Releases

Changelog

All notable changes to this project will be documented in this file.

[0.2.0-beta.1] - 2026-10-11

Added

• Remove Flux delivery fields and kurel’s Flux delivery mode
• Order components only where the document declares it
• Declare contract metadata and lowering targets on every builtin
• Let an author name the scaler, rbac and networkpolicy objects
• Label what a component owns and report its owner
• Default the Helm release name to the component name under both deliveries
• Order oci Kustomizations after their shared source
• Resolve generated names through a consumer naming hook
• Prune-protection and force-replace set a delivery intent
• Let the author and the naming hook name the postgresql Pooler and Databases
• Refuse a pod-spec trait on a component without a workload
• ObjectName names the object of a kind component
• Add six cluster-scoped kind components on a shared helper
• Let the six cluster-scoped kinds take objectName
• Name the generated source and the helm values objects
• Add the servicecidr, poddisruptionbudget and horizontalpodautoscaler kinds
• Refuse reserved metadata keys on every generated object
• Name the Kustomization of each helmtemplate hook-group child
• Give every policy refusal a class a consumer can read
• Labels and annotations on every kind component
• Make the name-collision refusal recognisable
• Make the reserved metadata key refusal recognisable
• Recognise the over-long hook-group name refusal and raise it in the transform
• Give the component label’s refusal a type and a sentinel
• Name the claim a role component’s pvc volume generates
• Resolve the ingress and httproute trait objects under name roles
• Label a CronJob’s job template and hold it to the reserved keys
• Resolve the Secrets the traits have written under two name roles
• Add the generated name role
• Declare exactly-one-of and at-most-one-of property groups
• Add the object kind policy
• Export the built-in handlers and lowering rules from pkg/oam/builtin/registry
• Expose the pod view of a monitoring workload object

Build

• Bump kure to v0.2.0-beta.15.0.20261004180425-97dce7a4b760
• Bump kure to v0.2.0-beta.15.0.20261004224508-0afd7ca8c4b8
• Bump kure to v0.2.0-beta.15.0.20261005031541-144a533dbcf3
• Bump kure to v0.2.0-beta.15.0.20261005101450-d3a45fad7a9a
• Keep Renovate off the monitoring API module shared with kure
• Bump kure to v0.2.0-beta.15.0.20261005142203-fef959cefb0a
• Bump kure to v0.2.0-beta.15.0.20261005152652-5dd0e22643ce
• Bump kure to v0.2.0-beta.15.0.20261005182950-3afb93e06660
• Require k8s.io/apiserver directly
• Update dependency syft to v1.54.1
• Require the Flux API modules of the new kinds directly
• Keep k8s.io/kube-openapi from being proposed on its own
• Name the vulnerability-alert exception for kube-openapi
• Require the flux-operator module directly
• Bump external-secrets apis to 2.12 and kure to 3978ab14
• Re-pin kure to main
• Bump Go to 1.26.9 and golang.org/x/net to v0.60.0
• Keep goimports out of testdata and hidden directories
• Update dependency goreleaser to v2.18.3
• Update module golang.org/x/mod to v0.42.0
• Update module golang.org/x/vuln to v1.9.0
• Pin kure v0.2.0-beta.16

CI

• Key the Go build cache on a UTC-day bucket, not a source hash
• Save the tool-binary caches from main only
• Drop the stale GO-2026-6596 allowlist entry

Changed

• Shorten every generated name by one rule
• Shorten the routing, backup and TLS default names too
• Shorten the role PVC claim name, keep an oversized suffix in bounds
• Drop a repeated nil check in the sibling group’s Generate
• Write the component type maps in the order of their types

