chore(master): release 0.6.4 - #549
Conversation
Greptile SummaryUpdates the root ArcBox release to 0.6.4.
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains.
|
| Filename | Overview |
|---|---|
| Cargo.toml | Consistently bumps the workspace version and release-managed internal dependency requirements to 0.6.4. |
| Cargo.lock | Regenerates workspace package versions for the 0.6.4 release without changing third-party dependencies. |
| .release-please-manifest.json | Advances the root release component from 0.6.3 to 0.6.4 while preserving separately versioned components. |
| CHANGELOG.md | Adds the generated 0.6.4 release notes and comparison link. |
Reviews (24): Last reviewed commit: "chore: update lockfiles for release" | Re-trigger Greptile
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes — the full release-please diff at 4b1bef1, covering both the generated release commit and the follow-up Cargo.lock regeneration.
- Manifest bump —
.release-please-manifest.jsonmoves the root"."component 0.6.3 → 0.6.4; the"fleet"component correctly stays at 0.1.3 (separate release train viaexclude-paths: ["fleet"]). - Changelog — one
## [0.6.4]section with a single### Bug Fixesentry for #548. This matchesgit log v0.6.3..masterexactly, which contains only34a5e641— no entries dropped. Cargo.toml—workspace.package.versionplus every dep pin carrying# x-release-please-version. The three manually-cadenced pins are correctly left alone:arcbox-hv = 0.3.20,arcbox-helper = 1.0.2,arcbox-boot = 0.8.0.Cargo.lock— all workspace member versions bumped by theUpdate Cargo.lock on release PRsstep.cargo metadata --locked --no-depsexits 0, so the tagged commit will satisfy thecargo publish --workspace --no-verify --lockedinrelease.yml.
A repo-wide grep for 0.6.3 finds no stale references outside CHANGELOG.md history and an unrelated third-party objc2 0.6.3 line in NOTICE.md.
ℹ️ This tag is the first to run the new crates.io publish-resume logic
The only commit in 0.6.4 is #548, which added the crate <name>@<ver> already exists on crates.io index → add-to-excludes → retry loop to release.yml's publish-crates job. Nothing in this diff can change that, but on a clean 0.6.4 no crate is pre-published, so the resume branch only engages if the publish partially fails mid-run — worth watching the publish job once this merges rather than assuming the fix is proven.
Claude Opus ｜ 𝕏
4b1bef1 to
dd01ccb
Compare
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes — the branch was regenerated since the prior pullfrog review at 4b1bef1 (which the force-push dismissed). Restricted to the PR's own files, the only thing that moved is CHANGELOG.md; Cargo.toml, Cargo.lock, and .release-please-manifest.json are byte-identical to the version reviewed last time.
- Changelog picked up two more commits — added a
### Performance Improvementsblock for #555 and #558, and moved the release date from 2026-08-03 to 2026-08-07. - Rebased onto the new
masterhead — merge-base is now72f0e745instead of34a5e641, and theCargo.lockauto-commit was regenerated on top of it asb4b347d.
Verification on the current head:
- Changelog matches history one-for-one. Exactly three non-merge commits sit after the 0.6.3 release commit
ba6aaaac—34a5e641(#548),1b4b7669(#555),72f0e745(#558) — and all three appear in the 0.6.4 section. Nothing dropped, nothing invented. Cargo.lockis consistent.cargo metadata --locked --no-depsexits 0, so the tag will satisfycargo publish --workspace --no-verify --lockedinrelease.yml. The lock diff is exactly 52version =line pairs and nothing else.- Version census is clean. 52 workspace members at 0.6.4;
arcbox-fleet-agent0.1.3,arcbox-hv0.3.20,arcbox-helper1.0.2 correctly untouched (separate cadences, no# x-release-please-versionmarker). A repo-wide grep for0.6.3across toml/json/yml/rs/lock finds no stale pin. - No new crates entered the workspace.
git diff --stat ba6aaaac 72f0e745 -- Cargo.toml release-please-config.jsonis empty, so #548/#555/#558 added no workspace member and changed no dependency — which rules out a newly-added crate failing the publish job for missing metadata, and explains why the lock diff is version lines only. - 0.6.4 is the right level.
perf:maps to a patch bump under release-please's conventional-commit defaults, so the two performance commits don't call for 0.7.0.
The sandbox behavior changes carried by #555/#558 (kernel quiet boot arg, resolv.conf on tmpfs, restore fast path) landed on master already and are outside this PR's diff — they are not re-reviewed here.
Claude Opus ｜ 𝕏
b4b347d to
7d8648d
Compare
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes — the branch was regenerated again since the prior pullfrog review at b4b347d (which the force-push dismissed). Restricted to the PR's own four files, the delta is a single added CHANGELOG.md line; Cargo.toml, Cargo.lock, and .release-please-manifest.json are byte-identical to what was reviewed last run.
