@devrouter/cli 0.6.3 → 0.6.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devrouter/cli",
-  "version": "0.6.3",
+  "version": "0.6.5",
   "description": "Local dev routing CLI with shared Traefik reverse proxy",
   "author": "Roland Schlaefli",
   "homepage": "https://github.com/rschlaefli/devrouter#readme",

package/upgrade-prompts/0.6.4.md

@@ -0,0 +1,67 @@
+# Upgrade to devrouter 0.6.4
+
+This release adds explicit stopped-primary replacement through
+`ensure <checkout> --replace-app` and preserves newer-writer classification in
+journal enumeration and capacity diagnostics. Replacement discards the primary
+container's writable layer while retaining proved dependencies and named/bind
+storage. It does not apply changed Compose overlays, replace data services,
+reset data or qualify retained maintenance.
+
+## Task
+
+After publication and installation are separately approved, select the exact
+published CLI through the consumer's existing package-manager convention.
+Verify the executable/version, update `devrouter.version` in `.devrouter.yml`
+and refresh existing agent guidance through `devrouter repo agents` within
+consumer adaptation authority. No configuration schema migration is needed.
+Do not start a consumer environment merely to verify the version change.
+
+Before this release writes lifecycle state, coordinate the same qualified
+release across participating agents, harnesses, controllers and source/package
+invocations sharing those journals. Check every PATH-visible executable and
+known wrapper/pin; obtain each participating owner's actual identity rather
+than treating PATH inventory as a complete fleet inventory. Unknown or competing
+writers hold activation. Changing a running controller/worker or global tool
+selection still needs its own authority. No global registry is required.
+
+A real 0.6.4 writer makes released 0.6.3 refuse direct journal reads/updates,
+global enumeration, ensure/exec/stop and controller recovery admission. This is
+expected fail-closed behavior, including after synthetic canonical-stop proof.
+The release qualification uses checksum-verified package bytes and isolated
+state; worker IPC and live consumer recovery remain separately unproved.
+An older CLI is not a supported rollback after newer writes. Preserve all
+journal bytes, writer stamps and replacement receipts. Recovery uses a qualified
+compatible CLI and exact ownership proof under the owner's runtime authority;
+never edit state or clear a receipt to bypass refusal.
+
+For an already-authorized preservation test, follow the full current
+`docs/DEVCONTAINER.md` replacement contract. Initial support is manual managed
+Compose on Devsy 1.24.0, canonical stopped-generation proof, unchanged committed
+managed source, qualified preserving hooks, retained non-primary dependencies
+and named storage. Allocated networks, capacity enrollment, anonymous mounts
+and namespace consumers refuse. Provider setup, builds/pulls and writable-layer
+loss are not inferred approvals.
+
+The durable replacement attempt is consumed before dispatch. Failure,
+cancellation, uncertainty, stop, registration changes, journal rollover and
+new request IDs never rearm it. Repeated replacement in the same checkout is
+unsupported. Use only supported ownership-proven stop/stop --repair for a
+blocked attempt; never retry with raw provider recreation. Keep the original
+application outcome distinct from infrastructure proof.
+
+## Validation
+
+1. Run static consumer checks for the actual version/guidance edits and report
+   every participating executable/harness identity and remaining unknowns.
+2. Under the receiving owner's separate runtime/data authority, perform only
+   its bounded supported preservation journey, proving actual retained data,
+   required application work, dependency/storage identity and readiness.
+3. End with canonical stop and exact stopped/route/worker proof unless the user
+   explicitly retains that environment. Missing proof remains unknown.
+
+## Report
+
+Report source/package integrity, exact selected executable and provider identities,
+participating adoption/downgrade limits, producing verification runs, retained
+receipt/data evidence, unresolved prerequisites and final runtime state. Published
+or installed compatibility alone does not establish consumer recovery.

package/upgrade-prompts/0.6.5.md

@@ -0,0 +1,45 @@
+# Upgrade to devrouter 0.6.5
+
+Status and doctor now recommend `devrouter ensure <checkout>` for managed
+repositories, including profiles with no routed apps. The command quotes the
+exact checkout path. Legacy app guidance and existing unwound-mount diagnostics
+remain. No configuration schema or provider/lifecycle contract changes.
+
+## Task
+
+Within approved installation/adaptation scope, select the verified exact package,
+update `devrouter.version` in `.devrouter.yml` and refresh existing agent guidance
+with `devrouter repo agents`. Check every PATH-visible executable and known
+wrapper, package/source invocation and harness/controller pin. Obtain participating
+owners' actual executable/package identities; PATH inventory is not fleet proof.
+Do not start a consumer to validate metadata or installation.
+
+Before the first 0.6.5 lifecycle write, coordinate compatible qualified clients
+sharing those journals, including readers and controllers. Older 0.6.4 refuses
+newer-writer state, including direct reads, updates and global enumeration.
+Unknown or competing client identities hold activation. Each receiving host
+and consumer retains its own runtime/data authority and consumed attempt limits.
+Installation and a release notice do not authorize activation.
+
+Preserve journal bytes, writer stamps and durable initialization/replacement
+receipts. Downgrading an older reader is not a recovery route after newer writes.
+Use a compatible qualified CLI with fresh ownership proof for authorized recovery;
+never erase or edit state to bypass refusal or rearm an attempt.
+
+## Validation
+
+1. Verify selected package integrity, executable bytes/version and existing local
+   guidance. Run native checks for the actual consumer edits.
+2. Use canonical exact-checkout ensure only under the receiving owner's separate
+   runtime authority. Diagnostic startup guidance is advice, not approval or proof
+   that all startup preconditions hold. Retain known refusals and unknown outcomes.
+3. Any separately authorized runtime work ends with canonical stop and exact
+   provider/container/route/worker proof, unless explicitly retained by the user.
+
+## Report
+
+Report the exact selected package and executable identities, participating-client
+adoption and remaining unknowns, relevant checks and any actual runtime terminal.
+Keep release/package proof distinct from consumer recovery. This patch's
+qualification does not add provider combinations, maintenance/reset support,
+consumer data acceptance or permission for another runtime attempt.