Dependencies

• Exclude fluxcd pkg/apis/kustomize from Renovate

Document Format

• Hold a helmtemplate chart in app.yaml to the replica maximum
• Add the namespace kind component
• Add the limitrange kind component
• Add the resourcequota kind component
• Add the persistentvolume kind component
• Set the release name of a template-rendered chart in app.yaml
• Let the pod-template policy check take an empty path
• Add the pod kind component
• State what a schema-validating caller sees for the refused pod fields
• Make the pod kind a trait target
• Refuse a rendered list that involves a Helm hook
• Hold each item of a registered list to the undeclared-field rule
• Check the hook only in the items a list is replaced by
• Add fluxcd-kustomization to app.yaml; oci lowers to kind components
• Take scopeOverrides on helmtemplate
• State the order manifest.Scope resolves in
• Add the replicaset kind component
• Add the replicationcontroller kind component
• Add the podtemplate kind component
• Refuse an unknown key inside a Cilium selector
• Turn a panicking API decoder into a build error
• Report a decoder panic on a manifest document as a build error
• Take sensitive Helm values in app.yaml as secretValues
• Read a nil map as a null in the secretValues shared-path check
• Resolve the secret trait’s sub-application through the naming hook
• A Secret is no longer unchecked on passthrough and manifests
• Name the explicit-secret refusal where other kinds are said to pass
• Take scopeOverrides on helm under delivery: template
• Read seven container fields on every workload container
• Raw tolerations and topology spread on statefulset
• Raw affinity, topology spread and sidecars on daemonset
• Raw affinity, tolerations and topology spread on job
• Raw affinity, tolerations and topology spread on cronjob
• Selector, dataSourceRef and volumeName on a standalone claim
• Scope a passthrough object in app.yaml by its kind
• Read the remaining ServiceSpec fields on the service kind
• Claim the object names the routing and Cilium traits settle
• Add the ingress kind component
• Add the httproute kind component
• Add the networkpolicy kind component
• Add the cilium-networkpolicy kind component
• Say why the Cilium trait claims its name as authored
• Add the secret kind component
• Hold cnpg-cluster to the shared spec comparison
• Add the servicemonitor, podmonitor, prometheus-probe and prometheusrule kind components
• Add the issuer, clusterissuer and certificate kind components
• State three limits of the cert-manager kinds exactly
• Add the cilium-bgpadvertisement, cilium-bgpclusterconfig, cilium-bgpnodeconfigoverride and cilium-bgppeerconfig kind components
• Add the cilium-cidrgroup, cilium-loadbalancerippool, cilium-egressgatewaypolicy, cilium-localredirectpolicy and cilium-nodeconfig kind components
• Add the cilium-clusterwidenetworkpolicy kind component
• Refuse a cilium-networkpolicy rule without a required field
• Refuse a cilium-networkpolicy trait rule without a required field
• Name the Cilium kind helper for every Cilium kind
• Add the gatewayclass, gateway, listenerset, referencegrant and backendtlspolicy kind components
• Say when a BackendTLSPolicy hostname authenticates the backend
• Name the Kustomization and the kept source of an oci component
• Name the HelmRelease of a helm component
• Refuse a required field that a kind’s type leaves out
• Name the empty strings a cnpg-cluster does refuse
• Hold a pod’s image volume to the allowed registries
• Hold every image a cnpg-cluster names to the allowed registries
• Say where a cnpg-cluster takes an image it does not name
• Name the objects of a webservice and a worker component
• Refuse a required field that a kind’s type writes as null
• Say what an issuer’s solver fields leave to the API server
• Hold every image a document names to the tag rule
• Name the Cluster and the ObjectStore of a postgresql component
• Refuse the endpoints of a postgresql pooler named as its Cluster
• Refuse the endpoint of a cnpg-pooler named as its cluster
• Read a cnpg-pooler’s cluster reference as its decode does
• Read a cnpg-pooler’s properties for its endpoint as the build does
• Refuse a required string that a kind’s type writes empty
• Say which refusals of the cnpg kinds Generate repeats
• Refuse an object store path postgresql would write empty
• Count an external object store path in any spelling
• Check a peer’s timers rule against the CRD’s defaults
• Refuse a postgresql block that would not be built
• Write a postgresql pooler’s authored instances of 0 or less
• Add the endpointslice kind component
• Add the role, rolebinding, clusterrole and clusterrolebinding kind components
• Name the traits README by its path in the RBAC kinds entry
• Add the secretstore, clustersecretstore, externalsecret and clusterexternalsecret kind components
• Hold an external secret’s target.manifest to the environment policy
• Refuse a target.manifest apiVersion that is no API version
• Hold a target.manifest apiVersion to group and version names
• Correct two statements about an external secret’s references
• Refuse a cnpg-cluster’s endpoint where the build refuses its properties
• Refuse the endpoints of a postgresql pooler named as its component
• Answer an endpoint only for a component its type’s parse accepts
• Hold the postgresql endpoint entry to the members its lowering emits
• Add the replicationsource and replicationdestination kind components
• State what of a VolSync mover’s pod the policy does not hold
• Hold a VolSync rsync mover to the policy’s container capabilities
• Say that no kind is reachable only as a trait any more
• App.yaml helm and helmtemplate components take layoutKustomizationName; shorten a chart layout’s Kustomization name over 63
• Refuse every unread upstream field of a hand-parsed kind with its reason
• Refuse a defective match expression in a built-in kind’s label selector
• Require a match expression’s key and operator on a CRD-backed kind
• Refuse an app.yaml Application whose objects hold another component’s label
• Hold an app.yaml Application’s mover pod, solver pod and Gateway infrastructure labels
• Add the fluxcd-alert kind component
• Add the imagepolicy kind component
• Add the imageupdateautomation kind component
• Add the artifactgenerator kind component
• Hold the ResourceSet and FluxInstance kinds
• Say what a kind in the Flux namespace shares
• Correct two statements about an Alert’s event sources
• Say in the fluxcd-alert schema what matchLabels narrows
• Put the highlights of the Flux kinds where the placement rule says
• Keep the contract and object methods of the Flux kinds in their files
• Require a policySelector match expression’s key and operator
• Mark as required the properties six kinds refuse a component without
• Hold the seven Flux kinds to what their API requires and defaults
• Refuse reserved keys in an app.yaml Application’s metadata that reaches no pods
• Refuse an empty string on a field whose default the API applies