- Changelog picked up one more commit — a
### Performance Improvementsentry for #559 (6d8ab5f). It sorts between the #555 and #558 entries rather than at the end, which is release-please's within-section ordering, not a mis-generated entry. Release date stays 2026-08-07. - Rebased onto the new
masterhead —git merge-base origin/master HEADis now6d8ab5f0, and theCargo.lockauto-commit was regenerated on top of it asfca6b4a.
Verification re-run against the current head:
- Changelog matches history one-for-one.
git log --no-merges ba6aaaac..6d8ab5f0returns exactly four commits —34a5e641(#548),1b4b7669(#555),72f0e745(#558),6d8ab5f0(#559) — and all four appear in the 0.6.4 section. Nothing dropped, nothing invented. Cargo.lockis consistent.cargo metadata --locked --no-depsexits 0, so the tagged commit will satisfycargo publish --workspace --no-verify --lockedinrelease.yml. The lock diff is exactly 52version =line pairs and nothing else.- Version census unchanged. 52 workspace members at 0.6.4, with exactly three off-cadence and correctly untouched:
arcbox-fleet-agent0.1.3,arcbox-hv0.3.20,arcbox-helper1.0.2 (no# x-release-please-versionmarker on their pins). A repo-wide grep for0.6.3across toml/json/yml/rs/lock finds no stale pin. - #559 added no workspace member and changed no dependency.
git diff --stat 72f0e745...6d8ab5f0 -- Cargo.toml release-please-config.json .release-please-manifest.jsonis empty, which keeps the "newly-added crate fails the publish job for missing metadata" class ruled out and explains why the lock diff is version lines only. - 0.6.4 is still the right level.
perf:maps to a patch bump under release-please's conventional-commit defaults.
The sandbox behavior carried by #559 (READY gated on agent vsock readiness, backed-off connect poll) landed on master already and is outside this PR's diff — not re-reviewed here.
Claude Opus ｜ 𝕏
fca6b4a to
73f12b2
Compare
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes — the branch was regenerated again since the prior pullfrog review at fca6b4a (which the force-push dismissed). Restricted to the PR's own four files, the delta is a single added CHANGELOG.md line; Cargo.toml, Cargo.lock, and .release-please-manifest.json are byte-identical to what was reviewed last run.
- Changelog picked up one more commit — a
### Performance Improvementsentry for #560 (b8b7631). It sorts between the #559 and #558 entries rather than at the end, which is release-please's within-section ordering, not a mis-generated entry. Release date stays 2026-08-07. - Rebased onto the new
masterhead —git merge-base origin/master HEADis nowb8b7631b, and theCargo.lockauto-commit was regenerated on top of it asf36e084.
Verification re-run against the current head:
- Changelog matches history one-for-one.
git log --no-merges ba6aaaac..b8b7631breturns exactly five commits —34a5e641(#548),1b4b7669(#555),72f0e745(#558),6d8ab5f0(#559),b8b7631b(#560) — and all five appear in the 0.6.4 section. Nothing dropped, nothing invented. Cargo.lockis consistent.cargo metadata --locked --no-depsexits 0, so the tagged commit will satisfycargo publish --workspace --no-verify --lockedinrelease.yml. Uniq-counting the changed lines in the lock hunk yields onlyversion = "0.6.3"×52 andversion = "0.6.4"×52 — nothing else moved.- Version census unchanged. 52 workspace members at 0.6.4, with exactly three off-cadence and correctly untouched:
arcbox-fleet-agent0.1.3,arcbox-hv0.3.20,arcbox-helper1.0.2 (no# x-release-please-versionmarker on their pins). A repo-wide grep for0.6.3across toml/json/yml/rs/swift/md/lock finds no stale pin outsideCHANGELOG.mdhistory and the unrelated third-partyobjc2 0.6.3line inNOTICE.md. - #560 added no workspace member and changed no dependency.
git diff --stat 6d8ab5f0...b8b7631b -- Cargo.toml release-please-config.json .release-please-manifest.jsonis empty, which keeps the "newly-added crate fails the publish job for missing metadata" class ruled out and explains why the lock diff is version lines only. - 0.6.4 is still the right level.
perf:maps to a patch bump under release-please's conventional-commit defaults, so fourperf:commits don't call for 0.7.0.
The sandbox behavior carried by #560 (boot readiness as a guest vsock dial-out event) landed on master already and is outside this PR's diff — not re-reviewed here.
Claude Opus ｜ 𝕏
f36e084 to
7f9971b
Compare
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes — the branch was regenerated again since the prior pullfrog review at f36e084 (which the force-push dismissed). Restricted to the PR's own four files, the delta is a single added CHANGELOG.md line; Cargo.toml, Cargo.lock, and .release-please-manifest.json are byte-identical to what was reviewed last run.
