chore(master): release 0.6.4 - #549
Conversation
Greptile SummaryUpdates the Arcbox workspace release metadata to version 0.6.4.
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains.
|
| Filename | Overview |
|---|---|
| Cargo.toml | Consistently bumps the workspace package and root-cadence internal dependency versions to 0.6.4 while preserving independently versioned crates. |
| Cargo.lock | Updates workspace package lockfile entries from 0.6.3 to 0.6.4. |
| .release-please-manifest.json | Advances only the root release component to 0.6.4. |
| CHANGELOG.md | Adds the generated release notes for version 0.6.4. |
Reviews (32): Last reviewed commit: "chore: update lockfiles for release" | Re-trigger Greptile
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes — the full release-please diff at 4b1bef1, covering both the generated release commit and the follow-up Cargo.lock regeneration.
- Manifest bump —
.release-please-manifest.jsonmoves the root"."component 0.6.3 → 0.6.4; the"fleet"component correctly stays at 0.1.3 (separate release train viaexclude-paths: ["fleet"]). - Changelog — one
## [0.6.4]section with a single### Bug Fixesentry for #548. This matchesgit log v0.6.3..masterexactly, which contains only34a5e641— no entries dropped. Cargo.toml—workspace.package.versionplus every dep pin carrying# x-release-please-version. The three manually-cadenced pins are correctly left alone:arcbox-hv = 0.3.20,arcbox-helper = 1.0.2,arcbox-boot = 0.8.0.Cargo.lock— all workspace member versions bumped by theUpdate Cargo.lock on release PRsstep.cargo metadata --locked --no-depsexits 0, so the tagged commit will satisfy thecargo publish --workspace --no-verify --lockedinrelease.yml.
A repo-wide grep for 0.6.3 finds no stale references outside CHANGELOG.md history and an unrelated third-party objc2 0.6.3 line in NOTICE.md.
ℹ️ This tag is the first to run the new crates.io publish-resume logic
The only commit in 0.6.4 is #548, which added the crate <name>@<ver> already exists on crates.io index → add-to-excludes → retry loop to release.yml's publish-crates job. Nothing in this diff can change that, but on a clean 0.6.4 no crate is pre-published, so the resume branch only engages if the publish partially fails mid-run — worth watching the publish job once this merges rather than assuming the fix is proven.
Claude Opus ｜ 𝕏
4b1bef1 to
dd01ccb
Compare
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes — the branch was regenerated since the prior pullfrog review at 4b1bef1 (which the force-push dismissed). Restricted to the PR's own files, the only thing that moved is CHANGELOG.md; Cargo.toml, Cargo.lock, and .release-please-manifest.json are byte-identical to the version reviewed last time.
- Changelog picked up two more commits — added a
### Performance Improvementsblock for #555 and #558, and moved the release date from 2026-08-03 to 2026-08-07. - Rebased onto the new
masterhead — merge-base is now72f0e745instead of34a5e641, and theCargo.lockauto-commit was regenerated on top of it asb4b347d.
Verification on the current head:
- Changelog matches history one-for-one. Exactly three non-merge commits sit after the 0.6.3 release commit
ba6aaaac—34a5e641(#548),1b4b7669(#555),72f0e745(#558) — and all three appear in the 0.6.4 section. Nothing dropped, nothing invented. Cargo.lockis consistent.cargo metadata --locked --no-depsexits 0, so the tag will satisfycargo publish --workspace --no-verify --lockedinrelease.yml. The lock diff is exactly 52version =line pairs and nothing else.- Version census is clean. 52 workspace members at 0.6.4;
arcbox-fleet-agent0.1.3,arcbox-hv0.3.20,arcbox-helper1.0.2 correctly untouched (separate cadences, no# x-release-please-versionmarker). A repo-wide grep for0.6.3across toml/json/yml/rs/lock finds no stale pin. - No new crates entered the workspace.
git diff --stat ba6aaaac 72f0e745 -- Cargo.toml release-please-config.jsonis empty, so #548/#555/#558 added no workspace member and changed no dependency — which rules out a newly-added crate failing the publish job for missing metadata, and explains why the lock diff is version lines only. - 0.6.4 is the right level.
perf:maps to a patch bump under release-please's conventional-commit defaults, so the two performance commits don't call for 0.7.0.
The sandbox behavior changes carried by #555/#558 (kernel quiet boot arg, resolv.conf on tmpfs, restore fast path) landed on master already and are outside this PR's diff — they are not re-reviewed here.
Claude Opus ｜ 𝕏
b4b347d to
7d8648d
Compare
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes — the branch was regenerated again since the prior pullfrog review at b4b347d (which the force-push dismissed). Restricted to the PR's own four files, the delta is a single added CHANGELOG.md line; Cargo.toml, Cargo.lock, and .release-please-manifest.json are byte-identical to what was reviewed last run.
