@devrouter/cli 0.0.80 → 0.1.1

package/dist/devrouter-lifecycle-worker.js

@@ -5347,7 +5347,7 @@ function retain(session, previous) {
 
 // src/core/reliability-operation-store.ts
 function installedCliVersion() {
-  return true ? "0.0.80" : "0.0.0-dev";
+  return true ? "0.1.1" : "0.0.0-dev";
 }
 function compareCliVersions(left, right) {
   const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -7163,7 +7163,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs18.default.rea
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.80" : "0.0.0-dev";
+    const cliVersion = true ? "0.1.1" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver2(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -11957,6 +11957,11 @@ function reliabilityRecovery(reason2, repoPath) {
     case "stop-incomplete":
     case "operation-unknown":
       return [`Run: devrouter stop ${repoPath}`, `Run: devrouter ensure ${repoPath} --repair`];
+    case "start-refused":
+      return [
+        `Run: devrouter doctor ${repoPath} to read the refused fixed host-port claim and its holder`,
+        `Stop the holding workspace or change this repository's own published binding, then run: devrouter ensure ${repoPath}`
+      ];
     case "unadmittable":
       return [
         `Run: devrouter stop ${repoPath}`,
@@ -11970,6 +11975,13 @@ function reliabilityRecovery(reason2, repoPath) {
       return [];
   }
 }
+function refusedManagedStart(result) {
+  if (result?.ok !== true) return false;
+  const value = result.value;
+  if (typeof value !== "object" || value === null) return false;
+  const conflicts = value.hostPortConflicts;
+  return Array.isArray(conflicts) && conflicts.length > 0;
+}
 function readReliabilityStatus(options) {
   let provider;
   try {
@@ -11989,7 +12001,7 @@ function readReliabilityStatus(options) {
     return void 0;
   }
   if (!record5) return void 0;
-  const reason2 = reliabilityAttention(record5.state);
+  const reason2 = reliabilityAttention(record5.state) ?? (record5.state.desired === "running" && refusedManagedStart(record5.result) ? "start-refused" : void 0);
   return {
     desired: record5.state.desired,
     phase: record5.state.phase,

package/dist/devrouter.js

@@ -4275,7 +4275,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs7.default.read
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.80" : "0.0.0-dev";
+    const cliVersion = true ? "0.1.1" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -6259,7 +6259,7 @@ var init_reliability_contract = __esm({
 