- Changelog picked up one more commit — a
### Performance Improvementsentry for #561 (6a08111). It sorts between the #560 and #558 entries rather than at the end, which is release-please's within-section ordering, not a mis-generated entry. Release date stays 2026-08-07. - Rebased onto the new
masterhead —git merge-base origin/master HEADis now6a081119, and theCargo.lockauto-commit was regenerated on top of it as031af59.
Verification re-run against the current head:
- Changelog matches history one-for-one.
git log --no-merges ba6aaaac..6a081119returns exactly six commits —34a5e641(#548),1b4b7669(#555),72f0e745(#558),6d8ab5f0(#559),b8b7631b(#560),6a081119(#561) — and all six appear in the 0.6.4 section. Nothing dropped, nothing invented. Cargo.lockis consistent.cargo metadata --locked --no-depsexits 0, so the tagged commit will satisfycargo publish --workspace --no-verify --lockedinrelease.yml.- Both bumped files carry version edits only. Uniq-counting the changed lines in the lock hunk yields
version = "0.6.3"×52 andversion = "0.6.4"×52 and nothing else; the 44 changedCargo.tomllines are byte-identical once the version token is masked, so no non-version edit rode along. - Version census unchanged. 52 workspace members at 0.6.4, with exactly three off-cadence and correctly untouched:
arcbox-fleet-agent0.1.3,arcbox-hv0.3.20,arcbox-helper1.0.2 (no# x-release-please-versionmarker on their pins). A repo-wide grep for0.6.3across toml/json/yml/rs/swift/md/lock finds no stale pin outsideCHANGELOG.mdhistory and the unrelated third-partyobjc2 0.6.3line inNOTICE.md. - #561 added no workspace member and changed no dependency.
git diff --stat b8b7631b...6a081119 -- Cargo.toml release-please-config.json .release-please-manifest.json Cargo.lockis empty, which keeps the "newly-added crate fails the publish job for missing metadata" class ruled out. - 0.6.4 is still the right level.
perf:maps to a patch bump under release-please's conventional-commit defaults, so fiveperf:commits don't call for 0.7.0.
The sandbox behavior carried by #561 (pre-warmed restore slots behind an LRU snapshot pool, new pool_size config field, delete_snapshot made async) landed on master already and is outside this PR's diff — not re-reviewed here.
Claude Opus ｜ 𝕏
031af59 to
cd64c6d
Compare
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes — the branch was regenerated again since the prior pullfrog review at 031af59 (which the force-push dismissed). Restricted to the PR's own four files, the delta is a single added CHANGELOG.md block; Cargo.toml, Cargo.lock, and .release-please-manifest.json are byte-identical to what was reviewed last run.
- Changelog gained a
### Featuressection — the train's first, holding #562 (4149fb1), placed above### Bug Fixes. Release date stays 2026-08-07. - Rebased onto the new
masterhead —git merge-base origin/master HEADis now4149fb1b, and theCargo.lockauto-commit was regenerated on top of it as196c82c.
Verification re-run against the current head:
- A
feat:in a patch release is correct here, not a mis-generated bump. This is the first non-fix/perfcommit in the 0.6.4 train, so 0.7.0 would be the natural expectation — butrelease-please-config.jsonsetsbump-patch-for-minor-pre-major: true, which makes a pre-1.0feat:a patch bump.bump-minor-pre-major: truereserves 0.7.0 for breaking changes, andgit log -1 --format=%B 4149fb1bshows #562 carries neither a!nor aBREAKING CHANGE:footer. 0.6.4 stands. - Changelog matches history one-for-one.
git log --no-merges ba6aaaac..4149fb1breturns exactly seven commits — #548, #555, #558, #559, #560, #561, #562 — and all seven appear in the 0.6.4 section. Nothing dropped, nothing invented. Cargo.lockis consistent.cargo metadata --locked --no-depsexits 0, so the tagged commit will satisfycargo publish --workspace --no-verify --lockedinrelease.yml.- Both bumped files carry version edits only. Uniq-counting the changed lines in the lock hunk yields
version = "0.6.3"×52 andversion = "0.6.4"×52 and nothing else; the 44 changedCargo.tomllines are byte-identical once the version token is masked, so no non-version edit rode along. - Version census unchanged. 52 workspace members at 0.6.4, with exactly three off-cadence and correctly untouched:
arcbox-fleet-agent0.1.3,arcbox-hv0.3.20,arcbox-helper1.0.2 (no# x-release-please-versionmarker on their pins), plus the externalarcbox-boot0.8.0. A repo-wide grep for0.6.3across toml/json/yml/rs/swift/md/lock finds no stale pin outsideCHANGELOG.mdhistory and the unrelated third-partyobjc2 0.6.3line inNOTICE.md. - #562 added no workspace member and changed no dependency.
git diff --stat 6a081119...4149fb1b -- Cargo.toml release-please-config.json .release-please-manifest.json Cargo.lockis empty, which keeps the "newly-added crate fails the publish job for missing metadata" class ruled out.