- Changelog picked up one more commit — a
### Performance Improvementsentry for #559 (6d8ab5f). It sorts between the #555 and #558 entries rather than at the end, which is release-please's within-section ordering, not a mis-generated entry. Release date stays 2026-08-07. - Rebased onto the new
masterhead —git merge-base origin/master HEADis now6d8ab5f0, and theCargo.lockauto-commit was regenerated on top of it asfca6b4a.
Verification re-run against the current head:
- Changelog matches history one-for-one.
git log --no-merges ba6aaaac..6d8ab5f0returns exactly four commits —34a5e641(#548),1b4b7669(#555),72f0e745(#558),6d8ab5f0(#559) — and all four appear in the 0.6.4 section. Nothing dropped, nothing invented. Cargo.lockis consistent.cargo metadata --locked --no-depsexits 0, so the tagged commit will satisfycargo publish --workspace --no-verify --lockedinrelease.yml. The lock diff is exactly 52version =line pairs and nothing else.- Version census unchanged. 52 workspace members at 0.6.4, with exactly three off-cadence and correctly untouched:
arcbox-fleet-agent0.1.3,arcbox-hv0.3.20,arcbox-helper1.0.2 (no# x-release-please-versionmarker on their pins). A repo-wide grep for0.6.3across toml/json/yml/rs/lock finds no stale pin. - #559 added no workspace member and changed no dependency.
git diff --stat 72f0e745...6d8ab5f0 -- Cargo.toml release-please-config.json .release-please-manifest.jsonis empty, which keeps the "newly-added crate fails the publish job for missing metadata" class ruled out and explains why the lock diff is version lines only. - 0.6.4 is still the right level.
perf:maps to a patch bump under release-please's conventional-commit defaults.
The sandbox behavior carried by #559 (READY gated on agent vsock readiness, backed-off connect poll) landed on master already and is outside this PR's diff — not re-reviewed here.
Claude Opus ｜ 𝕏
fca6b4a to
73f12b2
Compare
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes — the branch was regenerated again since the prior pullfrog review at fca6b4a (which the force-push dismissed). Restricted to the PR's own four files, the delta is a single added CHANGELOG.md line; Cargo.toml, Cargo.lock, and .release-please-manifest.json are byte-identical to what was reviewed last run.
- Changelog picked up one more commit — a
### Performance Improvementsentry for #560 (b8b7631). It sorts between the #559 and #558 entries rather than at the end, which is release-please's within-section ordering, not a mis-generated entry. Release date stays 2026-08-07. - Rebased onto the new
masterhead —git merge-base origin/master HEADis nowb8b7631b, and theCargo.lockauto-commit was regenerated on top of it asf36e084.
Verification re-run against the current head:
- Changelog matches history one-for-one.
git log --no-merges ba6aaaac..b8b7631breturns exactly five commits —34a5e641(#548),1b4b7669(#555),72f0e745(#558),6d8ab5f0(#559),b8b7631b(#560) — and all five appear in the 0.6.4 section. Nothing dropped, nothing invented. Cargo.lockis consistent.cargo metadata --locked --no-depsexits 0, so the tagged commit will satisfycargo publish --workspace --no-verify --lockedinrelease.yml. Uniq-counting the changed lines in the lock hunk yields onlyversion = "0.6.3"×52 andversion = "0.6.4"×52 — nothing else moved.- Version census unchanged. 52 workspace members at 0.6.4, with exactly three off-cadence and correctly untouched:
arcbox-fleet-agent0.1.3,arcbox-hv0.3.20,arcbox-helper1.0.2 (no# x-release-please-versionmarker on their pins). A repo-wide grep for0.6.3across toml/json/yml/rs/swift/md/lock finds no stale pin outsideCHANGELOG.mdhistory and the unrelated third-partyobjc2 0.6.3line inNOTICE.md. - #560 added no workspace member and changed no dependency.
git diff --stat 6d8ab5f0...b8b7631b -- Cargo.toml release-please-config.json .release-please-manifest.jsonis empty, which keeps the "newly-added crate fails the publish job for missing metadata" class ruled out and explains why the lock diff is version lines only. - 0.6.4 is still the right level.
perf:maps to a patch bump under release-please's conventional-commit defaults, so fourperf:commits don't call for 0.7.0.
The sandbox behavior carried by #560 (boot readiness as a guest vsock dial-out event) landed on master already and is outside this PR's diff — not re-reviewed here.
Claude Opus ｜ 𝕏
f36e084 to
7f9971b
Compare
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes — the branch was regenerated again since the prior pullfrog review at f36e084 (which the force-push dismissed). Restricted to the PR's own four files, the delta is a single added CHANGELOG.md line; Cargo.toml, Cargo.lock, and .release-please-manifest.json are byte-identical to what was reviewed last run.