 // src/core/reliability-operation-store.ts
 function installedCliVersion() {
-  return true ? "0.0.80" : "0.0.0-dev";
+  return true ? "0.1.1" : "0.0.0-dev";
 }
 function compareCliVersions(left, right) {
   const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -15902,6 +15902,11 @@ function reliabilityRecovery(reason, repoPath) {
     case "stop-incomplete":
     case "operation-unknown":
       return [`Run: devrouter stop ${repoPath}`, `Run: devrouter ensure ${repoPath} --repair`];
+    case "start-refused":
+      return [
+        `Run: devrouter doctor ${repoPath} to read the refused fixed host-port claim and its holder`,
+        `Stop the holding workspace or change this repository's own published binding, then run: devrouter ensure ${repoPath}`
+      ];
     case "unadmittable":
       return [
         `Run: devrouter stop ${repoPath}`,
@@ -15915,6 +15920,13 @@ function reliabilityRecovery(reason, repoPath) {
       return [];
   }
 }
+function refusedManagedStart(result) {
+  if (result?.ok !== true) return false;
+  const value = result.value;
+  if (typeof value !== "object" || value === null) return false;
+  const conflicts = value.hostPortConflicts;
+  return Array.isArray(conflicts) && conflicts.length > 0;
+}
 function readReliabilityStatus(options) {
   let provider;
   try {
@@ -15934,7 +15946,7 @@ function readReliabilityStatus(options) {
     return void 0;
   }
   if (!record5) return void 0;
-  const reason = reliabilityAttention(record5.state);
+  const reason = reliabilityAttention(record5.state) ?? (record5.state.desired === "running" && refusedManagedStart(record5.result) ? "start-refused" : void 0);
   return {
     desired: record5.state.desired,
     phase: record5.state.phase,
@@ -21024,7 +21036,7 @@ Run several worktrees of one repo in parallel without host/route collisions. A *
 - **TLS**: namespaced hosts (\`web.<ws>.localhost\`) are not covered by the \`*.localhost\` wildcard; devrouter auto-extends the mkcert cert SANs for active hosts when TLS is enabled.
 - **devcontainer integration**: managed scaffolds list the base compose file, then \`\${localEnv:DEVCONTAINER_COMPOSE_OVERLAY:docker-compose.default.yml}\`; custom repositories may keep another default overlay. Selecting \`.devcontainer/docker-compose.devrouter.yml\` for linked worktrees must pass \`WORKSPACE\` and \`DEVROUTER_WORKSPACE\` across the combined base/overlay config and bind-mount \`\${DEVROUTER_GIT_COMMON_DIR}\` to the same absolute app-container path. The app exposes \`\${WORKSPACE}-app\`; the proxy uses \`upstream: \${WORKSPACE}-app:<port>\`.
 - **Lifecycle**: after one-time \`setup\`, use \`ensure .\` for both primary and linked checkouts; never branch manually on checkout kind or use live verify as startup. \`stop .\` is non-destructive; \`stop . --delete\` is explicit exact-owner cleanup without worktree removal; and \`exec . -- <command...>\` runs one-shot commands only in the exact running workspace runtime (DevPod or Devsy). Never substitute raw \`devpod up\`, \`stop\`, \`delete\`, or the Devsy equivalents: they bypass devrouter's machine-global ownership lock, which serializes provider mutations in a fair arrival-order queue and lets contenders wait up to thirty minutes with throttled stderr progress before failing with the queue position or holder PID and true durations. Runtime selection is path-aware: \`DEVROUTER_WORKSPACE_RUNTIME=devpod|devsy\` forces one runtime, an exact-path registry owner wins next, then the machine preference from \`devrouter setup --workspace-runtime\`, then installed-CLI auto-detection. \`workspace up\` creates linked worktrees; destructive worktree removal and GC remain ledger-scoped. Dirty or locked full down fails before side effects. For Devsy, run \`devrouter setup --yes --workspace-runtime devsy\` once per installed Devsy release, rerunning it after a Devsy update, so Devrouter acquires and verifies the official Linux agent in its own machine cache. Devrouter supports Devsy releases in the range >=1.16.2 <2.0.0 and refuses a release whose published asset has no SHA-256 digest. \`doctor\` reports \`ready\`, \`missing\`, \`stale\`, or \`invalid\` without network access, and \`ensure\` fails before the provider queue when readiness is not \`ready\`. An explicit \`DEVSY_AGENT_BINARY\` remains authoritative and must match the official asset for the installed release.
-- **Interrupted lifecycle**: ensure reconciles an interrupted or never-dispatched ensure after positive worker drainage and automatically repairs retained degraded runtimes. Unknown arbitrary exec is never replayed; explicit stop reconciles that uncertainty. Preserve journals and retained configuration when evidence is unavailable. This does not provide OOM prevention or capacity-managed automatic recovery.
+- **Interrupted lifecycle**: ensure reconciles an interrupted or never-dispatched ensure after positive worker drainage and automatically repairs retained degraded runtimes. Unknown arbitrary exec is never replayed; explicit stop reconciles that uncertainty. A start refused before any provider mutation \u2014 a fixed published host port already held by a running container \u2014 stays visible in \`status\` as a \`start-refused\` attention reason naming the read-only \`doctor\` check and the consumer-side fix; an explicit \`stop\` releases the intent and the reason, and a later admitted ensure clears it. Preserve journals and retained configuration when evidence is unavailable. This does not provide OOM prevention or capacity-managed automatic recovery.
 - **Managed process identity**: \`ensure\` executes an exact captured adapter snapshot. Default reuse includes command argv, workspace, and adapter SHA-256. Set \`DEVROUTER_PROCESS_FINGERPRINT_ENV\` only to comma-separated non-secret environment names whose values affect runtime identity; secret-like names are rejected and raw values are never persisted.
 - **Route state**: the versioned Traefik dynamic file is authoritative for both metadata and rendering. JSON is a compatibility mirror; valid headerless generations migrate automatically, while corrupt canonical metadata fails closed.
 - **Cleanup**: \`workspace cleanup --repo . --inactive-for 30d --json\` is a report-only, no-\`--yes\` report for managed linked workspaces. It joins ownership (\`present|missing|locked|conflict\`), workspace runtime registration, runtime state (\`running|stopped|busy|not-found|absent|unknown\`), checkout, route, advisory activity, and integration evidence without mutating the workspace runtime, routes, ownership, Git, Docker, applications, worktrees, or branches. Local DevPod/Devsy list/status checks always run; \`--check-merged\` alone enables read-only origin and matching GitHub/GitLab checks. Treat \`not-found\` as stale runtime after Docker pruning; busy, unavailable, or conflicting evidence suppresses destructive suggestions. Explicit \`gc\`/\`down\` can remove exact stale registration only after expected-ID \`NotFound\` proof and ownership revalidation. GC never removes Git worktrees, branches, or prune state. Git has no worktree-removal hook.
@@ -21117,7 +21129,7 @@ Run several worktrees of one repo in parallel without host/route collisions. A *
 