• Read statefulset affinity as the raw corev1 shape
• Add the metallb-ipaddresspool kind component
• Add the metallb-l2advertisement kind component
• Add the metallb-bgpadvertisement kind component
• Add the metallb-bfdprofile kind component
• Add the metallb-community kind component
• Exclude MetalLB from Renovate and describe empty advertisements as the widest
• Add the metallb-bgppeer kind component
• App.yaml volsync trait takes an optional name for its ReplicationSource
• App.yaml configmap, secret and pvc traits claim their object names
• Read a container’s windowsOptions and an init container’s restart policy
• Hold windowsOptions strings to upstream’s rules
• Let a Flux kind be held to the environment policy
• Write a Flux kind’s durations in the form their pattern takes
• Add the imagerepository kind component
• Add the fluxcd-provider kind component
• Add the fluxcd-receiver kind component
• Check a Flux kind’s duration under a list by its authored text
• Add the resourcesetinputprovider kind component
• Refuse an @ in a Provider address that is no URL with a host
• Refuse an @ in a proxy or url that is no URL with a host
• App.yaml fluxcd-receiver refuses a user or password in an OIDC issuerURL
• Say that a fluxcd-receiver issuerURL that does not parse is refused
• Say the standard channel’s HTTPRoute CRD does not hold useDefaultGateways
• Hold the two Cilium Envoy config kinds
• Refuse an authored empty list the API would default
• Give a key refused below the top level the reason its parser has
• Give podResources.claims the reason upstream refuses it with
• Publish app.yaml one-of groups and refuse an empty member beside a set one
• Add the tcproute, udproute and tlsroute kind components
• Add the grpcroute kind component
• Say the standard channel’s GRPCRoute CRD does not hold useDefaultGateways
• Name gateway-api v1.6.3 as the version the experimental-field claim holds at
• Add the cnpg-imagecatalog, cnpg-clusterimagecatalog, cnpg-backup, cnpg-scheduledbackup, cnpg-databaserole, cnpg-publication and cnpg-subscription kind components
• Refuse an image the CloudNativePG operator would choose under a registry allowlist
• Refuse an unnamed CloudNativePG image only after the authored checks
• App.yaml pod kinds refuse a defaulted string written as ""
• Make the defaulter vendoring script executable
• App.yaml refuses a reserved key in a raw StatefulSet’s volume claim templates
• Add the alertmanager kind component
• Refuse an unset alertmanager image under a registry allowlist
• Say an image-less monitoring container is unchecked by any name
• Say kurel build refuses an empty deprecated alertmanager image field
• Hold the alertmanager kind to what the operator runs
• Refuse an alertmanager memory limit under the operator’s request
• Say which alertmanager pod fields the derivation recognises
• Hold the alertmanager container as the operator merges it
• Check the alertmanager container only as the operator runs it
• Check an unnamed container’s resources alone
• Refuse alertmanager specs the operator cannot run
• Refuse alertmanager values the operator or the API refuse
• Refuse alertmanager values only where the operator writes them
• Leave alertmanager TLS credential volume names to the API
• Keep the monitoring kinds’ defaulted-zero list to the pod numbers
• Refuse alertmanager specs the CRD admits and the pods cannot run
• Name retention values the alertmanager CRD refuses
• Say the object kind policy can keep the alertmanager kind out of a build
• Refuse an alertmanager secret or configMap whose volume name is cut after a -
• Drop the alertmanager claim templates’ comparison with a statefulset’s
• Refuse four alertmanager specs the operator cannot build
• Refuse alertmanager DNS, HostProcess and TLS specs the pods cannot carry
• Hold alertmanager flags and patched ports only where the operator generates them
• Refuse alertmanager zeros the pods’ defaulting replaces
• Refuse an alertmanager externalUrl Alertmanager exits on
• Hold the externalUrl scheme at v0.19.0’s prerelease too
• App.yaml refuses a reserved key in a monitoring kind’s storage claim template
• Read a monitoring kind’s storage claim template only as the arm in use
• Model the merge of a monitoring patch’s ports and refuse duplicate names
• Take a monitoring patch’s ports as listed where the operator gives the container none
• Hold a monitoring serviceName to the Service name rule, a DNS-1035 label
• Say where the API refuses a monitoring serviceName that is not a DNS-1035 label
• Refuse alertmanager fields below the version that reads them
• State what an unset alertmanager version is judged at
• Judge alertmanager flags and field gates at one pinned default
• Hold minReadySeconds at every alertmanager version
• Refuse an alertmanager clusterAdvertiseAddress Alertmanager exits on
• Hold the advertise address to the Go and the args Alertmanager starts with
• Read the advertise address as the kubelet passes it, judge its host only at Go 1.23
• Refuse an advertise host name at every alertmanager version
• Read an advertise port at 32 bits and scan the address once
• Say an empty clusterAdvertiseAddress host is not refused
• App.yaml takes the two admission webhook configuration kinds and apiservice
• Drop the webhook and apiservice handlers from builtinComponentHandlers for the rebase
• Register the webhook and apiservice handlers in pkg/oam/builtin/registry
• Hold the operator kinds’ pod checks in kind-neutral helpers
• Add the thanosruler kind component
• Judge a thanosruler portName on the container as the pods run the web port
• Say in the thanosruler portName schema how a patch’s ports change the container check
• App.yaml refuses a fluxcd-provider address that is its credential under a policy that forbids explicit secrets
• Add the prometheus kind component
• Hold the prometheus operator’s own defaults
• Merge prometheus and thanos-sidecar patches as the operator runs them
• Refuse the prometheus pods the API refuses, as on alertmanager
• Refuse a prometheus schedulerName or imagePullPolicy the pods’ defaulting replaces
• Refuse a prometheus externalUrl Prometheus exits on at startup
• Refuse the prometheus ports, volumes and serviceName the API refuses
• Refuse what the operator builds into a broken Prometheus
• Refuse prometheus sidecar mounts, log files and shard counts the operator breaks
• Refuse thanos sidecar mount fields the operator drops
• Refuse a prometheus secret or configMap whose volume name is cut after a -
• Hold the prometheus rule volume names, query log mount and pod metadata text to the operator
• Refuse a monitoring StatefulSet name its pods’ revision label cannot carry
• Say the prometheus kind holds nothing to version
• Say the prometheus kind’s claim template holds reserved keys
• Refuse an alertmanager enableFeatures Alertmanager exits on
• Refuse an alertmanager enableFeatures of one empty element
• Read an alertmanager enableFeatures as the kubelet passes it
• App.yaml HelmReleases under a Flux namespace keep their Helm storage with the release