- Changelog picked up one more commit — a
### Performance Improvementsentry for #561 (6a08111). It sorts between the #560 and #558 entries rather than at the end, which is release-please's within-section ordering, not a mis-generated entry. Release date stays 2026-08-07. - Rebased onto the new
masterhead —git merge-base origin/master HEADis now6a081119, and theCargo.lockauto-commit was regenerated on top of it as031af59.
Verification re-run against the current head:
- Changelog matches history one-for-one.
git log --no-merges ba6aaaac..6a081119returns exactly six commits —34a5e641(#548),1b4b7669(#555),72f0e745(#558),6d8ab5f0(#559),b8b7631b(#560),6a081119(#561) — and all six appear in the 0.6.4 section. Nothing dropped, nothing invented. Cargo.lockis consistent.cargo metadata --locked --no-depsexits 0, so the tagged commit will satisfycargo publish --workspace --no-verify --lockedinrelease.yml.- Both bumped files carry version edits only. Uniq-counting the changed lines in the lock hunk yields
version = "0.6.3"×52 andversion = "0.6.4"×52 and nothing else; the 44 changedCargo.tomllines are byte-identical once the version token is masked, so no non-version edit rode along. - Version census unchanged. 52 workspace members at 0.6.4, with exactly three off-cadence and correctly untouched:
arcbox-fleet-agent0.1.3,arcbox-hv0.3.20,arcbox-helper1.0.2 (no# x-release-please-versionmarker on their pins). A repo-wide grep for0.6.3across toml/json/yml/rs/swift/md/lock finds no stale pin outsideCHANGELOG.mdhistory and the unrelated third-partyobjc2 0.6.3line inNOTICE.md. - #561 added no workspace member and changed no dependency.
git diff --stat b8b7631b...6a081119 -- Cargo.toml release-please-config.json .release-please-manifest.json Cargo.lockis empty, which keeps the "newly-added crate fails the publish job for missing metadata" class ruled out. - 0.6.4 is still the right level.
perf:maps to a patch bump under release-please's conventional-commit defaults, so fiveperf:commits don't call for 0.7.0.
The sandbox behavior carried by #561 (pre-warmed restore slots behind an LRU snapshot pool, new pool_size config field, delete_snapshot made async) landed on master already and is outside this PR's diff — not re-reviewed here.
Claude Opus ｜ 𝕏
031af59 to
cd64c6d
Compare
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes — the branch was regenerated again since the prior pullfrog review at 031af59 (which the force-push dismissed). Restricted to the PR's own four files, the delta is a single added CHANGELOG.md block; Cargo.toml, Cargo.lock, and .release-please-manifest.json are byte-identical to what was reviewed last run.
- Changelog gained a
### Featuressection — the train's first, holding #562 (4149fb1), placed above### Bug Fixes. Release date stays 2026-08-07. - Rebased onto the new
masterhead —git merge-base origin/master HEADis now4149fb1b, and theCargo.lockauto-commit was regenerated on top of it as196c82c.
Verification re-run against the current head:
- A
feat:in a patch release is correct here, not a mis-generated bump. This is the first non-fix/perfcommit in the 0.6.4 train, so 0.7.0 would be the natural expectation — butrelease-please-config.jsonsetsbump-patch-for-minor-pre-major: true, which makes a pre-1.0feat:a patch bump.bump-minor-pre-major: truereserves 0.7.0 for breaking changes, andgit log -1 --format=%B 4149fb1bshows #562 carries neither a!nor aBREAKING CHANGE:footer. 0.6.4 stands. - Changelog matches history one-for-one.
git log --no-merges ba6aaaac..4149fb1breturns exactly seven commits — #548, #555, #558, #559, #560, #561, #562 — and all seven appear in the 0.6.4 section. Nothing dropped, nothing invented. Cargo.lockis consistent.cargo metadata --locked --no-depsexits 0, so the tagged commit will satisfycargo publish --workspace --no-verify --lockedinrelease.yml.- Both bumped files carry version edits only. Uniq-counting the changed lines in the lock hunk yields
version = "0.6.3"×52 andversion = "0.6.4"×52 and nothing else; the 44 changedCargo.tomllines are byte-identical once the version token is masked, so no non-version edit rode along. - Version census unchanged. 52 workspace members at 0.6.4, with exactly three off-cadence and correctly untouched:
arcbox-fleet-agent0.1.3,arcbox-hv0.3.20,arcbox-helper1.0.2 (no# x-release-please-versionmarker on their pins), plus the externalarcbox-boot0.8.0. A repo-wide grep for0.6.3across toml/json/yml/rs/swift/md/lock finds no stale pin outsideCHANGELOG.mdhistory and the unrelated third-partyobjc2 0.6.3line inNOTICE.md. - #562 added no workspace member and changed no dependency.
git diff --stat 6a081119...4149fb1b -- Cargo.toml release-please-config.json .release-please-manifest.json Cargo.lockis empty, which keeps the "newly-added crate fails the publish job for missing metadata" class ruled out.