 A managed consumer can gate agent tool calls so a command never starts while the
 checkout's environment is mid-transition. Wire \`devrouter harness gate\` as a
-Claude Code \`PreToolUse\` hook:
+\`PreToolUse\` hook. Claude Code reads it from a settings file:
 
     {
       "hooks": {
@@ -21129,7 +21141,26 @@ Claude Code \`PreToolUse\` hook:
       }
     }
 
-The hook reads the harness payload on stdin, defers inside the hook process while
+The Codex CLI reads the same hook from \`$CODEX_HOME/hooks.json\`, where the shell
+tool is named \`exec_command\`:
+
+    {
+      "hooks": {
+        "PreToolUse": [
+          { "matcher": "exec_command|Bash|shell", "hooks": [
+            { "type": "command", "command": "devrouter harness gate", "timeout": 180 }
+          ] }
+        ]
+      }
+    }
+
+The gate identifies the requesting harness from its payload and answers in that
+harness's accepted shape: a refusal is a \`deny\` in both, while an allowed call is
+\`permissionDecision: allow\` for Claude Code and Codex receives a bare completion
+carrying the same guidance as \`additionalContext\`, because Codex rejects an
+\`allow\` decision as unsupported hook output.
+
+
 the checkout's durable phase is \`queued\`, \`starting\`, \`verifying\`, \`recovering\`
 or \`stopping\`, and prints the harness permission decision. The deferral consumes
 no model turns because the harness is blocked on the hook. \`--wait-budget-ms\`
@@ -21141,7 +21172,7 @@ the wait budget: an overrunning hook is not honored, and the tool proceeds under
 the harness's normal permission rules. Use \`--json\` for the devrouter decision
 envelope with wait metrics.
 
