[Release] Synchronize for release

.bazelrc

@@ -11,6 +11,14 @@ try-import submodules/dev-tools/.bazelrc
 # TODO: Remove the need to fallback to local.
 build --spawn_strategy=processwrapper-sandbox,local
 
+# Run exclusive tests in a sandbox rather than with the bare
+# local strategy. Without this, exclusive tests bypass the
+# remote cache entirely (the local spawn runner does not
+# consult the remote cache in Bazel 6.5). This flag defaults
+# to true in Bazel 7, so this line can be removed when we
+# upgrade.
+test --incompatible_exclusive_test_sandboxed
+
 # When we use C++, we use C++17.
 build --cxxopt='-std=c++17'
 build --host_cxxopt='-std=c++17'

.github/actions/setup-bazel-remote-cache/action.yml

@@ -30,10 +30,19 @@ runs:
           echo "${{ inputs.environment-id }}" >> the_environment.txt
         fi
         echo $(uname -rsm) >> the_environment.txt
-        echo $(lscpu) >> the_environment.txt
+        # Exclude BogoMIPS from lscpu output: it's a
+        # runtime-measured value that fluctuates slightly on
+        # every boot (e.g. 5199.99 vs 5200.00), even on
+        # identical hardware, causing needless cache
+        # invalidation.
+        lscpu | grep -v BogoMIPS >> the_environment.txt
         if [ "${{ inputs.include-devcontainer-json }}" = "true" ]; then
           cat .devcontainer/devcontainer.json >> the_environment.txt
         fi
+        echo "the_environment.txt:"
+        echo "----"
+        cat the_environment.txt
+        echo "----"
 
     - name: Create user.bazelrc for remote cache
       shell: bash
@@ -57,3 +66,9 @@ runs:
         echo "----"
         cat user.bazelrc
         echo "----"
+        # If there's a `public`/ folder, also write a `user.bazelrc`
+        # there - the `public/` folder represents a separate Bazel
+        # workspace that should also get the remote cache configuration.
+        if [ -d public ]; then
+          cp user.bazelrc public/user.bazelrc
+        fi

Dockerfile

@@ -316,6 +316,15 @@ RUN set -e; \
     chmod +x ${BINARY_NAME}; \
     mv ${BINARY_NAME} /usr/local/bin/envoy
 
+# Install `ngrok`, useful in testing MCP servers from non-local clients
+# like `claude.ai` - or to intercept traffic for inspection.
+RUN curl -sSL https://ngrok-agent.s3.amazonaws.com/ngrok.asc \
+  | sudo tee /etc/apt/trusted.gpg.d/ngrok.asc >/dev/null \
+  && echo "deb https://ngrok-agent.s3.amazonaws.com bookworm main" \
+  | sudo tee /etc/apt/sources.list.d/ngrok.list \
+  && sudo apt update \
+  && sudo apt install ngrok
+
 # Ensure presence of relevant system groups.
 RUN groupadd -f --system docker
 RUN groupadd -f --system ssh
@@ -533,6 +542,29 @@ ARG FIREBASE_VERSION=13.26.0
 RUN npm install -g corepack firebase-tools@${FIREBASE_VERSION} \
     && corepack enable
 
