LocalRouter v0.1.0-alpha.5

Highlights

• Adds an opt-in LAN service listener for authenticated consumer APIs while keeping the console, /local/api, and /manage/mcp loopback-only.
• Adds a pinned multi-stage Docker build and hardened host-network Compose deployment: non-root runtime, read-only root filesystem, dropped capabilities, persistent private volumes, graceful shutdown, and configurable health checks.
• Lets lr use an operator-approved LAN endpoint only after unauthenticated discovery proves it is a service-only surface with maintenance unavailable.
• Improves exact Pack-qualified model discovery, catalogue timeouts, model_cls and media catalogues, request-schema enum models, and dynamic-input compatibility matching.
• Improves pooled readiness probes with distinct-credential retry and prompt rechecks after unhealthy credentials enter cooldown.
• Includes the request usage ledger, unified service management, retired Token-locator migration, and stale-draft rejection added since alpha.4.

Verification

• Full Go, race, Web, Protocol Pack, REST, SSE, binary, workflow, LAN, install, and open-source release suites passed.
• The real Docker image passed non-root, read-only, capability-drop, route-isolation, authentication, graceful-shutdown, health, and persistent-Token recreation checks.
• Physical LAN operation was verified from a separate workstation against Docker Engine on a second Linux host.
• Gitleaks, govulncheck, and OSV Scanner reported no release-blocking issue.
• The published Linux amd64 archive was installed and exercised; the Linux arm64 archive and both checksums were inspected by the release workflow.

See docs/DOCKER.md for fresh Docker deployment, LAN access, browser-origin policy, and migration from an existing native installation.

This is an alpha pre-release. Public source and archives contain no private provider Packs, credentials, pool contents, or private upstream addresses.