The sandbox behavior carried by #562 (every guest booting the fixed link-local identity, host-side per-TAP 1:1 translation, the net_invariant snapshot marker) landed on master already and is outside this PR's diff — not re-reviewed here. Worth noting only that the marker is #[serde(default)], so snapshots written by 0.6.3 load unchanged on 0.6.4 and keep the reconfig-RPC path; the upgrade direction needs no migration.
Claude Opus ｜ 𝕏
196c82c to
187ba34
Compare
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes — the branch was regenerated again since the prior pullfrog review at 196c82c (which the force-push dismissed). Restricted to the PR's own four files, the delta is a single added CHANGELOG.md line; Cargo.toml, Cargo.lock, and .release-please-manifest.json are byte-identical to what was reviewed last run.
- Changelog picked up one more commit — a
### Performance Improvementsentry for #566 (46ef5a3, eBPF TCX datapath for invariant sandbox NAT). It sorts between the #555 and #559 entries rather than at the end, which is release-please's within-section ordering, not a mis-generated entry. Release date stays 2026-08-07. - Rebased onto the new
masterhead —git merge-base origin/master HEADis now46ef5a36, and theCargo.lockauto-commit was regenerated on top of it as735a698.
Verification re-run against the current head:
- Changelog matches history one-for-one.
git log --no-merges ba6aaaac..46ef5a36returns exactly eight commits — #548, #555, #558, #559, #560, #561, #562, #566 — and all eight appear in the 0.6.4 section. Nothing dropped, nothing invented. - Both bumped files still carry version edits only. Uniq-counting the changed lines in the PR's
Cargo.lockhunks yieldsversion = "0.6.3"×52 andversion = "0.6.4"×52 and nothing else; the 44 changedCargo.tomllines are byte-identical once the version token is masked.cargo metadata --locked --no-depsexits 0, so the tag will satisfycargo publish --workspace --no-verify --locked. - Version census unchanged. 55 members, 52 at 0.6.4, exactly three off-cadence and correctly untouched:
arcbox-fleet-agent0.1.3,arcbox-helper1.0.2,arcbox-hv0.3.20 (no# x-release-please-versionmarker on their pins), plus the externalarcbox-boot0.8.0. A repo-wide grep for0.6.3across toml/json/yml/rs/swift/lock returns nothing. - #566 is the first commit in this train to move
Cargo.lockon the base side, and it does not affect the tag's publishability. Unlike #555–#562, it added a dependency — a Linux-onlyaya = "0.14.0"onvirt/arcbox-vm, pulling inaya-obj,object 0.39.1,hashbrown 0.17.1,assert_matches, and anindexmap2.13.0 → 2.14.0 bump. That is base content, not PR content (the PR's own lock diff against46ef5a36is still version lines only), but it is worth confirming becausearcbox-vmis in the publish set —release.ymlexcludes onlyarcbox-hvandarcbox-helper. Checked:cargo package -p arcbox-vm --no-verify --listincludes the committedbpf/sandbox_nat.bpf.oand both.sha256sidecars (noinclude/excludein the crate manifest, no*.orule in.gitignore), and theinclude_bytes!atvirt/arcbox-vm/src/network/ebpf.rs:37is#[cfg(target_os = "linux")]-gated, so macOS builds never need the blob. RootCargo.toml,release-please-config.json, and.release-please-manifest.jsonare untouched by #566, so no workspace member was added. - 0.6.4 is still the right level. #566 is a
perf:with no!and noBREAKING CHANGE:footer, which maps to a patch bump.
The sandbox behavior carried by #566 (TCX ingress/egress NAT programs replacing the CORE-81 iptables rule set, sandbox_datapath config knob with iptables fallback, onlink peer-route steering) landed on master already and is outside this PR's diff — not re-reviewed here.
Claude Opus ｜ 𝕏
735a698 to
8c414d5
Compare
|
Your Claude subscription has hit its usage limit. It resets at 11am (UTC). Re-trigger Pullfrog after the reset, or add an Add repo secret → · Model settings → · Setup docs → · Ask in Discord →
|
cc21a06 to
f9b4dc7
Compare
|
Your Claude subscription has hit its usage limit. It resets at 11am (UTC). Re-trigger Pullfrog after the reset, or add an Add repo secret → · Model settings → · Setup docs → · Ask in Discord →
|
c6440f8 to
8a685ff
Compare
|
Your Claude subscription has hit its usage limit. It resets at 11am (UTC). Re-trigger Pullfrog after the reset, or add an Add repo secret → · Model settings → · Setup docs → · Ask in Discord →
|
eb576ec to
d9ee395
Compare
|
Your Claude subscription has hit its usage limit. It resets at 11am (UTC). Re-trigger Pullfrog after the reset, or add an Add repo secret → · Model settings → · Setup docs → · Ask in Discord →
|
d97d0aa to
e6bb29e
Compare
|
Your Claude subscription has hit its usage limit. It resets at 11am (UTC). Re-trigger Pullfrog after the reset, or add an Add repo secret → · Model settings → · Setup docs → · Ask in Discord →
|
e2deb9a to
b291351
Compare
|
Your Claude subscription has hit its usage limit. It resets at 11am (UTC). Re-trigger Pullfrog after the reset, or add an Add repo secret → · Model settings → · Setup docs → · Ask in Discord →
|
b49ce2f to
c092853
Compare
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes — the branch was regenerated again since the prior pullfrog review at 735a698 (which the force-push dismissed). Restricted to the PR's own four files, the delta is CHANGELOG.md only; Cargo.toml, Cargo.lock, and .release-please-manifest.json are byte-identical in PR scope to what was reviewed last run.
