chore(master): release 0.5.5

[arcbox-labs]

🤖 I have created a release beep boop

0.5.5 (2026-07-31)

Features

• cli: abctl claude — coding-agent TUI in a sandbox (bd558cd)
• cli: embedded sandbox image templates (aa00154)
• fleet: restart the agent process in place (c8649a5)

Bug Fixes

• cli: do not wait for the parked stdin read when the runtime shuts down (94c1ad5)
• cli: end an exec session when the workload exits (050ff66)
• cli: key the image layout cache on filesystem content, not image id (75aaa6f)
• sandbox: invalidate converted rootfs images when vm-agent changes (df66e8c)
• sandbox: keep converted rootfs images that snapshots restore from (3837c08)
• sandbox: report an interactive workload's exit status when it exits (9bcf94c)
• sandbox: resolve docker images through an OCI layout export (96740ca)
• vz: build the Swift shim with SwiftPM's native build system (19e46b7)

Code Refactoring

• vm: publish snapshots atomically instead of piecewise (419b270)

Miscellaneous Chores

• assets: bump boot assets to 0.6.13 (fuse spin-wait, CORE-48) (#513) (098771c)
• tools: bump Docker toolchain to latest stable versions (#502) (a44178b)

---

This PR was generated with Release Please. See documentation.

[greptile-apps]

Greptile Summary

Updates the workspace release metadata to version 0.5.5.

• Bumps the release manifest and Rust workspace package versions from 0.5.4 to 0.5.5.
• Synchronizes internal path-dependency requirements and lockfile package metadata.
• Adds the generated 0.5.5 changelog entry.

Confidence Score: 5/5

The release metadata update appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
Cargo.toml	Consistently bumps the workspace version and internal path-dependency requirements to 0.5.5.
Cargo.lock	Synchronizes internal workspace package versions without changing third-party dependency resolutions.
CHANGELOG.md	Adds the generated release notes for version 0.5.5.
.release-please-manifest.json	Advances the root release version from 0.5.4 to 0.5.5.

_{Reviews (5): Last reviewed commit: "docs: drop fleet-only entry from the 0.5..." | Re-trigger Greptile}

[pullfrog]

✅ No new issues found.

Reviewed changes — release-please's 0.5.5 release PR, plus the bot's follow-up Cargo.lock regeneration. Pure release plumbing; no source changes and no behavioral surface.

• Manifest bump — .release-please-manifest.json moves "." from 0.5.4 to 0.5.5. "fleet": "0.1.3" is correctly untouched, since fleet is a separate release-please package and the root package sets exclude-paths: ["fleet"].
• Cargo.toml version pins — [workspace.package] version plus the 30 workspace dep pins carrying # x-release-please-version, all 0.5.4 → 0.5.5.
• Cargo.lock regeneration — exactly 51 version = "0.5.4" → "0.5.5" pairs and nothing else. Produced by the Update Cargo.lock on release PRs step in .github/workflows/release-please.yml, so the extra non-release-please commit on the branch is expected.
• Changelog — new 0.5.5 section with 11 entries (2 features, 8 fixes, 1 refactor).

Verification I ran against the repo, all clean:

• The 11 changelog entries map 1:1 onto the 11 non-merge commits between the 0.5.4 release commit 8cfe11fc and head-of-master 419b2705, each in the right section.
• A patch bump despite two feat commits is the configured behavior, not a miscategorization: release-please-config.json sets both bump-minor-pre-major and bump-patch-for-minor-pre-major to true, which maps feat to a patch bump while the project is at 0.x.
• The three deliberately-unbumped versions are all still correct: arcbox-hv at 0.3.20 (external Apple-bindings cadence, no annotation), arcbox-helper at 1.0.2 (bumping it would force an admin-password reinstall prompt for every Desktop user), and arcbox-fleet-agent at 0.1.3.
• No lockstep bump was missed — the release range touches none of app/arcbox-helper, common/arcbox-constants/src/wire.rs (AGENT_PROTOCOL_VERSION), assets.lock, or fleet/.
• No stale 0.5.4 remains anywhere in the tree outside CHANGELOG.md history and two unrelated third-party lock entries (cmov, event-listener-strategy).
• Publish safety holds: no publishable crate picked up a dependency on a publish = false crate in this range, and the new arcbox-cli asset assets/templates/claude.Dockerfile packages fine (the crate has no include list). arcbox-vz's include still covers everything its changed build.rs needs, since that change only adds a --build-system native flag.

