v0.6.0 — Manual Tailscale updates and relay diagnostics

v0.6.0 — 2026-10-26

This release combines merged PR #49 and PR #51. Publishing this release does not deploy it to an existing installation.

Changes

• dots-ts runtime check, apply, and status provide explicit manual updates of the installed Tailscale CLI/daemon pair. Downloads or private offline bundles are bounded and validated before cutover. A detached worker, shared operation lock, persistent fence and journal preserve recovery information when SSH disconnects.
• Successful cutover preserves existing node state, SSH identity, shim/OpenSSH and configuration. Once candidate daemon execution is attempted, uncertain failure requires manual recovery; automatic state downgrade is not assumed safe.
• The separately deployed research relay preserves sanitized worker errors, exit codes and runtime diagnostics. A successful delivery clears current errors while transition records retain the previous failure. Installing the standard package does not deploy this relay.

Installation and upgrade

Keep all four executable sources and the original source-manifest.json together. Use the usage guide to install the matching v0.6.0 tools before using the runtime updater. An older installation must not be operated on using only a new checkout's CLI.

The default installation pin stays at Tailscale 1.102.4. Existing package updaters reject changes to the declared binary version; retaining that pin allows the new tool to be installed first. Updating the source package does not update the Tailscale binaries. After reviewing the current official stable version, use runtime apply --version ... --confirm-recovery-terminal explicitly. A fresh installation also starts with 1.102.4 until explicitly upgraded. Raising the default pin requires a separately validated migration.

Open an independent cloud terminal and pause any external recovery jobs before runtime cutover. After local success, verify fresh external SSH/ping and any application paths you need before resuming those jobs. No automatic update schedule or watchdog is enabled.

Evidence and limits

• Both merged PRs received completed Codex code and security reviews without findings (#49 review, #51 review). PR #51 also passed the requested independent Claude Code/Codex CLI review before creation. Its later live-validation commit changed documentation only.
• PR #51's executable candidate 2ef1c77 passed 327 core tests on Linux Python 3.11 and 3.13, including 71 runtime fixtures. The isolated artifact smoke verified official 1.102.4 and 1.104.2 archives and real version-only outputs without network access or host/state mounts in the probe containers.
• The 2026-10-26 live trial installed the development candidate and upgraded CLI/daemon from 1.102.4 to 1.104.2, preserving identities and recovering external SSH/ping. This single normal-path trial does not cover live failure injection, state downgrade, VM replacement or all future releases.
• The stable release changes package metadata and documentation, not the reviewed executable sources. Final-commit checks, research tests and artifact verification are recorded in the GitHub Release.
• Tailscale 1.104.2 is an observed tested version, not a claim of Tailworm remediation. Same-origin checksums establish consistency, not independent publisher-signature authentication.

Deferred scope

v0.7.0 tracks opt-in automatic updates (#31), watchdog/external recovery coordination (#44), and reproducible experimental recovery setup (#45). Lifecycle (#20), external MCP recovery (#43) and exit-node feasibility (#16) remain in Research; their unresolved scope is not claimed by this release.

Release verification

Release commit: caf5942d8e0f8bcc2b67d1130d74a3cdadef8252.

• Core checks: Python 3.11/3.13, manifest and shell checks.
• Research checks: recovery transport and lifecycle tests on Python 3.12/3.13.
• Official artifact smoke: isolated 1.102.4/1.104.2 archive and version checks.

Eight attached assets: source ZIP and tar.gz, tailscale-setup.sh, shim.py, dots-ts, dots_proxy.py, source-manifest.json, and SHA256SUMS. Both archives match all 119 tracked files of the release commit. Keep the four source files and their original manifest together. The archives include research sources; the ordinary installer does not deploy that research infrastructure.