- Changelog picked up seven entries and three brand-new sections — #569 under Features, #567 under Bug Fixes, #568 under Performance Improvements, plus the train's first
### Tests(e5189b2),### Build System(d36184a,3b44845), and### Miscellaneous Chores(#572, boot assets 0.8.4) sections. Release date stays 2026-08-07. - Rebased onto the new
masterhead —git merge-base origin/master HEADis now50e59cd, and theCargo.lockauto-commit was regenerated on top of it asad051c8. - Manifest still bumps the root component only —
"."0.6.3 → 0.6.4. The file now carries four entries rather than two, becaused36184a/3b44845registeredsdk/typescriptandsdk/pythonas release-please components onmaster; both sit at 0.1.0 as unchanged context, as doesfleetat 0.1.3.
Verification re-run against the current head:
- Changelog matches history one-for-one — 15 entries, 15 root-scoped commits. This is the first run where that check is non-trivial: the 0.6.4 range holds 40 non-merge commits, ~20 of which are SDK work.
d36184a/3b44845widened the root package'sexclude-pathsto["fleet", "sdk/typescript", "sdk/python"], and checking every commit's file list withgit log --name-onlyconfirms each excluded commit touches onlysdk/python/**orsdk/typescript/**. The three that do reach root do so correctly: the twobuild(sdk):commits edit rootrelease-please-config.json/.release-please-manifest.json, ande5189b2editstests/e2e/**. Nothing dropped, nothing invented. - Both bumped files still carry version edits only. Uniq-counting the changed lines in the PR's
Cargo.lockhunks yieldsversion = "0.6.3"×52 andversion = "0.6.4"×52 and nothing else; the 44 changedCargo.tomllines are byte-identical once the version token is masked.cargo metadata --locked --no-depsexits 0, so the tag will satisfycargo publish --workspace --no-verify --locked. - Version census unchanged. 55 members, 52 at 0.6.4, exactly three off-cadence and correctly untouched:
arcbox-fleet-agent0.1.3,arcbox-helper1.0.2,arcbox-hv0.3.20 (no# x-release-please-versionmarker on their pins), plus the externalarcbox-boot0.8.0. The SDKs are not cargo crates, so they add no member. A repo-wide grep for0.6.3across toml/json/yml/rs/swift/lock/py/ts returns nothing outsideCHANGELOG.mdhistory. - Nothing new entered the publish set. #569's only
virt/arcbox-vm/Cargo.tomlchange movessha2from[dev-dependencies]to[dependencies]— already a workspace registry dep, so no new resolution risk on the tag.tests/e2e, which gainedsdk_py.rs, carriespublish = false.release.ymlstill excludes onlyarcbox-hvandarcbox-helper. - The new SDK components can't collide with this tag.
release.ymlfires ontags: ['v*'], and the SDK components useinclude-component-in-tag: true, so they tag assdk-python-vX.Y.Z/sdk-typescript-vX.Y.Z— neither matchesv*, andseparate-pull-requests: truekeeps their releases on their own PRs. - 0.6.4 is still the right level. #569 is the train's second
feat:, andrelease-please-config.json'sbump-patch-for-minor-pre-major: truemakes a pre-1.0feat:a patch bump;bump-minor-pre-major: truereserves 0.7.0 for breaking changes, andd23c12b8's message carries neither a!nor aBREAKING CHANGE:footer. The newtest:/build:/chore:types are patch-or-none.
The sandbox behavior carried by #567/#568/#569 (TAP-teardown race fix, ptp_kvm guest clock self-sync, warm-template-snapshot creates) and the Python/TypeScript SDK trees landed on master already and are outside this PR's diff — not re-reviewed here.
Claude Opus ｜ 𝕏
ad051c8 to
d52a955
Compare
There was a problem hiding this comment.
ℹ️ One cosmetic changelog issue, non-blocking. The release mechanics are correct.