The sandbox behavior carried by #562 (every guest booting the fixed link-local identity, host-side per-TAP 1:1 translation, the net_invariant snapshot marker) landed on master already and is outside this PR's diff — not re-reviewed here. Worth noting only that the marker is #[serde(default)], so snapshots written by 0.6.3 load unchanged on 0.6.4 and keep the reconfig-RPC path; the upgrade direction needs no migration.
Claude Opus ｜ 𝕏
196c82c to
187ba34
Compare
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes — the branch was regenerated again since the prior pullfrog review at 196c82c (which the force-push dismissed). Restricted to the PR's own four files, the delta is a single added CHANGELOG.md line; Cargo.toml, Cargo.lock, and .release-please-manifest.json are byte-identical to what was reviewed last run.
- Changelog picked up one more commit — a
### Performance Improvementsentry for #566 (46ef5a3, eBPF TCX datapath for invariant sandbox NAT). It sorts between the #555 and #559 entries rather than at the end, which is release-please's within-section ordering, not a mis-generated entry. Release date stays 2026-08-07. - Rebased onto the new
masterhead —git merge-base origin/master HEADis now46ef5a36, and theCargo.lockauto-commit was regenerated on top of it as735a698.
Verification re-run against the current head:
- Changelog matches history one-for-one.
git log --no-merges ba6aaaac..46ef5a36returns exactly eight commits — #548, #555, #558, #559, #560, #561, #562, #566 — and all eight appear in the 0.6.4 section. Nothing dropped, nothing invented. - Both bumped files still carry version edits only. Uniq-counting the changed lines in the PR's
Cargo.lockhunks yieldsversion = "0.6.3"×52 andversion = "0.6.4"×52 and nothing else; the 44 changedCargo.tomllines are byte-identical once the version token is masked.cargo metadata --locked --no-depsexits 0, so the tag will satisfycargo publish --workspace --no-verify --locked. - Version census unchanged. 55 members, 52 at 0.6.4, exactly three off-cadence and correctly untouched:
arcbox-fleet-agent0.1.3,arcbox-helper1.0.2,arcbox-hv0.3.20 (no# x-release-please-versionmarker on their pins), plus the externalarcbox-boot0.8.0. A repo-wide grep for0.6.3across toml/json/yml/rs/swift/lock returns nothing. - #566 is the first commit in this train to move
Cargo.lockon the base side, and it does not affect the tag's publishability. Unlike #555–#562, it added a dependency — a Linux-onlyaya = "0.14.0"onvirt/arcbox-vm, pulling inaya-obj,object 0.39.1,hashbrown 0.17.1,assert_matches, and anindexmap2.13.0 → 2.14.0 bump. That is base content, not PR content (the PR's own lock diff against46ef5a36is still version lines only), but it is worth confirming becausearcbox-vmis in the publish set —release.ymlexcludes onlyarcbox-hvandarcbox-helper. Checked:cargo package -p arcbox-vm --no-verify --listincludes the committedbpf/sandbox_nat.bpf.oand both.sha256sidecars (noinclude/excludein the crate manifest, no*.orule in.gitignore), and theinclude_bytes!atvirt/arcbox-vm/src/network/ebpf.rs:37is#[cfg(target_os = "linux")]-gated, so macOS builds never need the blob. RootCargo.toml,release-please-config.json, and.release-please-manifest.jsonare untouched by #566, so no workspace member was added. - 0.6.4 is still the right level. #566 is a
perf:with no!and noBREAKING CHANGE:footer, which maps to a patch bump.
The sandbox behavior carried by #566 (TCX ingress/egress NAT programs replacing the CORE-81 iptables rule set, sandbox_datapath config knob with iptables fallback, onlink peer-route steering) landed on master already and is outside this PR's diff — not re-reviewed here.
Claude Opus ｜ 𝕏
735a698 to
8c414d5
Compare
|
Your Claude subscription has hit its usage limit. It resets at 11am (UTC). Re-trigger Pullfrog after the reset, or add an Add repo secret → · Model settings → · Setup docs → · Ask in Discord →
|
cc21a06 to
f9b4dc7
Compare
|
Your Claude subscription has hit its usage limit. It resets at 11am (UTC). Re-trigger Pullfrog after the reset, or add an Add repo secret → · Model settings → · Setup docs → · Ask in Discord →
|
c6440f8 to
8a685ff
Compare
|
Your Claude subscription has hit its usage limit. It resets at 11am (UTC). Re-trigger Pullfrog after the reset, or add an Add repo secret → · Model settings → · Setup docs → · Ask in Discord →
|
eb576ec to
d9ee395
Compare
|
Your Claude subscription has hit its usage limit. It resets at 11am (UTC). Re-trigger Pullfrog after the reset, or add an Add repo secret → · Model settings → · Setup docs → · Ask in Discord →
|
9354ac3 to
64c0029
Compare
There was a problem hiding this comment.
