v1.0.0-alpha.1

portable-devshell v1.0.0-alpha.1

This is the first 1.0 prerelease, intended for testing the restructured Control, Instance, MCP, and Extension architecture. It is not a stable release or a drop-in, backward-compatible replacement for 0.7.x.

Highlights

1. Explicit lifecycle ownership: Instance owns its Worker supervision, execution, ToolCall ingress and audit lifetime. Control retains its host-level registry and server responsibilities. MCP Server, Protocol Route, OAuth, and MCP App resources have explicit generation, route lease, and teardown boundaries.
2. Domain-based transport and routing: Frame/Envelope/Endpoint communication and domain-specific request, event, and stream surfaces replace retired cross-layer adapters. Clients access the current domain contracts instead of legacy Worker or Control internal APIs.
3. Modern MCP and Web access: the current MCP endpoint and model tool catalog replace retired compatibility paths. Web OAuth2 supports first-party authorization, PKCE, public path prefixes, scoped tokens, and lifecycle-aware listener replacement.
4. Durable Workspace and ToolCall workflows: Comment, Approval, Goal, Todo, task recovery, action receipts, and host reentry follow the current Instance/Extension ownership. ToolCall review and rewrite stages remain explicit, and rejected calls have an audit trail.
5. Real host and release-asset acceptance: Testspace validates local and Reverse Workers, remote attachment, real tools, Web browser, hot replacement, failed-update rollback, and long-running tmux handoff. The release pipeline builds independent application and Worker assets for Linux, macOS, and Windows on x64 and ARM64.

Release-candidate hardening

• TUI startup routing: the route chosen while Control domains initialize now receives its initial load; real Ink Audit/Comment navigation and the Context snapshot contract are covered by platform tests.
• Control cold start and Extension retirement: start readiness accounts for bundled Extension activation; lease-drain tests distinguish candidate validation cleanup from active generation retirement and release held leases before test teardown.
• Agent archive packaging: the platform-neutral portable-devshell-agent.dsext packs from the current Control build output. Linux x64 development CI now exercises this exact archive path ahead of the Release workflow.

Breaking changes and upgrade guidance

• 0.7.x protocol and client compatibility is not promised. Obsolete MCP session, transport, command, and Worker compatibility paths have been removed rather than maintained in parallel. Upgrade the participating components together; do not assume an older Control, Worker, or client can communicate with this alpha.
• Legacy configuration migrations have been retired. The current global configuration schema is version 2 and the current Instance configuration schema is version 4. Do not rely on devshell migrate to convert old global v1 or Instance v2/v3 files. Back up the existing installation and prepare current-schema configuration before using this alpha.
• Do not replace a working production installation during initial evaluation. Use a separate PORTABLE_DEVSHELL_HOME, a separate runtime directory, and loopback-bound private Web/MCP ports until the target environment has passed its own acceptance tests.
• Agent is installed separately. The Core Release carries the platform-neutral portable-devshell-agent.dsext; it does not automatically install Agent or bundle provider runtimes. Install or update the Extension explicitly, and configure the Instance model allowlist as needed.
• Model-side discovery and attachment follow the current contract. The model-facing MCP catalog is fixed; per-Instance model commands are governed by [extensions].model. Reverse Instance discovery and Context attachment use the supported environ_remote command flow. Do not use obsolete instance_connect or legacy MCP group policies.

Verification scope

• Linux x64 prerelease candidate: local lint, typecheck, package and Rust tests, native Worker/installer/Reverse/CLI smokes, and 47 real tmux contract tests passed. A dedicated isolated Testspace passed its 10-command functional matrix and a real 180-second tmux detach boundary.
• Independent physical Linux x64 host: the same verified application archive and statically linked Worker ran on aromatic-server, not the developer machine. Cross-machine MCP v2 tool calls, remote file/terminal/Todo operations, concurrent requests, Chromium WebUI, Instance stop/start, listener hot update, occupied-port rollback, and isolated Control restart were exercised successfully.
• Known constraints: the remote test used loopback-only, no-auth QA listeners. It did not establish remote OAuth2 production-readiness; the server's Node.js 26 runtime also emitted an upstream oidc-provider LTS-support warning. Explicit Instance start was required after the QA Control's deliberate stop/restart.
• Formal release verification: GitHub development CI passed all eight jobs for dev1.0.0-alpha.1-6 at commit cd05884ce2a32f2c2fbd5603197abf2f1117416b (run #38126713049). The official Release workflow (run #38141557504) independently rebuilt and verified the six native targets (linux-x64, linux-arm64, darwin-x64, darwin-arm64, windows-x64, windows-arm64). The published application, Worker, Agent Extension, and installer files carry SHA-256 checksums. Windows target builds do not establish full physical PowerShell/ConPTY interaction coverage.

Refer to docs/development/acceptance.md, docs/development/compatibility.md, docs/operations/configuration.md, and docs/getting-started/installation.md for the current operational contracts and supported release flow.