Reviewed changes
The branch was regenerated since the last review (ad051c8). Within PR scope the delta is CHANGELOG.md only — 12 new entries plus a new ### Documentation section, taking ## [0.6.4] from 15 to 27 entries (the CORE-21 sandbox pause/resume train). Cargo.toml, Cargo.lock, and .release-please-manifest.json are byte-identical to the previously reviewed revision once the version token is masked. The branch was rebased onto 4036c21 with the usual lock auto-commit (a62b4b2).
Re-ran the standard release-PR drift checks against the new head:
- Version bump level — none of the 12 new commits carries a
!suffix or aBREAKING CHANGE:footer;bea29381explicitly notes the change is additive andAGENT_PROTOCOL_VERSIONis unchanged. Pre-1.0 config (bump-minor-pre-major+bump-patch-for-minor-pre-major) makesfeat:a PATCH bump, so 0.6.4 is correct. - Lockfile shape —
Cargo.lockchanges are exactly 52 ×version = "0.6.3"→version = "0.6.4"and nothing else. No dependency graph movement. - Workspace consistency —
cargo metadata --locked --no-depsexits 0; 55 members, 52 at0.6.4, exactly 3 intentionally off-cadence (arcbox-fleet-agent0.1.3,arcbox-helper1.0.2,arcbox-hv0.3.20). Their pins inCargo.tomlare correctly untouched. - Stragglers — no
0.6.3remains anywhere outsidetarget/,node_modules/,CHANGELOG.md, andNOTICE.md. - No workspace surface change from CORE-21 —
git diff --stat 50e59cd...4036c21 -- Cargo.toml Cargo.lock release-please-config.json .release-please-manifest.jsonis empty, so the new work added no member and moved no dependency.
The CORE-21 pause/resume behavior itself is base content that landed on master through its own PRs; it is not re-reviewed here.
Claude Opus ｜ 𝕏
a62b4b2 to
df7dc74
Compare
|
Your Claude subscription has hit its usage limit. It resets at 4:20pm (UTC). Re-trigger Pullfrog after the reset, or add an Add repo secret → · Model settings → · Setup docs → · Ask in Discord →
|
b4f2bbe to
2731cd4
Compare
There was a problem hiding this comment.
ℹ️ One cosmetic changelog issue, non-blocking. The release mechanics are correct.
Reviewed changes
The branch was regenerated again since the last review (a62b4b2). Within PR scope the delta is CHANGELOG.md only — 17 new entries plus a new ### Continuous Integration section, taking ## [0.6.4] from 27 to 44 entries, with the release date moving 2026-08-07 → 2026-08-08. Cargo.toml, Cargo.lock, and .release-please-manifest.json are byte-identical to the previously reviewed revision once the version token is masked. The branch was rebased onto 2fb3528 with the usual lockfile auto-commit (f7ee724).
Re-ran the standard release-PR drift checks against the new head:
- Version bump level — read all 17 new commit bodies; none carries a
!suffix or aBREAKING CHANGE:footer. Pre-1.0 config (bump-minor-pre-major+bump-patch-for-minor-pre-major) makesfeat:a PATCH bump, so 0.6.4 is correct. - Lockfile / manifest shape — the
Cargo.lock+Cargo.tomlhunks are exactly 52 ×version = "0.6.3"→version = "0.6.4"plus the 44x-release-please-version-marked lines inCargo.toml, and zero non-version lines. No dependency graph movement from this PR. - Workspace consistency —
cargo metadata --locked --no-depsexits 0; 55 members, 52 at0.6.4, exactly 3 intentionally off-cadence (arcbox-fleet-agent0.1.3,arcbox-helper1.0.2,arcbox-hv0.3.20). Their pins inCargo.tomlare correctly untouched, as are the third-party pins (arcbox-boot0.8.0 etc.). - Stragglers — no
0.6.3remains anywhere outsidetarget/,node_modules/,CHANGELOG.md, andNOTICE.md. - SDK components unaffected —
sdk/pythonandsdk/typescriptstay at0.1.0, andsdk/python/uv.lockagrees with itspyproject.toml. That is consistent withrelease-please.yml's lockfile step: with no SDK version moved,uv lockwas a no-op and onlyCargo.lockchanged. - Tag routing — merging fires
release.yml(tags: ['v*']) only. The newrelease-sdk-python.yml/release-sdk-typescript.ymlpipelines key offsdk-python-v*/sdk-typescript-v*and are not triggered byv0.6.4. - Base-side publish-set delta — one line:
arcbox-apigainedbase64inCargo.lock. Already present in the graph and the rootCargo.tomlis untouched, so no new workspace member and no resolution risk on the tag.
The base-branch work itself (sandbox/microVM behavior, the SDK publish pipelines) landed through its own PRs and is not re-reviewed here.
The previous review's finding is retired: 0d354483 is genuinely gone from the regenerated changelog, not merely line-shifted. The same class of leak did recur on a different commit — see the inline note.