ℹ️ One cosmetic changelog issue; the release itself verifies clean.
Reviewed changes — delta since the prior pullfrog review (head was e0abc6d2):
CHANGELOG.md: 44 → 51 entries in the0.6.4section; release date2026-08-08→2026-08-10..release-please-manifest.json: only the root.bump is in PR scope; thesdk/pythoncontext line moved0.1.0→0.1.1on the base side.Cargo.toml/Cargo.lock: byte-identical in PR scope to the last review.
Verification
- Changelog ↔ history (both directions).
git log --no-merges ba6aaaac..6ad91a8d -- . ':!fleet' ':!sdk/typescript' ':!sdk/python'yields 50 root-scoped commits against 51 changelog entries.commin both directions gives exactly one asymmetry:bbda08adleaked in, nothing was dropped (the dangerous direction is clean). Detail inline onCHANGELOG.md:68. - Diff shape. The
Cargo.lock+Cargo.tomlhunks uniq toversion = "0.6.3"×52 /version = "0.6.4"×52 plus the 44# x-release-please-versionpin pairs; a second pass filtering out0.6.[34]returns zero lines. The three manually-pinned deps (arcbox-hv0.3.20,arcbox-helper1.0.2,arcbox-boot0.8.0) are correctly left untouched. No non-version edit rode along. - Lockfile.
cargo metadata --locked --no-depsexits 0 —release.ymlrunscargo publish --workspace --no-verify --lockedon the tag, so this is the gate that matters. - Version census. 55 workspace members, 52 at
0.6.4, three intentionally off-cadence (arcbox-fleet-agent0.1.3,arcbox-helper1.0.2,arcbox-hv0.3.20) — unchanged across every run of this train, so the 0.6.4 series added no member. Repo-wide grep finds no0.6.3stragglers outsidetarget/,node_modules/, andCHANGELOG.md. - Bump level. The only new
feat:in this delta (cad4fee2, #582) has no!and noBREAKING CHANGE:footer; withbump-minor-pre-major+bump-patch-for-minor-pre-major,0.6.4is the correct level. - Release pipeline.
.github/workflows/release.ymlis touched by exactly one commit in the whole 0.6.4 range (34a5e641, #548); the otherci:/fix(ci):commits hitci.ymland the SDK workflows. Tag routing re-checked:v0.6.4matchesrelease.ymlonly (sdk-python-v*/sdk-typescript-v*are disjoint). - Base-side publish-set delta since the last review is a single line (the manifest's
sdk/pythonbump) — #582, despite its size, moved no dependency and added no crate.
Claude Opus ｜ 𝕏
10b8a38 to
bd5b94c
Compare
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes — delta since the prior pullfrog review (head was 10b8a38b):
CHANGELOG.md: 51 → 59 entries in the0.6.4section (eight new Bug Fixes, one new Test, and thebbda08adDocumentation leak removed). Release date unchanged at2026-08-10..release-please-manifest.json/Cargo.toml/Cargo.lock: byte-identical in PR scope to the last review.- The nine added entries are exactly the nine commits in
6ad91a8d..052d392d— the branch was regenerated on the new master head.
Prior finding retired. The bbda08ad changelog leak flagged on CHANGELOG.md:68 is gone from the regenerated changelog (grep -c bbda08ad CHANGELOG.md = 0; the Documentation section is back to its single 7efe0d5 entry). Thread resolved.
Verification
- Changelog ↔ history (both directions).
git log --no-merges ba6aaaac..052d392d -- . ':!fleet' ':!sdk/typescript' ':!sdk/python'yields 59 root-scoped commits against 59 changelog entries;commin both directions is empty. Zero leaked, zero dropped — an exact set match, the cleanest result of this release train. - Diff shape. The
Cargo.lock+Cargo.tomlhunks uniq toversion = "0.6.3"×52 /version = "0.6.4"×52 plus the 44# x-release-please-versionpin pairs (88 changedCargo.tomllines, all 88 marked, none without); a second pass filtering out0.6.[34]returns zero lines. The three manually-pinned deps (arcbox-hv0.3.20,arcbox-helper1.0.2,arcbox-boot0.8.0) are correctly left untouched, each with its explanatory comment intact. - Lockfile.
cargo metadata --locked --no-depsexits 0 —release.ymlrunscargo publish --workspace --no-verify --lockedon the tag, so this is the gate that matters. - Version census. 55 workspace members, 52 at
0.6.4, three intentionally off-cadence (arcbox-fleet-agent0.1.3,arcbox-helper1.0.2,arcbox-hv0.3.20) — unchanged across every run of this train, so the 0.6.4 series added no member. Repo-wide grep finds no0.6.3stragglers outsidetarget/,node_modules/, andCHANGELOG.md(onlyNOTICE.md's unrelated third-partyobjc2 0.6.3). - Bump level. This delta adds no
feat:at all — eightfix:and onetest:, all with empty bodies, no!, noBREAKING CHANGE:footer. Withbump-minor-pre-major+bump-patch-for-minor-pre-major,0.6.4remains correct. - Manifest.