-+Gated calls are keyed by the harness \`tool_use_id\` and recorded durably. If the
+Gated calls are keyed by the harness \`tool_use_id\` and recorded durably. If the
 harness re-delivers a call it already granted or cancelled, the gate returns one
 refusal naming the earlier decision instead of waiting again, because that call
 may already have run; the agent should verify it and issue a new call. Entries
@@ -21280,7 +21311,7 @@ function buildOnboardingPrompt(options = {}) {
     "- if kind=app and runtime=proxy:",
     "  - HTTP-only optional readiness: { path: /api/health, statuses: [200], contentType: application/json }; statuses default to [200], explicit lists allow unique 2xx/4xx codes, never redirects. Paths stay on the configured host with no query, fragment, percent escapes, backslash or dot segments. Media types match their case-insensitive base type.",
     "  - Declared application readiness failures return applicationReadiness.status=application-error and a nonzero ensure exit, while retaining tooling and routes for application fixes; do not reset caches or recreate the provider. Absent readiness means legacy route liveness, not full application readiness.",
-    "  - A configured FIXED published host binding already held by a running container refuses managed ensure before any provider start (hostPortConflicts in --json, nonzero exit) naming the port, holder container, compose project, and owning workspace when attributable. Ephemeral host::container bindings are exempt. Never rewrite consumer ports to resolve a conflict: stop the holding workspace or use the consumer's own override, then ensure again. Unverifiable evidence also refuses.",
+    "  - A configured FIXED published host binding already held by a running container refuses managed ensure before any provider start (hostPortConflicts in --json, nonzero exit) naming the port, holder container, compose project, and owning workspace when attributable. Ephemeral host::container bindings are exempt. Never rewrite consumer ports to resolve a conflict: stop the holding workspace or use the consumer's own override, then ensure again. The refused start stays visible in `devrouter status` as a `start-refused` attention reason that names the read-only `doctor` check and the consumer-side fix; an explicit `stop` releases the intent and the reason, and a later admitted ensure clears it. Unverifiable evidence also refuses.",
     '  - upstream: "host:port" (an already-running port, e.g. a devcontainer published on 127.0.0.1:3000, or a container reachable by name on a shared Docker network such as `derivatives-db:5432`)',
     `  - upstream may use the \`${WORKSPACE_PLACEHOLDER}\` placeholder (e.g. \`${WORKSPACE_PLACEHOLDER}-app:3000\`) to target a per-workspace devcontainer alias; it is substituted with the resolved workspace token at runtime and re-validated. Do NOT put \`${WORKSPACE_PLACEHOLDER}\` in \`host\` (rejected) \u2014 the host is auto-namespaced.`,
     "  - managed `devrouter ensure` requires every HTTP/TCP proxy upstream to begin with the exact resolved workspace/project alias prefix before it mutates DevPod or routes",
@@ -21354,7 +21385,7 @@ function buildOnboardingPrompt(options = {}) {
     `- When a workspace is active: hosts auto-namespace (\`web.localhost\` \u2192 \`web.<ws>.localhost\`), \`${WORKSPACE_PLACEHOLDER}\` in \`upstream\` is substituted with the token, and the docker \`router\` key is suffixed per workspace. Managed ensure rejects every HTTP/TCP upstream outside that exact alias namespace before mutation. The runtime config is computed in memory only \u2014 the committed \`.devrouter.yml\` is never rewritten.`,
     "- TLS: namespaced hosts (`web.<ws>.localhost`) are not covered by the `*.localhost` wildcard; devrouter auto-extends the mkcert cert SANs for active hosts when TLS is enabled.",
     "- Lifecycle: after one-time setup, use `devrouter ensure .` for both primary and linked checkouts; never branch on checkout kind or use live verify as startup. Managed consumer images contain no devrouter package/helper: ensure delivers its matching helper at runtime and invokes an exact captured snapshot of the repository-owned post-start adapter. Keep `.devrouter.yml` as the only consumer-side version pin. Use `devrouter stop .` for a non-destructive pause, `devrouter stop . --delete` only for explicit exact-owner cleanup without removing the checkout, and `devrouter exec . -- <command...>` for container commands. Never substitute raw DevPod/Devsy mutations; they bypass the machine-global ownership lock, which serializes provider mutations in a fair arrival-order queue and lets contenders wait up to thirty minutes with throttled stderr progress before failing with the queue position or holder PID and true durations. `workspace up` creates linked worktrees; destructive worktree removal and GC remain ledger-scoped.",
