v0.6.5

Patch release in the v0.6 "Kentucky Butter" line. Ships with devcake-cli 0.1.9 — upgrade the CLI before devcake up --release v0.6.5.

Operator sequence on a host that runs AppArmor (stock Ubuntu): upgrade the CLI (uv tool install --reinstall '.[mcp]' from this checkout, or devcake-cli 0.1.9 from PyPI) → let running missions finish → devcake up --release v0.6.5 (archives the Dagu state store, then warns that the Dev-container profile is not loaded and carries on without the nested engine) → run the two sudo commands devcake doctor prints (they install and load scripts/apparmor/devcake-nested; an older copy reads as outdated and needs the same two commands) → devcake up → after the harness images re-bake, devcake doctor shows apparmor_profile ok and devcake status shows nested engine: ok … compose too. Hosts without AppArmor (WSL2, Docker Desktop): upgrade the CLI and run devcake up --release v0.6.5; nothing else changes.

Security posture, stated plainly (docs/14 §6): on AppArmor hosts the profile lifts the default restriction on unprivileged user namespaces for Dev containers, and on every host a Dev can read a few host-information files Docker normally masks.

• Added — compose inside Dev containers. The harness images ship a
  pinned podman-compose as the nested engine's compose provider, reached
  through docker compose and a docker-compose symlink alike, with the
  iptables binary netavark needs for compose-created networks and the
  provider banner silenced; the nested-engine probe records a compose step
  in its receipt, shown on the Dev Types panel, devcake status, an
  Overview warning and the Dev's prompt when it is red. The Dev's prompt
  section names the compose gaps (health-check waits, daemon socket, host
  name). Before this the images carried no compose at all.
• Fixed — the nested engine inside Dev containers works on hosts that
  run AppArmor (ADR-0023 addendum). Under Docker's default profile the
  rootless engine could not mount, and Ubuntu confined it further the
  moment it created a user namespace; nested docker/podman had never
  worked on such hosts, only on the rigs without AppArmor. The checkout
  now ships a Dev-container profile (scripts/apparmor/devcake-nested,
  compiled in CI) that the operator loads once (devcake doctor prints
  the two commands, never runs them); devcake up derives the profile
  name into .env — asking the daemon first, so a profile the host cannot
  apply is never named (a virgin host with no image yet falls back to the
  installed file compiled by the host's own parser) — the run DAG names it on both Dev steps, allows
  the one extra syscall the runtime needs, and launches with Docker's
  masked system paths removed. Security posture, stated plainly: on
  Ubuntu hosts the profile lifts the default restriction on unprivileged
  user namespaces for Dev containers (a Dev may hold capabilities inside
  namespaces it creates, which the rootless engine needs), and on every
  host a Dev can now read a few host-information files Docker normally
  masks; the profile re-denies them on AppArmor hosts, elsewhere they stay
  readable. docs/14 §6 has the full list. The host baker
  now runs the nested-engine probe after every harness bake and
  publishes the newest receipt: the Overview warns, the Dev Types panel
  and devcake status name the first red step, and a Dev on a red host
  is told in its prompt that containers are unavailable — runs still
  launch. devcake up archives the Dagu state volume under
  .factory/backups/ (0600, named with the version it came from, newest
  three kept, the newest versioned one never evicted) when the checkout pins a Dagu the volume was not last used
  with — the last container's image decides, or after devcake down
  whether the pinned image was ever pulled here; dagu is stopped for the
  copy and started again at once — a backup for rollback, not a migration; the
  command is printed when it cannot be taken. The baker re-measures the
  nested-engine receipt after a kernel or engine upgrade and asks the
  daemon every minute whether it still applies the named profile; when it
  no longer does, every surface says that no Dev container can start until
  the profile is loaded again or devcake up is run.
• Changed — devcake-cli 0.1.9. The host CLI carries the AppArmor
  derivation, the doctor check and the Dagu archive; a release checkout
  refuses devcake up --release under an older installed CLI, so upgrade
  the CLI first (uv tool install --reinstall '.[mcp]' from the checkout,
  or the PyPI release of the same version).
  Every Dev prompt now carries a short section saying what docker is
  inside the container.
• Changed — Dagu 2.13.0 → 2.16.3. The release that carries our
  upstream fix for container limits: the run DAG now writes them in
  Docker's own flat form instead of the nested workaround the old decoder
  needed. Also in the range: a step's containers are stopped on timeout,
  the docker group is created by the stock entrypoint, and the Dagu state
  layout was refactored — devcake up archives the Dagu volume before the
  re-pinned Dagu first starts (the "Fixed" bullet above).