{".": "0.6.4", "fleet": "0.1.3", "sdk/typescript": "0.1.1", "sdk/python": "0.1.1"}agrees withsdk/typescript/package.jsonandsdk/python/pyproject.toml;v0.6.4still routes torelease.ymlonly (sdk-python-v*/sdk-typescript-v*are disjoint). - Base-side dependency graph — first movement in this train, and publish-safe.
git diff 6ad91a8d...052d392d -- Cargo.lockis 5 insertions / 2 deletions, adding three edges:arcbox-cli+=anstream(registry,1.0.0),arcbox-core+=semver(registry,1.0.28), andarcbox-api+=arcbox-transportviaworkspace = true, inheriting the root pin{ version = "0.6.4", path = "rpc/arcbox-transport" }with its# x-release-please-versionmarker — so it is one of the 44 pins this PR bumps and the tag publishes it at a matching version. A path dep lacking a version requirement is the one shape that hard-failscargo publish --workspace --locked; a repo-wide sweep finds no bare path deps in the publish set.
Claude Opus ｜ 𝕏
aa009dd to
227148d
Compare
There was a problem hiding this comment.
ℹ️ The changelog leak recurred; the release itself verifies clean.
Reviewed changes — delta since the prior pullfrog review (head was aa009dd2):
CHANGELOG.md: 59 → 61 entries in the0.6.4section. Release date unchanged (2026-08-10)..release-please-manifest.json/Cargo.toml/Cargo.lock: byte-identical in PR scope to the last review.
Exactly two changelog lines are new. One is legitimate — e40e57a (feat(api): list sandbox exposed ports (CORE-102), #585), the single new base commit. The other is the bbda08a leak that the previous regeneration had removed; detail inline on CHANGELOG.md:78.
Verification
- Changelog ↔ history (both directions).
git log --no-merges ba6aaaac..e40e57af -- . ':!fleet' ':!sdk/typescript' ':!sdk/python'yields 60 root-scoped commits against 61 changelog entries.commin both directions gives exactly one asymmetry:bbda08adleaked in, nothing was dropped — the dangerous direction is clean, as it has been on every run of this train. - Diff shape. The
Cargo.lock+Cargo.tomlhunks uniq toversion = "0.6.3"×52 /version = "0.6.4"×52 plus the 44# x-release-please-versionpin pairs; a second pass filtering out0.6.[34]returns zero lines. The three manually-pinned deps (arcbox-hv0.3.20,arcbox-helper1.0.2,arcbox-boot0.8.0) are correctly left untouched. No non-version edit rode along. - Lockfile.
cargo metadata --locked --no-depsexits 0 —release.ymlrunscargo publish --workspace --no-verify --lockedon the tag, so this is the gate that matters. - Version census. 55 workspace members, 52 at
0.6.4, three intentionally off-cadence (arcbox-fleet-agent0.1.3,arcbox-helper1.0.2,arcbox-hv0.3.20) — unchanged across every run of this train, so the 0.6.4 series added no member. Repo-wide grep finds no0.6.3stragglers outsidetarget/,node_modules/,CHANGELOG.md, and a third-partyobjc2 0.6.3line inNOTICE.md. - Bump level. The only new
feat:in this delta (e40e57af) squashes three bullets (feat(api)/fix(api)/docs(api)) with no!and noBREAKING CHANGE:footer; withbump-minor-pre-major+bump-patch-for-minor-pre-major,0.6.4is the correct level. - Base-side publish set is untouched.
git diff --stat 052d392d...e40e57afoverCargo.toml,Cargo.lock,release-please-config.json,.release-please-manifest.json,release.ymlandrelease-please.ymlis empty — #585 moved no dependency edge, added no crate, and changed neither release pipeline. - Manifest agreement.
{".": "0.6.4", "fleet": "0.1.3", "sdk/typescript": "0.1.1", "sdk/python": "0.1.1"}matchessdk/typescript/package.jsonandsdk/python/pyproject.toml. Tag routing re-checked:v0.6.4matchesrelease.ymlonly (sdk-python-v*/sdk-typescript-v*are disjoint).
Claude Opus ｜ 𝕏
b8721af to
f1b6957
Compare
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes — delta since the prior pullfrog review (head was b8721afc):
CHANGELOG.mdis the only file that moved in PR scope — one entry added, one removed, so the0.6.4section stays at 61 entries. Release date unchanged (2026-08-10)..release-please-manifest.json/Cargo.toml/Cargo.lock— byte-identical in PR scope to the last review.- The previously flagged changelog leak is gone.
bbda08ano longer appears;Documentationis back to its single legitimate entry. Prior thread retired.