+# Install `kubectl krew` plugin manager, and the `resource-capacity`
+# plugin. We use a shared `KREW_ROOT` so that any user can run `kubectl
+# krew` without permission issues.
+ARG KREW_VERSION=v0.4.4
+ENV KREW_ROOT=/opt/krew
+RUN set -e; \
+    case "${TARGETARCH}" in \
+        amd64|arm64) ;; \
+        *) echo "Unsupported arch for krew: ${TARGETARCH}" >&2; exit 1 ;; \
+    esac; \
+    TMPDIR="$(mktemp -d)" \
+    && cd "${TMPDIR}" \
+    && KREW="krew-linux_${TARGETARCH}" \
+    && curl -fsSLO "https://github.com/kubernetes-sigs/krew/releases/download/${KREW_VERSION}/${KREW}.tar.gz" \
+    && tar zxf "${KREW}.tar.gz" \
+    && ./"${KREW}" install krew \
+    && ln -s "${KREW_ROOT}/bin/kubectl-krew" /usr/local/bin/kubectl-krew \
+    && kubectl krew install resource-capacity \
+    && ln -s "${KREW_ROOT}/bin/kubectl-resource_capacity" /usr/local/bin/kubectl-resource_capacity \
+    && chown -R ${UNAME}: "${KREW_ROOT}" \
+    && chmod -R a+rX "${KREW_ROOT}" \
+    && rm -rf "${TMPDIR}"
+
 # Install Claude Code. We're not worried about breaking changes in this
 # tool (we don't use its API or CLI, it's human-driven) so we don't need
 # to pin its version, and in fact leave its default auto-update function

README.md

@@ -43,7 +43,7 @@ class CreateCounterResponse(Model):
     counter_id: str = Field(tag=1)
 
 
-class SessionState(Model):
+class UserState(Model):
     pass
 
 
@@ -61,8 +61,8 @@ class IncrementRequest(Model):
 
 
 api = API(
-    Session=Type(
-        state=SessionState,
+    User=Type(
+        state=UserState,
         methods=Methods(
             create_counter=Transaction(
                 request=None,

bazel/rocksdb/rocksdb.BUILD

@@ -61,7 +61,6 @@ cmake(
     },
     lib_source = ":all",
     out_static_libs = ["librocksdb.a"],
-    tags = ["no-cache"],
     visibility = ["//visibility:public"],
     deps = [
         "@com_github_gflags_gflags//:gflags",

charts/reboot/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: 3.3.2
 name: reboot
-version: "0.45.2"
+version: "0.46.0"
 description: Reboot is a programming framework that enables transactional microservices built with the developer in mind.
 type: application
 keywords:
@@ -10,4 +10,4 @@ keywords:
   - scalable
   - reactive
 home: https://docs.reboot.dev/
-appVersion: "0.45.2"
+appVersion: "0.46.0"

ci/templates/setup-bazel-remote-cache.action.yml

@@ -26,10 +26,19 @@ runs:
           echo "${{ inputs.environment-id }}" >> the_environment.txt
         fi
         echo $(uname -rsm) >> the_environment.txt
-        echo $(lscpu) >> the_environment.txt
+        # Exclude BogoMIPS from lscpu output: it's a
+        # runtime-measured value that fluctuates slightly on
+        # every boot (e.g. 5199.99 vs 5200.00), even on
+        # identical hardware, causing needless cache
+        # invalidation.
+        lscpu | grep -v BogoMIPS >> the_environment.txt
         if [ "${{ inputs.include-devcontainer-json }}" = "true" ]; then
           cat .devcontainer/devcontainer.json >> the_environment.txt
         fi
+        echo "the_environment.txt:"
+        echo "----"
+        cat the_environment.txt
+        echo "----"
 
     - name: Create user.bazelrc for remote cache
       shell: bash
@@ -53,3 +62,9 @@ runs:
         echo "----"
         cat user.bazelrc
         echo "----"
+        # If there's a `public`/ folder, also write a `user.bazelrc`
+        # there - the `public/` folder represents a separate Bazel
+        # workspace that should also get the remote cache configuration.
+        if [ -d public ]; then
+          cp user.bazelrc public/user.bazelrc
+        fi

documentation/docs/ai_chat_apps/examples.mdx

@@ -11,8 +11,8 @@ Code, Goose, or any compatible AI client.
 It demonstrates:
 
 * `UI` methods that open React UIs in the AI chat interface.
-* The `Session` type: auto-constructed per MCP session, acting
-  as an entry point that creates other state types.
+* The `User` type: auto-constructed per authenticated user,
+  acting as an entry point that creates other state types.
 * Generated React hooks (`useCounter()`) that work in both AI
   and browser contexts.
 * `App.tsx` component that implements the UI and receive AI-provided