the actual wait, and a call
+  the harness re-delivers with the same `tool_use_id` returns one refusal that
+  names the earlier decision instead of waiting again.
+- **Capacity recovery.** `devrouter capacity reconcile --yes` replaces a
+  provably absent ledger with a fresh baseline. It refuses without `--yes` and
+  while any journal binding remains; treat it as operator recovery, not routine
+  maintenance.
+- **Multiple installs.** `doctor` reports `global.cli-path`. Upgrade every
+  `devrouter` install on PATH so a stale binary cannot run lifecycle rules
+  against state a newer version wrote.
+
+## Validation
+
+Confirm the resolved executable and installed version from a consumer checkout,
+and check `global.cli-path` reports no stale or divergent install. Confirm
+`global.devsy-agent` reports `ready`; before `setup` records the installed
+release, expect the non-blocking drift warning, and after it expect the recorded
+manifest with no network access at `ensure` time. Parse command JSON from
+stdout only, because `ensure` and `stop` still stream bounded phase progress
+on stderr. Exercise `capacity reconcile` or a stuck `stopping` settlement
+only with operator authority, and require each operation's own terminal
+evidence.
+
+## Report
+
+Report the release revision, resolved executable, installed version, the Devsy
+agent and `global.cli-path` diagnostics, the manifest origin reported after
+`setup`, and the terminal result of any authorized lifecycle or capacity
+operation. Keep source and package validation separate from consumer readiness,
+and record unknown ownership or ledger evidence as unresolved rather than as
+recovered.

package/upgrade-prompts/0.1.0.md

@@ -0,0 +1,69 @@
+# Upgrade to devrouter 0.1.0
+
+This release is the first stable cut of the reliability program. The managed
+lifecycle is now driven by durable intent instead of a live CLI process, capacity
+admission refuses instead of guessing when its evidence is incomplete, and the
+agent harness gate serves Claude Code and the Codex CLI in the shape each of them
+accepts.
+
+## What changed for a consumer
+
+- A managed `stop` whose physical cessation is proven against a positively
+  absent capacity ledger now completes instead of staying in `stopping`
+  forever. An intact ledger keeps today's settlement and revision fencing, and
+  every other ledger classification still refuses.
+- `devrouter capacity reconcile --yes [--json]` is the explicit forward
+  recovery for a provably absent ledger. It refuses without `--yes`, while any
+  journal binding remains, and when a declared runtime domain cannot be observed.
+- `devrouter doctor` reports `global.cli-path` when another `devrouter` on
+  PATH is newer than the running CLI or when the shell resolves a different
+  install. Keep one install authoritative before trusting lifecycle state.
+- `devrouter harness gate` defers one agent tool call while the checkout's
+  durable phase is `queued`, `starting`, `verifying`, `recovering` or
+  `stopping`, waits inside the hook process with no model turns, and refuses
+  once with recovery guidance when the budget runs out. It identifies the
+  requesting harness from its payload: Claude Code receives
+  `permissionDecision: allow`, the Codex CLI receives the same guidance as
+  `additionalContext` because it reports an `allow` decision as unsupported
+  hook output. A re-delivered call returns one refusal that names the earlier
+  decision instead of repeating a command that may already have run.
+- A fixed host-port conflict whose holder is the shared `devrouter-traefik`
+  router names the consumer's own published binding as the side to change instead
+  of telling the agent to stop the router.
+- Managed `ensure` accepts a devnet upstream served by any Compose project owned
+  by the exact worktree, while a container owned by a different worktree or by a
+  shared project outside the checkout is still refused.
+
+## Task
+
+Use the published 0.1.0 CLI. Update the repository `devrouter.version` metadata
+only when consumer source changes are authorized, and refresh generated agent
+guidance only with its owner's authority. No schema, command, flag, environment
+or journal migration is needed, and the upgrade rewrites no runtime state.
+
+Two operating notes matter for scripts and agents:
+
+- `ensure` and `stop` write bounded progress lines to stderr. Parse JSON from
+  stdout only; do not merge the streams before parsing.
+- Capacity admission, parking consent and automatic recovery stay inert unless an
+  operator enables them. Nothing in this release starts, stops or parks a
+  consumer environment on its own.
+
+## Validation
+
+Verify the resolved executable and installed version, then run `devrouter
+doctor` and confirm `global.cli-path` reports one authoritative install and no
+newer shadow copy. For an authorized managed checkout, run `devrouter status`
+and confirm the reported intent, phase, capacity state and attention reason agree
+with the runtime you observe. Require each lifecycle operation's own terminal
+evidence: a status block or a progress line is not stop or ensure success. When
+the gate is wired, prove it once in the harness you use by gating a harmless
+command against a settled checkout.
+
+## Report
+
+Report the release revision, the executable and installed version, the
+CLI-path diagnostics, the status block for any affected checkout, and the
+terminal result of any authorized lifecycle operation. Keep source and package
+validation separate from consumer readiness or recovery, and record unknown
+ownership or surviving resources as unresolved rather than as recovered.