The added line is b79304a (fix(sandbox): classify file read/write errors on the file channel, #586) in Bug Fixes — the single new base commit.
Verification
- Changelog ↔ history, both directions — exact match.
git log --no-merges ba6aaaac..b79304a5 -- . ':!fleet' ':!sdk/typescript' ':!sdk/python'yields 61 root-scoped commits against 61 changelog entries / 61 unique shas;commin both directions is empty. Nothing leaked in, nothing dropped. - Lockfile.
cargo metadata --locked --no-depsexits 0 — this is the gate that matters, sincerelease.yml'spublish-cratesjob runscargo publish --workspace --no-verify --lockedon the tag. - Diff shape. The
Cargo.lock+Cargo.tomlhunks uniq toversion = "0.6.3"×52 /version = "0.6.4"×52, plus theworkspace.package.versionpair and 44# x-release-please-versionpin pairs. A second pass filtering out0.6.[34]returns zero lines, so no non-version edit rode along. The three manually-cadenced pins are correctly untouched (arcbox-hv0.3.20,arcbox-helper1.0.2,arcbox-boot0.8.0), and every bumped pin still carries an explicitversionalongside itspath— the one shape that hard-failscargo publish. - Version census. 55 workspace members, 52 at
0.6.4, three intentionally off-cadence (arcbox-fleet-agent0.1.3,arcbox-helper1.0.2,arcbox-hv0.3.20) — unchanged across every run of this train, so the 0.6.4 series added no member. Repo-wide grep finds no0.6.3stragglers outsidetarget/,node_modules/,CHANGELOG.md, and a third-partyobjc2 0.6.3line inNOTICE.md. - Bump level. The delta adds no new
feat:at all.b79304a5is afix:with two squashed bullets (fix(sandbox)/ci(vm)), no!and noBREAKING CHANGE:footer; withbump-minor-pre-major+bump-patch-for-minor-pre-majorbothtrue,0.6.4is the correct level. - Base-side publish set is untouched.
git diff --stat e40e57af...b79304a5overCargo.toml,Cargo.lock,release-please-config.json,.release-please-manifest.json,release.ymlandrelease-please.ymlis empty — #586 touches only.github/workflows/test-vm-linux.ymland twovirt/arcbox-vmsources, so it moved no dependency edge and changed neither release pipeline. - Manifest agreement and tag routing.
{".": "0.6.4", "fleet": "0.1.3", "sdk/typescript": "0.1.1", "sdk/python": "0.1.1"}matchessdk/typescript/package.jsonandsdk/python/pyproject.toml.v0.6.4matchesrelease.ymlonly —sdk-python-v*/sdk-typescript-v*are disjoint.git merge-base origin/master HEADisb79304a5, the currentmasterhead, so the branch is regenerated on the current tip with no stale rebase.
Claude Opus ｜ 𝕏
8a952c3 to
17aa9f4
Compare
There was a problem hiding this comment.
ℹ️ The changelog leak recurred on a different commit; the release mechanics themselves verify clean.
Reviewed changes — delta since the prior pullfrog review (head was 8a952c3d, dismissed by the regeneration):
CHANGELOG.mdis the only file that moved in PR scope — the0.6.4section went 61 → 63 entries. Release date unchanged (2026-08-10).- Added the one new base commit —
82c8b65feat(sandbox): template catalog store with GC pins (CORE-107) (#590)under Features (new-file line 25). Read in full: five squashed bullets, no!, noBREAKING CHANGE:footer, and it adds no workspace member. - Re-introduced an sdk-only Documentation entry —
d240b92reappeared at new-file line 80, flagged inline. Cargo.toml,Cargo.lockand.release-please-manifest.jsonare byte-identical in PR scope to the prior review — same 52 lock version pairs, same 44 marker-carrying pin pairs, same single manifest bump.