Documentation

• Cite the gocache cost figure and narrow the PR-cache claim
• Separate PR and merge-queue cache scope in the caching guide
• Add delivery-scope design sub-report
• Record the release-name default and image-check recommendation
• Replace provisional ticket IDs with the filed issues
• Correct five current-behaviour claims in delivery-scope
• Align delivery-scope with the filed tickets
• Drop leftover Flux delivery wording
• Drop the removed readiness check from the paused description
• Say the forwarded delivery traits are consumer-registered
• Keep bundle-only handlers in the terminal-type definition
• State every condition of a generated source
• Qualify where the postgresql members share a bundle
• Say what counts as a list inside an unregistered list
• Leave the design page out of the hook-group naming change
• State that hook-group child names carry no namespace
• Qualify the remaining hook-group uniqueness statements
• Say which authored names have a default
• Name the traits README by path, not by a relative link
• Add the kind inventory, held to the base library by test
• State the stamp on the helmtemplate config’s Namespace field
• State the decided handler asymmetries where they live
• Mark the delivery-field and ordering sections as shipped
• Say when the post-renderer parts a chart’s selector from its pods
• Move the ownership note to the ConfigWrapper row
• Bring the delivery-scope page up to what main holds
• State that an existing Job cannot take the component label
• State the suspended-Job exception as the cluster applies it
• Leave the feature-gate fallback out of the Job exception
• State what template delivery does with an undeclared field
• State the release name default as shipped on the delivery-scope page
• Name the pinned kure commit and what it means for lists
• Name the oci rule and the fluxcd-kustomization kind
• Withdraw the tier placement of the oci rule’s sources
• List fluxcd-kustomization with the Flux kinds
• State the naming hook as shipped on the delivery-scope page
• Say where kure maps a delivery intent and where it refuses one
• Say what ClusterScoped does and does not replace
• Drop a comparison the transform does not bear out
• State the passthrough scope precedence in the summaries
• State the forwarded-trait rule and close the asymmetries ticket
• State the scaling kinds’ value checks as they are
• Say object metadata on kind components is decided, not shipped
• Say what the endpointslice row is held for
• State where hook-group names that meet are refused
• The cert-manager kinds take labels and annotations
• Say where a Job’s annotations come from and what ApplyTo checks
• Say the policy is not applied again after a post-policy step
• Say which bundle’s settings a component’s Kustomization takes
• Say when a lowered name collision carries a namespace
• State the rule the endpoint entries hold to and its three limits
• State the fourth thing an endpoint entry does not see
• Name the cnpg-pooler endpoint’s selector by the Pooler’s object
• Say what names the object the CNPG endpoint selectors carry
• Name the entry a reference points at
• Put the per-type highlights in the order of their types
• Put the tables of component types in the order of their types
• Put the shipped kinds of the delivery scope in the order of their types
• Point at the kind inventory instead of naming every kind
• List the kind components of the build reference in a table
• Say where the lines of a new kind component go
• Leave the per-type highlights in the order they were written
• A long component name shortens the whole layout Kustomization name
• State what a hand-parsed kind does with an upstream field it does not read
• Describe the label-reach test and which name a labels refusal holds
• List ReservedKeyInPodMetadata among the new exported API
• Say that a policy-free kind may list its defaulted zeros
• Word the defaulted-zero claims to what their tests hold
• Name the component types again in the OAM README
• Name the exactly-one rules the published schema cannot express
• Say a trait’s Flux namespace input is claimed where it lands
• Name a kind’s own validation and the empty list in the required-written pin
• Name the kure commit and gateway-api v1.6.3 that go.mod pins
• Say what a bundle’s settings reach under the kure pin
• Qualify patch placement and the two new kure refusals
• Limit patch placement to plain patches before any other entry
• List the four patch placements by entry kind
• Say which per-layout Kustomizations a bundle patch reaches
• Count the 263 required store paths External Secrets 2.12 generates
• Correct the ComponentLabelKey GoDoc for go-kure/launcher#790
• State that a chart’s own-layout Kustomization name is shortened by launcher’s rule, not kure’s
• State that helmtemplate’s own-layout Kustomization name is shortened by launcher’s rule
• Settle go-kure/launcher#787’s open point in the delivery scope and scope kure’s rule
• State the chart layout shortening as the pinned state, not a lasting rule
• State when the object kind policy refuses the rbac trait
• A listed allowlist that leaves out either rbac kind refuses the trait
• Name the CloudNativePG ephemeral volume claim template the checks leave unread
• Say a hookGroupNamePrefix names the Kustomization, the default does not
• Count the Naming hook’s prefix out of the hook-group default
• Point from the registry’s maps to the list of kind components
• ExplicitSecretPolicy names a fluxcd-provider credential address among its sources

Fixed

• Check a generated name’s characters before shortening it
• Keep a generated source out of an inherited order
• Exempt from an inherited order only the source that is hoisted
• Hold template-delivered charts to the environment policy
• Close three gaps in the rendered-workload checks
• Name the authored component for a forwarded trait with no handler
• Name the authored component for a trait a document rule moved
• Name helmtemplate hook-group layouts after their application
• Hold a passthrough object to environment policy
• Report a passthrough refusal at generation as a policy violation
• Refuse an authored trait name no object can carry
• Refuse an authored empty trait name
• Hold the objects of a manifests source to environment policy
• Give namespaced template-delivery objects the application namespace
• Keep a labelled workload admissible and state the label’s limits
• Refuse a non-string pod label whether or not the key is there
• Read an unstructured object’s labels as written
• Label the members of an unstructured list envelope
• Label the pods of a ReplicaSet and a ReplicationController
• Write the component label into a label map of its own
• Label a bare Pod a Flux-installed chart renders
• Label the pod template of a standalone PodTemplate
• Read a nil map on an unstructured object as absent
• Keep the core-kind label patches to the core API group
• Select a synthesized policy’s pods by the authored component
• Refuse or keep a field the Go type does not declare
• Name a remedy both Helm terminals have in the no-release-name error
• Follow the decoder’s field selection in UnknownJSONFieldPath
• Declare the contract of the oci rule and the fluxcd-kustomization kind
• Keep the path of an unknown fluxcd-kustomization key that contains a dot
• Ask the naming hook before refusing a name, and tell every applied trait apart
• Tell apart every owner of a resolved name, and compare a hook-named sub-application by name
• Keep a hook answer that is the default as the hook’s, and tell a rule’s trait from an authored one
• Say of a trait’s equal-named sub-applications only what holds for all of them
• Name the lowered document in a naming hook request
• Warn conditionally about a volume under the force-replace intent alone
• Refuse a name two lowering rules resolve, and hold raw documents apart by namespace
• Keep a lowering rule’s name claim apart from a later owner’s
• Claim a lowering rule’s cluster-scoped name with no namespace
• Hold a document without a namespace as one of default under LowerRaws
• ObjectName applies to what a document rule returns
• Leave a handler’s own objectName alone, and read a null as none on a member
• Resolve no object name where no endpoints are read, and name both its sources
• Take objectName out before a handler fills capability defaults
• Hold a CronJob’s name to 52 characters and a Job’s to 63
• Hold an Indexed job’s name to one its pods can be named after
• Hold an Indexed job’s name to its first index where completions is unset
• Require controller on the ingressclass kind
• Refuse one owner’s Flux-scoped and plain claims of one object
• Read inheritedMetadata of a typed Cluster that states no kind
• Read platform annotations a capability gives in a typed map
• Find the platform’s annotations under a config wrapper
• End the walk for platform annotations on any wrapper chain
• Read a null entry of a trait’s string map as absent
• Make a policy refusal in a post-policy step a violation
• A refused ObjectMetadata.ApplyTo leaves the object as it was
• Hold the annotations ApplyTo merges to the size limit
• Read labels and annotations a component built in Go holds
• One root-node shape for a flat and an ordered application
• Name a policy once in its refusal
• Keep the parser’s two readings of a list apart
• Check only what the augmenter added to a layout
• Compare the objects a List holds wherever generated objects are keyed
• Leave a hook-group prefix that names nothing unmeasured
• Measure a chart layout’s Kustomization name with its application’s name
• Refuse two spellings of a Flux verification’s provider
• Claim a trait’s Flux namespace input where it lands
• Tell a trait’s owner its Flux namespace before a claim asks what it reads
• Refuse managedTLS on expose and read it from any string-keyed map
• Hold a Flux object’s commonMetadata to the reserved keys and the component label
• Hold an ArtifactGenerator’s commonMetadata to the reserved keys alone
• Hold a ResourceSet’s and a FluxInstance’s commonMetadata
• Refuse two applications of one name in one bundle
• Refuse a workload whose selector rules the component label out
• Select a renamed entry’s pods under the component label key app
• Refuse a malformed exclusive group before checking its keys
• Refuse a kind of unknown scope whatever namespace it states
• Hold a list by its members and re-read what an augmenter edits
• Hold a typed list’s members and an added configMapGenerator to the object kind policy
• Read a list as it is written for the object kind policy
• Read nested and mixed lists as written for the object kind policy
• Drop a null List for the object kind check alone
• Hold one generation for the object kind recheck and document the policy for traits
• Leave default Kustomization names to kure

