Skip to content

Release 2.1.123 (2026-07-09)

Bug fixes

  • abort when a repo declares named instances but none is selected (#2254) A role that declares [vm..instances.] overlays uses its base tier as a shared template, not a bootable box. Resolving such a repo with no --name silently composed that base into a phantom default whose VM was never created, so the user only hit a misleading 'VM does not exist — build it with vrg-vm create' error downstream. This was especially confusing through a shared_from borrow: session on the borrower redirected to the lender and demanded a create of a box the user never meant to build, when the working path was simply --name .

Guard _resolve_target: when the effective (post-borrow) repo's role declares named instances and no --name was given, raise SpecError listing the available instances and instructing --name. The check runs on the effective repo, so it covers both direct use and borrowed lenders, across every VM-targeting command. compose_vm_spec is unchanged, so default composition (used by list drift-classification and the fingerprint contract) still works.

Documentation

  • add the epic-home visibility-flip runbook (#2253) Document the corner-case procedure for relocating a repo's epics when it flips between public and private (its resolved epic home changes). No dedicated tool: re-create the epic in the new home, re-parent tasks with vrg-epic-move, close the old epic. Covers the cross-visibility caveat (a still-public task can no longer hard-link under a now-private epic; use a soft Blocked-by: from the private side). Task of epic #130.

Features

  • source epics from the resolved home (self for private repos) (#2250) roadmap.gather/render now source from a resolved epic home instead of hard-coding /.github: the default resolves to the org's .github (unchanged org-level roadmap), and vrg-roadmap --repo owner/repo scopes to that repo's resolved home so a private repo self-homes its roadmap. --org and --repo are mutually exclusive. Org roadmap omits private epics by design. Task of epic #130.

  • refuse public task under a private epic (visibility boundary) (#2252) Add a visibility-boundary guard to vrg-epic-link: a task may hard-link to an epic only if it is no more publicly visible than the epic's home. A public task under a private epic would leak the private repo's name into a public issue and break cross-boundary roll-up, so it is refused with guidance to reference the public work via a soft Blocked-by: from the private epic's body instead. Binary is_public; fail-loud on a probe error. Task of epic #130.

  • self-contained --repo audit sourced from the resolved home (#2255) vrg-epic-audit --repo / audits that repo's resolved epic home (a private repo self-homes its epics). Threads the resolved home through the home-scoped checks — epic_drift, operational_pending, stray_dotgithub_issue, and close_drift — and names the home in the report banner. The org-wide checks (task_drift, epic_outside_dotgithub, closed_operational_without_success) stay org-scoped. Home defaults to /.github, so the default org audit is unchanged. Completes epic #130 (the deferred half of #2234).