Verification run against this head:
- Changelog ↔ history set comparison over
ba6aaaac..82c8b651with the rootexclude-pathspathspec: 62 root-scoped commits vs 63 changelog entries.comm -23(drops) is empty — nothing root-scoped was lost, which is the direction that would actually block.comm -13returns the single leak below. cargo metadata --locked --no-depsexits 0, soCargo.lockagrees with the bumpedCargo.toml(load-bearing:release.ymlpublishes with--locked).- Version census: 55 members, 52 at 0.6.4, exactly three off-cadence (
arcbox-hv0.3.20,arcbox-helper1.0.2,arcbox-fleet-agent0.1.3) — unchanged, so the train still adds no crate. - Diff-shape census over the
Cargo.lock+Cargo.tomlhunks: only0.6.3/0.6.4version tokens; the non-0.6.[34]filter pass returns zero lines. No non-version edit smuggled in. grepfor0.6.3across toml/json/yml/rs/swift/lock/py/ts returns nothing outsidetarget/,node_modules/,CHANGELOG.mdandNOTICE.md.- Base-side publish-set delta
b79304a5...82c8b651overCargo.toml,Cargo.lock, both release-please files and both release workflows is empty, so #590 moved no dependency edge and touched neither release pipeline. git merge-base origin/master HEAD=82c8b651= currentmasterhead, so the branch is regenerated on the current tip.- Bump level:
bump-minor-pre-majorandbump-patch-for-minor-pre-majorare bothtrue, so pre-1.0 a plainfeat:is a patch bump. 0.6.4 holds. - Manifest cross-check:
sdk/typescript0.1.1 andsdk/python0.1.1 agree withpackage.json/pyproject.toml.
Claude Opus ｜ 𝕏
| ### Documentation | ||
|
|
||
| * **sandbox:** pause/resume semantics + resolve the Pause-from-RUNNING ambiguity ([7efe0d5](https://github.com/arcboxlabs/arcbox/commit/7efe0d55d07a368f15cd7bfec328075db8c22591)) | ||
| * **sdk:** mark the PyPI publish workflow pending and record the bootstrap caveats ([d240b92](https://github.com/arcboxlabs/arcbox/commit/d240b92b1e4277f7c41f1dd30f89a608e5c7eb05)) |
There was a problem hiding this comment.
d240b92 touches only sdk/python/README.md, which sits under the root component's exclude-paths, so this entry should not be in the root changelog — it belongs to the sdk-python component. This is the same non-deterministic release-please misclassification seen earlier in this train (previously on bbda08ad), not a new class; it is cosmetic and does not affect the bump or the published artifacts.
Technical details
# sdk-only commit leaks into the root changelog
## Affected sites
- `CHANGELOG.md:80` — `* **sdk:** mark the PyPI publish workflow pending and record the bootstrap caveats ([d240b92](...))`. `git show --stat d240b92b` is `sdk/python/README.md | 48 +-` and nothing else, so the root component's `exclude-paths: ["fleet", "sdk/typescript", "sdk/python"]` should have filtered it.
## Required outcome
- No fix in this PR. Do NOT hand-edit `CHANGELOG.md`: the next regeneration force-pushes over it.
## Root cause (already verified against upstream source; do not re-derive)
- `shouldInclude` in release-please's `src/util/commit-exclude.ts` short-circuits on `!commit.files`, so a commit whose changed-file list release-please could not resolve bypasses `exclude-paths` entirely. `manifest.ts` passes `backfillFiles: true` as the mitigation, which makes this a transient per-run resolution failure rather than a misconfiguration.
- Consistent with the observed non-determinism: the leaking identity has changed between regenerations (`0d354483` → `d240b92` → none → `bbda08ad` → none → `bbda08ad` → none → `d240b92` again). A clean regeneration is not a fix and a leaking one is not a regression.
## Open questions for the human
- `.github/workflows/release-please.yml:25` pins `googleapis/release-please-action@v4`, a floating major tag, so the generator version can move between regenerations with no repo change. Hash-pinning it would at least make this reproducible and make an upgrade actionable — worth a tracked issue rather than anything in this PR.
0c044b6 to
38ad871
Compare
|
Your Claude subscription has hit its usage limit. It resets at 5pm (UTC). Re-trigger Pullfrog after the reset, or add an Add repo secret → · Model settings → · Setup docs → · Ask in Discord →
|
e167462 to
da3a316
Compare
|
Your Claude subscription has hit its usage limit. It resets at 5pm (UTC). Re-trigger Pullfrog after the reset, or add an Add repo secret → · Model settings → · Setup docs → · Ask in Discord →
|
98c3959 to
1411960
Compare
|
Your Claude subscription has hit its usage limit. It resets at 5pm (UTC). Re-trigger Pullfrog after the reset, or add an Add repo secret → · Model settings → · Setup docs → · Ask in Discord →
|
383415c to
700caf1
Compare
|
Your Claude subscription has hit its usage limit. It resets at 5pm (UTC). Re-trigger Pullfrog after the reset, or add an Add repo secret → · Model settings → · Setup docs → · Ask in Discord →
|
c45c26a to
4f19f91
Compare
|
Your Claude subscription has hit its usage limit. It resets at 5pm (UTC). Re-trigger Pullfrog after the reset, or add an Add repo secret → · Model settings → · Setup docs → · Ask in Discord →
|
|
🤖 Created releases: 🌻 |
1 participant
🤖 I have created a release beep boop
0.6.4 (2026-08-10)
Features
Bug Fixes
Performance Improvements
Tests
Documentation
Build System
Continuous Integration
Miscellaneous Chores
This PR was generated with Release Please. See documentation.