Claude Opus ｜ 𝕏
f7ee724 to
e918466
Compare
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes
The branch was regenerated again since the last review (f7ee724). Within PR scope the delta is confined to CHANGELOG.md and one line of .release-please-manifest.json:
- The
d240b92entry I flagged last run is gone from the root changelog, and nothing replaced it. - One entry was added under
### Miscellaneous Chores:chore(master): release sdk-typescript 0.1.1(79f6170). Section total stays at 44 entries. .release-please-manifest.json'ssdk/typescriptcontext line moved0.1.0→0.1.1; only"."is actually bumped by this PR (0.6.3 → 0.6.4).- Rebased onto
79f61709with the usual lockfile auto-commit (e0abc6d).
Re-ran the standard release-PR drift checks against the new head:
- Changelog ↔ history is an exact set match — this is the first perfectly clean run in a while. The pathspec-filtered log (
git log --no-merges ba6aaaac..79f61709 -- . ':!fleet' ':!sdk/typescript' ':!sdk/python') yields exactly 44 commits, the changelog's 44 entries reference exactly those 44 SHAs, and bothcommdirections are empty — zero leaked, zero dropped. The!commit.filesmisclassification class that produced the last two findings did not recur. - Version bump level — no new commit carries a
!suffix or aBREAKING CHANGE:footer. Pre-1.0 config (bump-minor-pre-major+bump-patch-for-minor-pre-major) makesfeat:a PATCH bump, so 0.6.4 is correct. - Diff-shape census — 192 changed lines across
Cargo.lock+Cargo.toml: 52 ×version = "0.6.3"→version = "0.6.4"in the lock, 44# x-release-please-version-marked pin pairs in the manifest, and zero non-version lines (grep -vE '0\.6\.[34]'returns nothing). - Workspace consistency —
cargo metadata --locked --no-depsexits 0; 55 members, 52 at0.6.4, exactly 3 intentionally off-cadence (arcbox-fleet-agent0.1.3,arcbox-helper1.0.2,arcbox-hv0.3.20), unchanged since run 4. TheirCargo.tomlpins are correctly untouched, as are the third-party pins (arcbox-boot0.8.0 etc.). - Stragglers — no
0.6.3remains anywhere outsidetarget/,node_modules/, andCHANGELOG.md. - Manifest ↔ component agreement —
sdk/typescript/package.jsonis at 0.1.1 andsdk/python/pyproject.tomlat 0.1.0, matching their manifest entries. - Tag routing — merging fires
release.yml(tags: ['v*']) only.release-sdk-python.yml/release-sdk-typescript.ymlkey offsdk-python-v*/sdk-typescript-v*and are not triggered byv0.6.4. - Base-side publish-set delta — one line (the manifest's
sdk/typescriptbump). No dependency-graph movement, no new workspace member, no resolution risk on the tag.
On the one thing that changed in the changelog's composition: the new 79f6170 entry is path-legitimate, not another leak. That commit touches root .release-please-manifest.json, which sits outside all three of the root package's exclude-paths prefixes (fleet, sdk/typescript, sdk/python), so release-please includes it correctly. It is also long-standing behavior rather than something this PR introduced — the root changelog already carries four release fleet-agent lines from earlier releases (lines 403, 665, 666, 782), landing by the same mechanism. And there is no supported remedy: exclude-paths matching is directory-prefix-only (isRelevant in upstream src/util/commit-exclude.ts tests path === '.' || file.indexOf(path + '/') === 0), so adding the manifest filename to that list would silently do nothing. Not raising it as a finding.
The previous review's finding is retired — replied and resolved. No open threads remain.
The base-branch work itself (the sdk-typescript 0.1.1 release) landed through its own PR and is not re-reviewed here.
Claude Opus ｜ 𝕏
e0abc6d to
6d3f597
Compare
|
Your Claude subscription has hit its usage limit. It resets at 9pm (UTC). Re-trigger Pullfrog after the reset, or add an Add repo secret → · Model settings → · Setup docs → · Ask in Discord →
|
5b9af99 to
e5eb76b
Compare
|
Your Claude subscription has hit its usage limit. It resets at 12am (UTC). Re-trigger Pullfrog after the reset, or add an Add repo secret → · Model settings → · Setup docs → · Ask in Discord →
|
bd6886c to
859d1ba
Compare
|
Your Claude subscription has hit its usage limit. It resets at 12am (UTC). Re-trigger Pullfrog after the reset, or add an Add repo secret → · Model settings → · Setup docs → · Ask in Discord →
|
910adaf to
5fd8d29
Compare
|
Your Claude subscription has hit its usage limit. It resets at 12am (UTC). Re-trigger Pullfrog after the reset, or add an Add repo secret → · Model settings → · Setup docs → · Ask in Discord →
|
e393364 to
07d6c8d
Compare
|
Your Claude subscription has hit its usage limit. It resets at 12am (UTC). Re-trigger Pullfrog after the reset, or add an Add repo secret → · Model settings → · Setup docs → · Ask in Discord →
|
9354ac3 to
64c0029
Compare
There was a problem hiding this comment.