  ^{｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

ℹ️ No blocking issues — one changelog-accuracy note inline.

Reviewed changes — release-please force-pushed the branch since the last review (a97e6b63/5e513f09 → 07862d22/492ea764), rebasing onto a master that had gained the fleet restart work. Comparing the two head trees, the only change to this PR's four files is a single added changelog line; the version bumps are byte-identical to what was reviewed before.

• Changelog gained one entry — feat(fleet): restart the agent process in place now appears in the 0.5.5 Features section (see the inline note).
• Version bumps unchanged — .release-please-manifest.json "." → 0.5.5, [workspace.package] version plus the 30 dep pins carrying # x-release-please-version, and exactly 51 version = "0.5.4" → "0.5.5" pairs in Cargo.lock and nothing else. "fleet": "0.1.3", arcbox-hv 0.3.20 and arcbox-helper 1.0.2 are still correctly untouched.
• Re-verified completeness against the new base — the 11 entries map 1:1 onto the non-fleet, non-merge commits between the 0.5.4 release commit 8cfe11fc and base 4c1ef9ec. git merge-base origin/master HEAD is 4c1ef9ec, i.e. master head, so nothing is pending regeneration.
• Lockfile still consistent with master — 50a57775 touched fleet/arcbox-fleet-agent/Cargo.toml but only added a test-util feature to an already-locked tokio dev-dependency, so no new Cargo.lock entry was owed.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

ℹ️ No new issues in this delta. Not formally approving only because the changelog-accuracy note from the previous review is still open.

Reviewed changes — release-please regenerated the branch after master gained two chore commits. The only change to this PR's four files since the last review is a new changelog section; every version bump is byte-identical to what was already reviewed.

• Changelog gained a Miscellaneous Chores section — two entries: chore(assets): bump boot assets to 0.6.13 (098771c, #513) and chore(tools): bump Docker toolchain to latest stable versions (a44178b, #502). The section is new because earlier 0.5.5 cycles had no in-range chore commit, not because anything changed — release-please-config.json has always mapped chore to Miscellaneous Chores.
• Both new entries are accurate and owe no other edits — each commit touches only assets.lock, so neither needed a Cargo.lock or version change. 098771c moves [boot] version 0.6.12 → 0.6.13 and manifest_sha256 together, which is the pair the daemon's compile-time pin requires; the release build compiles from this tree, so v0.5.5 embeds 0.6.13.
• Version bumps unchanged — .release-please-manifest.json "." → 0.5.5; Cargo.toml has exactly 43 changed lines ([workspace.package] version plus the 42 dep pins carrying # x-release-please-version) whose +/- sets are byte-identical after normalizing the version; Cargo.lock has exactly 51 version = "0.5.4" → "0.5.5" pairs and nothing else. "fleet": "0.1.3", arcbox-hv 0.3.20 and arcbox-helper 1.0.2 remain correctly untouched.
• Base is current — git merge-base origin/master HEAD is 098771c, i.e. master head, so nothing is pending regeneration. The only two 0.5.4 strings left in Cargo.lock belong to third-party cmov and event-listener-strategy.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

Important

The fleet line was removed from CHANGELOG.md, but release-please builds the published release notes from the pull request body, which still lists it. The edit needs to be applied to the PR body too, or v0.5.5's notes will still advertise the fleet feature.

