v0.1.0-lab.7
Pre-release
Lab-only prerelease. Not a public release.
Built from 1e88893774eabc7489cbe4c736512d5e5e47b89a with all six shared mecmcp crates pinned to v0.8.0.
sha256 0949a744a1f86ff8c56ea778cb3a61f3798a6e9e23dadb25e463fc351d3b2cb3
Phase A of the completion plan: the four change-control defects. Closes #61, #63, #66.
Two things to do when upgrading
Re-mint your tokens. The surface is now 51 tools. A token's tool scope is an explicit allowlist, so a token minted against the previous 50 will not see discard_sdc_operation. This presents as a failed deployment and is not one — check the token's scope length before suspecting the build.
Expect previews to look different. They are XML now, not CLI set lines. That is the fix rather than a side effect; see below.
Previews now cover the whole change (#66)
A deploy was observed committing a deletion its preview never disclosed. The cause turned out to be entirely on this side: GET /api/v1/policies/preview/{id}/devices/{id} accepts a format parameter — CLI (the default) or XML — and this client never passed it.
The same preview, fetched both ways:
format=CLI |
format=XML |
|
|---|---|---|
| bytes | 273 | 570 |
parent feed-server named |
no | yes |
| delete markers | 1 | 4 |
Since the preview digest is computed over that artifact, an approver could be shown less than the change. SDC was never concealing anything — its XML answer was always complete, and the deploy did exactly what that answer said. This client digested the lossy rendering of it.
Verified live before release: the parent object now appears in the digest-bound artifact.
Wedged operations can be cleared (#63)
A failed deploy left an operation that refused every later apply on the tenant, with no supported remedy short of editing changeset-state.json on a running deployment. Observed twice in production on 2026-08-12.
discard_sdc_operation clears it. Owner-only, fingerprint-bound so a stale caller cannot clear an operation it has not read, and registered in WRITE_TOOLS so a wildcard token scope cannot reach it. The failed operation stays visible — this unblocks applies, it does not erase the failure.
Exposing the upstream call alone would have made things worse: it invokes transaction.rollback, which returned an error the caller converts to Indeterminate — a state that can never be discarded. So SdcTransaction::rollback reports truthfully first, since SDC reverts the device itself on a failed deploy.
Unsupported deploy targets are refused locally (#61)
DEVICE_GROUP is marked "Not supported, future support" in the pinned spec, but requests naming one were built, sent, and rejected — after spending a preview job on the management plane. Now refused before any request, with a message quoting the spec. One guard and one call site, deletable when SDC supports it.
Known gaps
- #55 — certificate and licence write tools return the raw before-state, bypassing the read-path allowlist. No exposure today.
- #21, #31, #33, #34 — coverage epics. #31's ~110 operations and 36 of the 61 API groups share one five-operation shape the existing resource catalog can absorb; that is Phase B.