-    "- Managed agent harnesses can defer tool calls through `devrouter harness gate` wired as a Claude Code `PreToolUse` hook: it waits inside the hook process while the checkout's durable phase is queued, starting, verifying, recovering or stopping (no model turns), allows the tool once the phase settles, and refuses once with recovery guidance when `--wait-budget-ms` (default 30000) runs out. It also records the gated call by harness tool-use id, so a call re-delivered after a granted or cancelled wait returns one refusal instead of repeating a command that may already have run. Lifecycle commands pass through, unreadable journal evidence is allowed rather than blocking the agent, and the hook timeout must exceed the wait budget.",
+    "- Managed agent harnesses can defer tool calls through `devrouter harness gate` wired as a `PreToolUse` hook (Claude Code settings, or `$CODEX_HOME/hooks.json` for the Codex CLI with the `exec_command` shell tool): it waits inside the hook process while the checkout's durable phase is queued, starting, verifying, recovering or stopping (no model turns), allows the tool once the phase settles, and refuses once with recovery guidance when `--wait-budget-ms` (default 30000) runs out. It identifies the requesting harness from its payload and answers in that harness's accepted shape, because Codex rejects an `allow` decision. It also records the gated call by harness tool-use id, so a call re-delivered after a granted or cancelled wait returns one refusal instead of repeating a command that may already have run. Lifecycle commands pass through, unreadable journal evidence is allowed rather than blocking the agent, and the hook timeout must exceed the wait budget.",
     "- After a drained interrupted ensure, manual exec can use an exactly proven retained Devsy runtime with the plain local Docker command. Revalidate identity for each tooling command until later preparation reconciles startup; preserve configuration, data and interrupted history. This does not repair absent stop baselines or provide OOM protection.",
     "- Busy ensure and exec wait up to thirty minutes for a positively identified active lifecycle worker on the same checkout, with stderr progress. Do not stop healthy work to make room. Commands stay serial; timeout or cancellation before admission leaves prior work untouched. A lifecycle fence change cancels admission, and uncertain execution is never replayed.",
     "- Ensure reconciles interrupted or never-dispatched ensure after positive worker drainage. Unknown arbitrary exec never replays; use explicit stop to reconcile that uncertainty. Preserve journals and generated configuration if evidence is unavailable. This does not detect or prevent OOM; bounded automatic recovery runs only when the operator enables the capacity recovery policy.",
@@ -23174,7 +23205,7 @@ function probeInstalledCliVersion(executable) {
 }
 function buildCliPathCheck(options = {}) {
   const id5 = "global.cli-path";
-  const runningVersion = options.runningVersion ?? (true ? "0.0.80" : "0.0.0-dev");
+  const runningVersion = options.runningVersion ?? (true ? "0.1.1" : "0.0.0-dev");
   if (runningVersion === "0.0.0-dev") {
     return {
       id: id5,
@@ -24022,7 +24053,7 @@ async function buildDoctorReport(options = {}) {
           suggestion: `Remedy ${expansionNotice.remedy.code}: set a named default profile other than '${expansionNotice.profile}'${remedyCandidates}.`
         });
       }
-      const cliVersion = true ? "0.0.80" : "0.0.0-dev";
+      const cliVersion = true ? "0.1.1" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       const installedKnown = cliVersion !== "0.0.0-dev";
       const versionComparison = installedKnown && configVersion ? compareSemver(configVersion, cliVersion) : void 0;
@@ -25128,8 +25159,13 @@ var init_harness_gate = __esm({
 // src/commands/harness.ts
 var harness_exports = {};
 __export(harness_exports, {
+  detectHarnessHook: () => detectHarnessHook,
   runHarnessCommand: () => runHarnessCommand
 });
+function detectHarnessHook(payload) {
+  const turnId = payload.turn_id;
+  return typeof turnId === "string" && turnId.length > 0 ? "codex" : "claude";
+}
 function readStdin() {