Testing

• Qualify the suffix-preservation comment
• Let a trait row’s constructor be called from the components package
• Hold the kind inventory’s API versions to the base library
• Hold the kind inventory’s Type column to the handlers
• Pin that generation rechecks an inline manifests source
• Hold labels, scale target and selectors to the component beside a name override
• Compare whole selectors, the scale target and the namespace beside a name override
• Add the component label to the core-kind goldens
• Name the returned type when the ownership wrapper is not one
• Pin what passthrough does with a full strict record
• Make the passthrough full-record test reach its case
• Say what the refuse-set test probes by hand
• Rework the Helm goldens and release-name docs for the rebase onto main
• Hold the pod kind to the app-label invariant
• Register the scheme in the list mismatch test
• The secret trait’s sub-application takes the delivery intent
• Hold the cluster-scoped kinds’ copy and input checks tighter
• Compare the whole input in the cluster-scoped kinds’ input check
• Hold the two object metadata cases the comments name
• Count the objects before reading the first
• Count the hook’s requests for the HelmRelease
• Select the workload roles without a switch
• Count the object name properties of webservice and worker
• Say what the cert-manager required-list test derives
• Hold the name-collision text to the claim key’s
• Show a required field in another spelling is not refused
• Hold checked CRD rules to the API server’s validator
• Show the postgresql values a block that is not built drops
• Show a postgresql pooler’s instances of 0 or less is left out
• Drop a document’s status in the CRD create harness
• Hold the endpointslice, RBAC and six Cilium kinds in the table of API sets
• Hold the marker guards on the markers themselves
• Classify the counts over named fields of the external-secrets API
• Put typed objects to the rendered-object check itself
• Show endpoints answered for a document the build refuses
• Read the registries for the endpoint guard, show refusals past the parse
• Hold the VolSync CRDs to no default on list elements and map values
• Read the whole rsync mover package for the capabilities it adds
• Hold the rsync mover’s source to a digest
• Say which builders take the privileged-movers answer
• Hold the per-kind test tables in the order of their types
• Hold coreKindSchemas and apiSetKinds complete
• Hold the tables of component types in the docs in order
• Put the comment of the RBAC kinds back over them
• Read a kind list from the function’s own body
• Account for every line with a bar in a kind table’s section
• Hold the nine hand-parsed kinds to every field of their upstream type
• Report a label-reach entry whose type is gone instead of panicking
• Hold the Flux rows of the policy-free kinds to the four kinds
• Put the comment of the Kustomization fixture back over it
• Say that the Flux kinds set no defaulted-zero list
• Give the Flux source kinds their own reason for having no API-set row
• Say which kinds set no defaulted-zero list
• List the ArtifactGenerator’s commonMetadata among what is not read
• Show the postgresql rule writes what its members’ schemas require
• Count a null as absent and guard only a full run in the postgresql members test
• Name every nil kind the postgresql members test reads as null
• Rename the routing objects through the naming hook
• Run statefulset raw affinity through the selector matrix
• Claim a Flux namespace input where it lands
• Refuse a FluxInput spec outside a trait’s Secret or ConfigMap
• Pin the required fields a CRD-backed kind writes unauthored and does not refuse
• Measure the Flux kinds in the required-written pin
• Match a refused omission to the field’s full path
• Measure the MetalLB kinds in the required-written pin
• Measure the four new Flux kinds in the required-written pin
• Hold the required-written pin’s kinds to the kind inventory
• Count only omitempty lists as losing an authored empty list
• Hold the secret kind to every field of its upstream type
• Hold every ownProperties kind to a parity row
• Count the route kinds’ omitted paths in the Gateway defaulted-zero test
• Hold the cnpg kinds’ checked rules to the API server’s validator
• Measure the cnpg kinds in the required-written pin
• The defaulting drift test fails on code it cannot follow
• State what the defaulting drift test does not detect
• The drift test fails on a dereferenced copy, a break and a guard initialiser
• The drift test fails on a call in a case or on the object
• The drift test looks through parentheses around a callee
• The drift test walks only the shapes the excerpt uses
• The closed walk checks types, shadowing and receivers
• The closed walk scopes its names to their block
• Hold each alertmanager policy proof to its own field
• Measure the alertmanager kind in the required-written pin
• List the alertmanager image fields right after the pod spec’s
• Give the alertmanager’s claim template row its own reason
• Keep strictlyDecodedTypes and componentLabelFixtures row-local
• Restore the aligned layout of the two shared kind tables
• Re-apply the row-local layout of the two shared kind tables
• Hold the per-kind test tables in the order of their type
• Say why a leading digit in a monitoring serviceName is refused
• Vendor the Prometheus operator’s Alertmanager gates at v0.94.1
• Hold the alertmanager gate source to every comparing file
• Scan every reading shape and fail on a broken scan
• Vendor and walk the whole alertmanager package
• Catch parenthesized and method-value version comparisons
• Hold the gate fixtures’ leftover check under a -run filter
• Cover what the app.yaml apiservice and webhook kinds leave to the API server, and a wrong objectName
• Drop the webhook and apiservice rows from the two shared kind tables for the rebase
• Restore the webhook and apiservice rows in the two shared kind tables
• Measure the prometheus kind in the required-written pin
• Pin the refusal of one empty alertmanager enableFeatures below 0.27.0

