v0.1.0-lab.5

Lab-only prerelease. Not a public release.

Built from 0b3a661c3c680bae1f03356e999731828db63b3d with all six shared mecmcp crates pinned to v0.8.0.

sha256  e46e17473728b8b056fd2aba2bcc7749e4061b3fca908940f6ee3b3c8662275c

The compatibility blocker is cleared

Previous release notes said v0.1.0 was blocked until one coherent upstream release replaced 59 compatibility ledger entries. That happened. The compat/ layer was deleted in #36 on the move to mecmcp 0.7.2, and the ledger in 369f9bb on the move to 0.8.0.

What still gates a public v0.1.0 is operational rather than upstream: container image support, remote audit-journal forwarding, broader live validation, and a tool surface that covers a minority of the SDC API.

Three questions answered against a live tenant

Each had blocked an issue on "needs a live tenant", and each is now recorded in docs/sdc-api/README.md.

• Certificates and licences carry no key material (#50). Six readers return metadata only. Four traps recorded, including two date formats inside one object and public-key metadata a naive key denylist would wrongly redact.
• Device sync imports, and does not fix drift (#21). The device's commit log was unchanged across a sync, so nothing is pushed — but it reconciles inventory only and leaves device_config_state: OUT_OF_BAND_CHANGED. It is not the remedy that issue wanted, and GetSyncStatus does not share the deploy job's status vocabulary.
• Templates are arbitrary Junos CLI (#33). The 17 built-ins cover system config only — no general interface or routing template, and no security dynamic-address. Custom definitions can express those, but whether template-placed config survives a policy deploy is a different pipeline and remains untested.

Added

• Certificate and licence tools: six reads, eight writes under change control (#32).
• IPsec profile and tunnel reads (#28); firewall and NAT rule reads (#25); NAT pool reads (#30).
• NAT policy authoring (#27), firewall policy writes (#24, partial), object authoring (#29) — all under change control.
• get_sdc_change_set_details, recovering a preview digest that prepare returns only once (#22).
• An allowlist projection over certificate and licence reads, applied at the MCP boundary so change-control drift detection keeps full-fidelity state (#50).

Changed

• Adopt the shared mecmcp change-set CLI standard: --lab-mode, --state-file, --approval-timeout-secs (#54). Explicit CLI beats product configuration, and adoption cannot silently relocate an existing deployment's state file or change its approval TTL.
• --version now answers. It previously failed as an unknown argument, which broke the package-identity check a deployment runs.
• --lab-mode waives the second principal for single-operator use. Wiring the flag alone was not enough — nothing called the waiver, so a plan could not move past Planned. The waiver is applied at change-set creation, records approver: null with approval_waiver: "lab-mode", and never fabricates an approver.
• Adopt mecmcp 0.8.0 and delete the local compatibility transport copies (#36).

Fixed

• Refuse --approval-timeout-secs 0, which expired every change set at creation and disabled the entire write surface.
• Attribute an expected_preview_digest mismatch to that argument by name.

Documentation

• Corrected release claims across README, CHANGELOG, and the operations guide. Five places asserted the cleared blocker, and the README denied a live policy deploy that had in fact happened — the deploy that #23 exists because of.
• Documented that a wildcard token scope grants no write tool: --tools '*' yields the read surface only.

Known gaps

• #55 — certificate and licence write tools still return the raw before-state, bypassing the read-path allowlist. No exposure today; the allowlist equals the observed field union.
• #21 implementation, #33 template tools, #31 (~110 operations), #34 remain open.