   if (process.stdin.isTTY) {
     return Promise.resolve("");
@@ -25181,11 +25217,28 @@ function permitReason(decision) {
       return "devrouter: environment settled.";
   }
 }
-function hookOutput(decision) {
+function hookOutput(decision, kind) {
+  if (decision.decision === "refuse") {
+    return JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "deny",
+        permissionDecisionReason: permitReason(decision)
+      }
+    });
+  }
+  if (kind === "codex") {
+    return JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        additionalContext: permitReason(decision)
+      }
+    });
+  }
   return JSON.stringify({
     hookSpecificOutput: {
       hookEventName: "PreToolUse",
-      permissionDecision: decision.decision === "refuse" ? "deny" : "allow",
+      permissionDecision: "allow",
       permissionDecisionReason: permitReason(decision)
     }
   });
@@ -25209,6 +25262,7 @@ async function runHarnessCommand(method, options, repoPath, dependencies = {}) {
 `));
   const observe = dependencies.observe ?? readHarnessGateObservation;
   const raw = await (dependencies.stdin ?? readStdin)();
+  let kind = "claude";
   let payload;
   try {
     const parsed = JSON.parse(raw);
@@ -25218,28 +25272,35 @@ async function runHarnessCommand(method, options, repoPath, dependencies = {}) {
   }
   if (!payload) {
     const decision2 = gateDecision("allow", "hook-payload-invalid");
-    process.stdout.write(json ? `${JSON.stringify(decision2)}
-` : `${hookOutput(decision2)}
-`);
+    process.stdout.write(
+      json ? `${JSON.stringify(decision2)}
+` : `${hookOutput(decision2, kind)}
+`
+    );
     return;
   }
+  kind = detectHarnessHook(payload);
   const toolName = typeof payload.tool_name === "string" ? payload.tool_name : "";
   const toolInput = isRecord7(payload.tool_input) ? payload.tool_input : {};
   const command = typeof toolInput.command === "string" ? toolInput.command : "";
   if (toolName === "Bash" && DEVROUTER_COMMAND_RE.test(command)) {
     const decision2 = gateDecision("allow", "devrouter-command");
-    process.stdout.write(json ? `${JSON.stringify(decision2)}
-` : `${hookOutput(decision2)}
-`);
+    process.stdout.write(
+      json ? `${JSON.stringify(decision2)}
+` : `${hookOutput(decision2, kind)}
+`
+    );
     return;
   }
   const sessionCwd = repoPath ?? (typeof payload.cwd === "string" && payload.cwd.length > 0 ? payload.cwd : void 0);
   const repoRoot = sessionCwd ? findHarnessGateRepoRoot(sessionCwd) : void 0;
   if (!repoRoot) {
     const decision2 = gateDecision("allow", "unmanaged-checkout");
-    process.stdout.write(json ? `${JSON.stringify(decision2)}
-` : `${hookOutput(decision2)}
-`);
+    process.stdout.write(
+      json ? `${JSON.stringify(decision2)}
+` : `${hookOutput(decision2, kind)}
+`
+    );
     return;
   }
   const budgetMs = parseHarnessGateBudget(options.waitBudgetMs);
@@ -25290,7 +25351,7 @@ async function runHarnessCommand(method, options, repoPath, dependencies = {}) {
       };
       process.stdout.write(
         json ? `${JSON.stringify({ ...decision2, checkout: repoRoot })}
-` : `${hookOutput(decision2)}
+` : `${hookOutput(decision2, kind)}
 `
       );
       return;
@@ -25348,7 +25409,7 @@ async function runHarnessCommand(method, options, repoPath, dependencies = {}) {
   }
   process.stdout.write(
     json ? `${JSON.stringify({ ...decision, checkout: repoRoot })}
-` : `${hookOutput(decision)}
+` : `${hookOutput(decision, kind)}
 `
   );
 }
@@ -29972,7 +30033,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.0.80" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.1.1" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devrouter/cli",
-  "version": "0.0.80",
+  "version": "0.1.1",
   "description": "Local dev routing CLI with shared Traefik reverse proxy",
   "author": "Roland Schlaefli",
   "homepage": "https://github.com/rschlaefli/devrouter#readme",
@@ -52,6 +52,9 @@
     "qualify:controller": "node --import tsx scripts/qualify-controller.ts",
     "qualify:stop-drift": "node --import tsx scripts/qualify-config-drift-stop.ts",
     "qualify:harness-journey": "./scripts/qualify-harness-journey.sh",
+    "qualify:codex-journey": "DR_JOURNEY_HARNESS=codex ./scripts/qualify-harness-journey.sh",
+    "qualify:non-node": "./scripts/qualify-non-node-consumer.sh",
+    "qualify:slow-dependency": "./scripts/qualify-slow-dependency-recovery.sh",
     "test:process": "bash scripts/test-devrouter-process.sh",
     "check": "biome check .",
     "check:fix": "biome check --write .",