[0.2.0-beta.0] - 2026-10-03

Added

• Add NameAllocator emit-or-adopt for elements shared across siblings
• Add a strict JSON decode for external API types, with a field-reachability check
• Add CheckCrossDocumentCollisions for multi-document callers
• Export CheckEnumMembersHoldNoNull for static Enum null checks
• Recognise traits a component rule forwards by value
• Lower worker to deployment via a component lowering rule
• Release through the shared Release workflow
• Promote dependency, placement, reconciliation and health-checks to builtins
• Publish policy schemas through HandlerSchemas
• Return raw lowering steps on the success path
• Generate Flux delivery objects with –oci-repository
• Accept a Flux source timeout of an hour or more, emitted in minutes
• Let a component lowering rule emit a same-name sibling group
• Warn on an authored component or trait whose type is deprecated
• Read a component’s endpoints from the lowering rule claiming its type
• Generate a sibling group’s primary objects first
• Apply a sibling group’s traits in authored order
• Lower webservice into a deployment and service pair
• Let a lowering rule record a rendered PlatformReserved value
• Add serviceaccount, persistentvolumeclaim and configmap kind components
• Warn when a PersistentVolume or claim is force-applied
• Replace engine-only traits with a post-policy step on lowering rules
• Check issue references in commit messages too
• Build the pvc trait through the persistentvolumeclaim kind’s claim path
• Give the persistentvolumeclaim component the pvc capability’s storageClassName default
• Build the configmap trait through the configmap kind’s path
• Give webservice and worker pvc volumes the pvc capability’s storageClassName
• Give statefulset claim templates the pvc capability’s storageClassName

Build

• Update dependency hugo to v0.167.0
• Update dependency yq to v4.54.1
• Bump kure to v0.2.0-beta.14
• Keep fluxcd/pkg/apis/meta out of Renovate proposals now it is a shared direct dep
• Exclude helm.sh/helm/v4, now a direct dep shared with kure
• Update dependency flux2 to v2.9.6
• Update dependency syft to v1.53.0
• Revert syft to v1.52.0
• Keep the unpublished syft v1.53.0 from being proposed again
• Update dependency flux-schema-plugin to v0.15.0
• Update dependency syft to v1.54.0
• Drop helm from the shared-direct mirror
• Bump kure to v0.2.0-beta.15