ℹ️ One cosmetic changelog issue; the release itself verifies clean.
Reviewed changes — delta since the prior pullfrog review (head was e0abc6d2):
CHANGELOG.md: 44 → 51 entries in the0.6.4section; release date2026-08-08→2026-08-10..release-please-manifest.json: only the root.bump is in PR scope; thesdk/pythoncontext line moved0.1.0→0.1.1on the base side.Cargo.toml/Cargo.lock: byte-identical in PR scope to the last review.
Verification
- Changelog ↔ history (both directions).
git log --no-merges ba6aaaac..6ad91a8d -- . ':!fleet' ':!sdk/typescript' ':!sdk/python'yields 50 root-scoped commits against 51 changelog entries.commin both directions gives exactly one asymmetry:bbda08adleaked in, nothing was dropped (the dangerous direction is clean). Detail inline onCHANGELOG.md:68. - Diff shape. The
Cargo.lock+Cargo.tomlhunks uniq toversion = "0.6.3"×52 /version = "0.6.4"×52 plus the 44# x-release-please-versionpin pairs; a second pass filtering out0.6.[34]returns zero lines. The three manually-pinned deps (arcbox-hv0.3.20,arcbox-helper1.0.2,arcbox-boot0.8.0) are correctly left untouched. No non-version edit rode along. - Lockfile.
cargo metadata --locked --no-depsexits 0 —release.ymlrunscargo publish --workspace --no-verify --lockedon the tag, so this is the gate that matters. - Version census. 55 workspace members, 52 at
0.6.4, three intentionally off-cadence (arcbox-fleet-agent0.1.3,arcbox-helper1.0.2,arcbox-hv0.3.20) — unchanged across every run of this train, so the 0.6.4 series added no member. Repo-wide grep finds no0.6.3stragglers outsidetarget/,node_modules/, andCHANGELOG.md. - Bump level. The only new
feat:in this delta (cad4fee2, #582) has no!and noBREAKING CHANGE:footer; withbump-minor-pre-major+bump-patch-for-minor-pre-major,0.6.4is the correct level. - Release pipeline.
.github/workflows/release.ymlis touched by exactly one commit in the whole 0.6.4 range (34a5e641, #548); the otherci:/fix(ci):commits hitci.ymland the SDK workflows. Tag routing re-checked:v0.6.4matchesrelease.ymlonly (sdk-python-v*/sdk-typescript-v*are disjoint). - Base-side publish-set delta since the last review is a single line (the manifest's
sdk/pythonbump) — #582, despite its size, moved no dependency and added no crate.
Claude Opus ｜ 𝕏
| ### Documentation | ||
|
|
||
| * **sandbox:** pause/resume semantics + resolve the Pause-from-RUNNING ambiguity ([7efe0d5](https://github.com/arcboxlabs/arcbox/commit/7efe0d55d07a368f15cd7bfec328075db8c22591)) | ||
| * **sdk:** mark the npm publish workflow pending in the release flow ([bbda08a](https://github.com/arcboxlabs/arcbox/commit/bbda08ad2c260f61893f62cccc49473816d34e23)) |
There was a problem hiding this comment.
bbda08ad doesn't belong in the root changelog: git show --stat bbda08ad shows it touches exactly one file, sdk/typescript/README.md, which sits inside the root package's exclude-paths (fleet, sdk/typescript, sdk/python in release-please-config.json).
This is the third recurrence of a known non-deterministic class rather than a new regression — run 9 leaked 0d354483, run 10 leaked d240b92, run 11 regenerated clean, and this run leaked bbda08ad. Root cause is the !commit.files short-circuit in release-please's shouldInclude (src/util/commit-exclude.ts): when a commit's changed-file list can't be resolved, the commit bypasses exclude-paths entirely. Upstream's mitigation is backfillFiles: true in manifest.ts; which commit loses its file list varies per regeneration, which is why the leaking sha differs each time.
Impact is cosmetic. It doesn't affect the patch bump, the published artifacts, or the lockfile, and the sdk/typescript component computes its own commit set independently — so the entry is duplicated across two changelogs, not lost from one.
Please don't hand-edit CHANGELOG.md to remove it: release-please force-pushes this branch on the next regeneration and the edit would be overwritten. If the duplication is worth eliminating, the fix belongs in the release-please version/config, not in this PR.
🤖 I have created a release beep boop
0.6.4 (2026-08-10)
Features
Bug Fixes
Performance Improvements
Tests
Documentation
Build System
Continuous Integration
Miscellaneous Chores
This PR was generated with Release Please. See documentation.