package/upgrade-prompts/0.1.0.md

@@ -0,0 +1,69 @@
+# Upgrade to devrouter 0.1.0
+
+This release is the first stable cut of the reliability program. The managed
+lifecycle is now driven by durable intent instead of a live CLI process, capacity
+admission refuses instead of guessing when its evidence is incomplete, and the
+agent harness gate serves Claude Code and the Codex CLI in the shape each of them
+accepts.
+
+## What changed for a consumer
+
+- A managed `stop` whose physical cessation is proven against a positively
+  absent capacity ledger now completes instead of staying in `stopping`
+  forever. An intact ledger keeps today's settlement and revision fencing, and
+  every other ledger classification still refuses.
+- `devrouter capacity reconcile --yes [--json]` is the explicit forward
+  recovery for a provably absent ledger. It refuses without `--yes`, while any
+  journal binding remains, and when a declared runtime domain cannot be observed.
+- `devrouter doctor` reports `global.cli-path` when another `devrouter` on
+  PATH is newer than the running CLI or when the shell resolves a different
+  install. Keep one install authoritative before trusting lifecycle state.
+- `devrouter harness gate` defers one agent tool call while the checkout's
+  durable phase is `queued`, `starting`, `verifying`, `recovering` or
+  `stopping`, waits inside the hook process with no model turns, and refuses
+  once with recovery guidance when the budget runs out. It identifies the
+  requesting harness from its payload: Claude Code receives
+  `permissionDecision: allow`, the Codex CLI receives the same guidance as
+  `additionalContext` because it reports an `allow` decision as unsupported
+  hook output. A re-delivered call returns one refusal that names the earlier
+  decision instead of repeating a command that may already have run.
+- A fixed host-port conflict whose holder is the shared `devrouter-traefik`
+  router names the consumer's own published binding as the side to change instead
+  of telling the agent to stop the router.
+- Managed `ensure` accepts a devnet upstream served by any Compose project owned
+  by the exact worktree, while a container owned by a different worktree or by a
+  shared project outside the checkout is still refused.
+
+## Task
+
+Use the published 0.1.0 CLI. Update the repository `devrouter.version` metadata
+only when consumer source changes are authorized, and refresh generated agent
+guidance only with its owner's authority. No schema, command, flag, environment
+or journal migration is needed, and the upgrade rewrites no runtime state.
+
+Two operating notes matter for scripts and agents:
+
+- `ensure` and `stop` write bounded progress lines to stderr. Parse JSON from
+  stdout only; do not merge the streams before parsing.
+- Capacity admission, parking consent and automatic recovery stay inert unless an
+  operator enables them. Nothing in this release starts, stops or parks a
+  consumer environment on its own.
+
+## Validation
+
+Verify the resolved executable and installed version, then run `devrouter
+doctor` and confirm `global.cli-path` reports one authoritative install and no
+newer shadow copy. For an authorized managed checkout, run `devrouter status`
+and confirm the reported intent, phase, capacity state and attention reason agree
+with the runtime you observe. Require each lifecycle operation's own terminal
+evidence: a status block or a progress line is not stop or ensure success. When
+the gate is wired, prove it once in the harness you use by gating a harmless
+command against a settled checkout.
+
+## Report
+
+Report the release revision, the executable and installed version, the
+CLI-path diagnostics, the status block for any affected checkout, and the
+terminal result of any authorized lifecycle operation. Keep source and package
+validation separate from consumer readiness or recovery, and record unknown
+ownership or surviving resources as unresolved rather than as recovered.

package/upgrade-prompts/0.1.1.md

@@ -0,0 +1,48 @@
+# Upgrade to devrouter 0.1.1
+
+This is a patch release on top of 0.1.0. It closes one way a managed environment
+could sit blocked without saying so: a start that admission refused on a fixed
+published host-port claim left the journal recording the intent as `running`
+while no runtime existed, so `devrouter status` reported a stable, drifting-free
+environment that could not progress.
+
+## What changed for a consumer
+
+- A managed `ensure` refused because a running container already holds a fixed
+  published host port now stays visible after the command exits. `devrouter
+  status` reports a `start-refused` attention reason with two recovery
+  commands: the read-only `devrouter doctor <repo>` check that names the
+  conflicting consumer binding and its holder, and the consumer-side fix
+  followed by `devrouter ensure <repo>`.
+- An explicit `devrouter stop <repo>` releases that intent and the reason, and a
+  later admitted ensure clears it. Nothing else about the refusal changed: the
+  start is still refused before any provider mutation, and live-worker,
+  unknown-ownership and surviving-resource checks still refuse fail-closed.
+- The release also carries `pnpm qualify:slow-dependency`, the developer
+  qualifier behind the Q06 dependency-recovery evidence. It is a repository
+  script and has no consumer-facing effect.
+
+## Task
+
+Use the published 0.1.1 CLI. Update the repository `devrouter.version` metadata
+only when consumer source changes are authorized, and refresh generated agent
+guidance only with its owner's authority. No schema, command, flag, environment
+or journal migration is needed, and the upgrade rewrites no runtime state.
+
+## Validation
+
+Verify the resolved executable and installed version, then run `devrouter
+doctor` for the checkout and confirm `global.cli-path` reports one
+authoritative install. Run `devrouter status` and confirm the reported intent,
+phase and attention reason agree with the runtime you observe. When the reported
+reason is `start-refused`, resolve the named binding as the owner of that
+port — the shared router is never the side to stop — and keep each lifecycle
+operation's own terminal evidence separate from a status block or progress line.
+
+## Report
+
+Report the release revision, the executable and installed version, the status
+block for any affected checkout, and the terminal result of any authorized
+lifecycle operation. Keep source and package validation separate from consumer
+readiness or recovery, and record unknown ownership or surviving resources as
+unresolved rather than as recovered.