CI

• Add the Release / State dispatch workflow

Document Format

• Close the typed-nil holes in the cilium and auto-synthesis netpol parsers
• Reject cilium-networkpolicy documents without rules or endpointSelector
• Add the kind-named service component
• Refuse a service component name that is not a valid Service name
• Admit the scaler trait on deployment
• Add the topology-spread trait for any Deployment
• Check the topology-spread selector at every replica count
• Accept the engine-owned scope on a topology-spread trait
• Refuse a topology-spread capability rendering at profile evaluation
• List the topology-spread trait in the kurel-package trait table
• Default podFailurePolicy onPodConditions status to True
• Say onPodConditions status defaults when absent or null
• Reject networkpolicy peers the API server refuses
• Read every Go integer kind in the property readers, refuse what does not fit
• Refuse a wrapped maxSize and out-of-range ports; report overflow as a range error
• Reject postgresql documents with wrongly typed optional properties
• Read typed-nil postgresql scalars as omitted
• Close the remaining typed-nil holes in pkg/oam parsers
• Give typed nils the untyped answer in the remaining trait parsers
• Refuse typed-nil list entries with the untyped message in the remaining readers
• Add opt-in force-replace trait for immutable-field updates
• Add a Types union to PropertySchema for int-or-string and quantity leaves
• Type the service kind’s targetPort as the integer/string union
• Support raw block volumes (volumeMode: Block)
• Refuse volume names a raw block device already uses
• Refuse claim-template name and mountPath collisions on statefulset
• Validate Service names as DNS-1035 labels in webservice, daemonset and statefulset
• Refuse an empty postgresql version
• Add opt-in wait and healthChecks to the oci component’s Kustomization
• Correct the oci healthChecks apiVersion and opt-in wording
• Forward every resource name onto the postgresql Cluster
• Refuse hugepages without cpu or memory on postgresql and podResources
• Add the kind-named helmrelease component
• Omit the helmrelease values ConfigMap app label past 63 characters
• Skip the auto health check for a suspended helmrelease
• Refuse worker documents whose affinity topologyKey or nodeSelector is not valid label syntax
• Project component names over 63 characters onto a valid app label value
• Project the helmrelease values ConfigMap app label past 63 characters
• Add the kind-named helmtemplate component
• Add the kind-named Flux source components
• Check the registry and bucket host Flux actually contacts
• Refuse an Amazon S3 bucket endpoint under a registry allowlist
• Refuse an oci or helmchart interval that truncates to zero or bypasses the handler
• Refuse an invalid Flux interval on helmrelease and the source components, and a wrongly typed helmchart property
• Refuse a truncating Flux interval Go code sets with a named string type
• Refuse a wrongly typed helmchart valuesMode
• Refuse a wrongly typed helmchart source or source field
• Accept a reserved component value a schema-declaring rule writes, reject one a document rule would drop
• Reject a reserved value a schema-less trait rule copies out of a sealed trait
• Reject a reserved value a schema-declaring trait rule copies out of a sealed trait
• Keep every component a document lowering rule emits authored
• State the inherited and forwarded cases in the createApplications exemption comment
• Name the unsealed-trait condition in the createApplications exemption comment
• Accept array and object kurel parameters, substituted as a whole YAML node
• Keep the anchor on a substituted node and refuse an array or object parameter in a string default
• Refuse a typed-nil structured value and stop blaming –set for every string
• Add the EnvironmentSet document (environments.yaml) and kurel build –environment
• Require Application and raw-document namespaces to be DNS-1123 labels
• Refuse reconciliation policy durations Flux rejects once emitted
• Install a native helmchart release built under a Flux namespace into the application namespace
• Refuse a reserved component property a lowering rule emits as null
• Check a rule’s whole emission for reserved keys before validating any of it
• Check authored components for reserved keys at the start of every lowering round
• A multi-tier Application’s tier umbrella Kustomization no longer sets wait
• Add the cnpg-cluster component, a full CloudNativePG Cluster projection
• Describe the operator custom-resource component pattern
• Refuse app.yaml documents that set a platform-reserved trait property a lowering rule copies as null or drops
• Refuse postgresql and cnpg-cluster documents with non-positive storage sizes or replicas 0
• Refuse a platform-reserved property set inside an array item, or authored as a nested null
• Keep Transform’s exemptions and document naming in the authored reservation check
• Add the role-named helm component type to the v1alpha1 Application, lowered to the kind-named Flux terminals
• Add cnpg-pooler, cnpg-database and cnpg-objectstore kind components
• Refuse postgresql names CloudNativePG cannot give a Cluster
• Deprecate the helmchart component type in favour of helm
• Accept a ports list on the deployment component in app.yaml
• Refuse an empty deployment port protocol in app.yaml, as its schema does
• Point the postgresql WAL-archiver entry at the barman-cloud plugin and carry serverName there
• Refuse two applications of one document generating the same object
• State the real reason pod priority and overhead are refused
• Refuse a container port name repeated across the pod in app.yaml
• Refuse a postgresql managed role’s connectionLimit: 0
• Refuse a zero managed-role connectionLimit in postgresql Generate too
• Refuse an authored empty ensure on a cnpg-database schema, extension, fdw or server
• Copy the chart layer of a helmchart OCI source and stop sharing it with oci
• Lower postgresql onto the cnpg kind components, changing app.yaml output layout
• Forward postgresql’s traits to every member and order a pooler-named database after the Pooler in app.yaml
• Refuse repeated postgresql database names in app.yaml and bound its placement names
• Refuse a fileKeyRef whose volume is missing or not emptyDir
• Refuse webservice documents whose affinity topologyKey or nodeSelector is not valid label syntax
• Let a helm component in app.yaml reference a GitRepository or Bucket chart source
• Accept a ports list on the daemonset, statefulset, job and cronjob components in app.yaml
• Qualify the named-port refusal note for daemonset and statefulset
• Accept clusterIP None on the service component for a headless Service
• Let a helm component in app.yaml generate an inline GitRepository or Bucket chart source
• Make a helm component in app.yaml redeploy Git/Bucket charts and refuse inline ssh sources
• Refuse a user or token in an inline helm GitRepository URL in app.yaml
• Refuse credentials in an inline helm Bucket endpoint and an unknown provider in app.yaml
• Accept only a plain host and path in an inline helm Git URL or Bucket endpoint in app.yaml
• Refuse an http:// inline helm Bucket endpoint in app.yaml
• Daemonset and statefulset emit no Service and refuse port
• Remove the helmchart component
• Add the helmchart Flux HelmChart source terminal
• Prune-protection and force-replace in app.yaml reach a component’s trait sub-applications
• Refuse an out-of-range port in an inline helm Git URL or Bucket endpoint in app.yaml
• Refuse a user or password in an inline helm chart source url
• Drop the ServiceAccount and claims the pod kinds generate
• Emit helm values ConfigMap through a configmap trait
• Accept a typed valuesFrom list under helm valuesMode: configMap
• Strict-decode a typed valuesFrom list before normalizing it
• Refuse a helmrelease valuesFrom kind Flux does not admit
• Hold helmrelease valuesFrom name, valuesKey and targetPath to the CRD

