v0.1.0-lab.6

Lab-only prerelease. Not a public release.

Built from 9d4048fb971365da56fa4c642782b2929704bfdf with all six shared mecmcp crates pinned to v0.8.0.

sha256  b7d68e4c1df58422121ba9e68e4db8f2b2ab013a83bc42ec14415cfe6606e229

Upgrading from lab.5 requires re-minting your tokens

The tool surface is now 50 — 39 reads and 11 change-control tools, up from 48.

A token's tool scope is an explicit allowlist of names, so a token minted against the previous 48 keeps seeing exactly those 48 after the upgrade. The two new tools simply do not appear. This presents as a failed deployment and is not one; check the token's scope length before suspecting the build.

Re-mint with the full list:

rustsdcmcp token add --tokens-file /etc/rustsdcmcp/tokens.json \
  -f /etc/rustsdcmcp/sdc.json --name <name> --devices <tenant> \
  --tools '<all 50 names>'

A wildcard --tools '*' still grants no write tool — that is deliberate, enforced in mecmcp-auth, and unchanged.

Added

• Device group reads (#34): list_sdc_device_groups and get_sdc_device_group. Reads only; group create, update, and delete remain unimplemented pending the gating decision in #24. The list accepts the API's fields projection, which matters because size bounds the number of groups and not the size of each — a group embeds its membership.

Documentation

• How to enable --lab-mode. lab.5 documented what it means without ever showing the invocation. Also corrected: --lab-mode is CLI-only, with no sdc.json fallback, unlike --state-file and --approval-timeout-secs.
• A policy deploy deletes template-placed configuration that no imported policy references (#33), confirmed by a committed apply against a live device. Template origin confers no protection, so #23's co-management boundary stands and templates are not a remedy for it.
• A deploy can commit more than its preview disclosed (#66). In the observed case the preview named one object and the commit removed two, with the omitted object absent from the digest-bound artifact entirely. The change-set binding behaved correctly; what it bound did not describe the whole change. Treat a preview as a lower bound until the conditions are understood.
• The undocumented custom-template upload schema, derived from the endpoint's own errors, and an edge WAF that rejects a template body containing http:// plus an RFC1918 address.
• DEVICE_GROUP is not a supported deploy target — the pinned spec marks it "not supported, future support" — correcting a claim in #34 (#61).

Known gaps

• #66 — preview under-reporting, above. The most consequential open item.
• #63 — a failed deploy wedges every later apply on the tenant, and discard_operation is unexposed. Recovery currently means hand-editing the state file.
• #61 — a DEVICE_GROUP target is accepted locally and fails downstream instead of being refused.
• #55 — certificate and licence write tools return the raw before-state, bypassing the read-path allowlist. No exposure today.