Reviewed changes — one hand-authored commit landed since the previous pullfrog review (6bf9015 → 6a1aa5d), addressing the fleet-entry note from review 2. The other three files are byte-identical to what was already reviewed.

• Dropped the fleet entry from the 0.5.5 changelog — 6a1aa5d deletes exactly one line, * **fleet:** restart the agent process in place ([c8649a5]), from the Features section and nothing else. Section spacing is intact (two blank lines before ### Bug Fixes, matching release-please's own output), leaving 13 entries: 2 feat, 8 fix, 1 refactor, 2 chore.
• Version bumps unchanged — re-verified all three: .release-please-manifest.json "." → 0.5.5 with "fleet": "0.1.3" untouched; Cargo.toml exactly 43 changed lines ([workspace.package] version plus the 42 dep pins carrying # x-release-please-version), +/- sets byte-identical after normalizing the version; Cargo.lock exactly 51 version = "0.5.4" → "0.5.5" pairs and nothing else. arcbox-hv 0.3.20 and arcbox-helper 1.0.2 remain correctly unbumped.
• Base still current — git merge-base origin/master HEAD is 098771c, i.e. master head, so nothing is pending regeneration right now.
• Checked and cleared: no stray entry in the next cycle. docs maps to a visible Documentation section in changelog-sections, so the docs: commit was worth checking — but it cannot leak into 0.5.6 under either permitted merge style. A squash uses the PR title; a rebase makes 6a1aa5d the merge head, so tag v0.5.5 points at-or-after it.

⚠️ The published release notes still carry the fleet entry, because they come from the PR body rather than CHANGELOG.md

release-please's BaseStrategy.buildRelease() constructs the GitHub Release body by parsing the merged pull request's body — parsePullRequestBody(mergedPullRequest.body), then notes = releaseData?.notes — and never reads the committed CHANGELOG.md (source). This PR's body still lists * **fleet:** restart the agent process in place ([c8649a5]) under ### Features, so merging as-is publishes v0.5.5 release notes that contradict the file 6a1aa5d just corrected.

Separately, the hand-edit itself is fragile: release-please passes force: true to suggesterCreatePullRequest on both create and update, and maybeUpdateExistingPullRequest compares only the body string — it has no awareness of extra commits on the branch. Any push to master before this merges will force-push the branch and silently revert 6a1aa5d.

Technical details

# `CHANGELOG.md` edit does not reach the v0.5.5 GitHub Release notes

## Affected sites
- PR #511 body, `### Features` list — still contains `* **fleet:** restart the agent process in place ([c8649a5](https://github.com/arcboxlabs/arcbox/commit/c8649a5ae9dd219874ec86fe479d79d6d484fe56))`. This string, not `CHANGELOG.md`, becomes the `v0.5.5` release body.
- `CHANGELOG.md` (at `6a1aa5d`) — already correct; no further change needed there.
- Commit `6a1aa5d` — lives only on the release branch and is not protected against release-please's force-push.

## Required outcome
- Both artifacts agree: the fleet bullet is absent from the `v0.5.5` GitHub Release notes as well as from `CHANGELOG.md`.
- The correction survives to merge, or is knowingly re-applied if release-please regenerates the branch.

## Suggested approach (optional)
- Edit the PR body to delete the same bullet, then merge. The body is the only input to the release notes, so this is the whole fix.
- Merge promptly while `git merge-base origin/master HEAD` is still `098771c`. If master gains a commit first, release-please force-pushes and both the body bullet and the `CHANGELOG.md` deletion revert — re-apply both before merging.
- If `v0.5.5` is already tagged by the time this is read, the release body can still be edited directly on the GitHub Release.

## Open questions for the human
- Worth a follow-up guard so this class of hand-correction is not silently half-applied next time — e.g. a note in the release runbook that release notes live in the PR body, not `CHANGELOG.md`?

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

[arcbox-labs]

🤖 Created releases:

• v0.5.5

🌻