Documentation

• Record the real cost of the labeled/unlabeled PR trigger
• Strip-ack starts no run, and only docs-skip reads the payload
• Document the optional-field-wrapper guard
• Correct the scaler, statefulset-claim and token-trigger wording
• Scope the peer-shape null wording to the three peer fields
• Record the two-axis type model and the type naming rule in design-gvk
• Classify worker by role, not kind count; name policies as lowering output
• Tighten the two-axis wording against the engine’s behavior
• State the adoption exception wherever collisions are called fatal
• Correct the allocator’s collision key and location in D2
• Constrain emit-or-adopt to terminal shared elements
• Say launcher does not add the force annotation without the trait
• List the force-replace trait in the kurel package guide’s trait catalogue
• Name ValidateAuthoredProperties as the raw-rule trait check
• Replace drifted line citations and correct stale claims
• Correct the remaining stale claims the review found
• Keep built-in terminal types admissible in the D4 settled-pass note
• Describe the traits README as a key-property catalog
• State the daemonset Service-name rule as port > 0
• Bound the surviving null and helper-routing universals
• Bound the nested-null, typed-nil and resource-list claims
• Correct the typed-nil, raw-read and empty-string routing claims
• Stop naming one diagnostic for a null on a raw read
• Qualify the raw-lookup null and resource-quantity null claims
• Exclude the always-written cronjob fields from the presence-gated claim
• Record the helmrelease health-check and build behaviour
• Narrow the oci explicit-registry claims to what the parser does
• State why forwardableTraits marks a copy
• Name DeploymentConfig, not the removed WorkerConfig, as a policy implementer
• Scope the app-label compatibility claim and name worker’s label path
• Scope the component label uniqueness claim to validated Applications
• Say which helmtemplate errors carry the component-type prefix
• A wrongly typed value is an error on a direct Transform call too
• Re-vendor the release guide at go-kure/.github 27e9923
• Document the Deploy Docs slot restriction
• A forwarded component keeps the classification it arrived with
• Point the EnvironmentSet reference in design-gvk at pkg.go.dev
• Link the EnvironmentSet reference to the README on GitHub
• List environments.yaml in the format-scope checklists
• Name artifact directories by bundle, including dependency-policy splits
• Accept a zero duration in the delivery refusal paragraph
• Scope the cnpg-cluster lowering-value claim to what the schema checks
• Qualify bare issue and PR references as go-kure/launcher#N
• Reword two downstream tracker references in the external-secret data shorthand design
• Describe bundle ordering and shared-source ownership in the package README
• State the deployed-first source owner in the SourceDeduplicatable contract
• Update the oci source-owner comment and scope helmchart sharing to native delivery
• Document why oci’s targetNamespace has no default
• Name objects still namespace-less after the artifact’s kustomize build
• Say the deploy step follows the pages checkout, not that it alone can read the token
• Qualify issue references in Go comments, tests and scripts
• Record that postgresql carries serverName on the plugin entry
• Describe the sibling-group hooks on deployment and service
• Make identity ports the condition for the sibling selector switch
• Name DeploymentConfig, not the removed WebserviceConfig, as a policy implementer
• State when the docs deploy refuses to write the root
• Say the slot still deploys when the label no longer ranks highest
• Give the missing-tag deploy failure its own remedy
• Dispatch the deploy retry from the tag it names
• Give the deploy retry every input it needs
• Retry the root write with the highest existing stable tag
• Apply the document-format lifecycle from the first stable release
• State the GA baseline and the pre-GA disclosure rule consistently
• Migration pod replacement and probe port names
• The pod replacement step under a rollingUpdate partition
• Repoint the remaining statefulset Service references
• Repoint the probe-port and port-less daemonset references
• Vendor the shared workflows guide
• Reword the helm rule references to the removed helmchart
• Record helmchart as removed and reused by the HelmChart CR
• A moved external-secret’s namespaced SecretStore must exist in the Flux namespace
• Link the force warning’s attribution limit to its follow-up
• Say the helm values configmap trait is built through the configmap kind

Fixed

• Save Go caches from main only
• Save the docs-build Hugo modules cache from main only
• Keep setup-go’s cache in deploy-docs
• Bring check-pin-impact.sh level with kure’s gate and pin it with hermetic cases
• Hold a service component’s named implicit backend to its first port
• Compare pin impact against the base the PR merges onto
• Scope adoption to one document, digest identities in errors
• Stop sharing label selectors and inherited-metadata maps with generated objects
• Add IntegerInRange and read uintptr as an integer kind
• Report overflow in scaler, certificate and volsync as a range error
• Stop UnreachableJSONFields at a repeated embedded type
• Match owned keys case-insensitively, keep exact numbers, and let encoding/json decide reachability
• Report keys behind unexported embedded pointers, honour encoding/json’s tag-name fallback, and document the per-key contract
• Accept a union value any member validates, and read uintptr as a number
• Run LowerRaws for round 0 only and seal nothing
• Scope LowerRaws error chains to the failing document
• Skip typed-nil objects and report each collision once
• Report fields hidden behind another field in UnreachableJSONFields
• Report rather than panic when the UnreachableJSONFields probe cannot marshal
• Treat a self-decoding root as unprovable in UnreachableJSONFields
• Treat a jsonv2 self-coding root as unprovable in UnreachableJSONFields
• Prepend each release’s changelog section, never regenerate
• Restore published CHANGELOG sections to their release-time text
• Keep a hook-group helmchart layout a directory under an AppFileSingle writer default
• Check an ingress implicit backend’s portName against every kind’s Service port
• Require an explicit registry in oci source urls under an allowlist
• Keep a forwarded trait’s authored Origin.Index behind a rule’s own trait
• Reject components whose projected app label values collide
• Convert rendered chart values to JSON types at decode
• Keep refusing rendered timestamps RFC 3339 cannot express
• Drop an unemittable document that hook grouping drops, instead of failing
• Refuse a rendered document with a non-string top-level key
• Check authored policy properties against their handler’s schema
• Reject a non-string health-check namespace and keep a rejected dependency policy’s edges out
• Refuse a conflicting second placement and durations Flux would reject
• Reject a reconciliation property of the wrong type instead of skipping it
• Read a typed or untyped null as absent in reconciliation and health-check namespace
• Reject an empty dependency rules or dependsOn list
• Drop a dropped-hook document whose metadata has a non-string key
• Keep the raw step on a re-serialization error
• Read an explicit null on the remaining optional properties as omission
• Pin each null test’s wrong-type check to its own refusal
• Keep the key check and empty-selector refusal ahead of a null entry
• Check a hugepage resource name before skipping its null entry
• Refuse interval values Flux rejects in oci and helmchart
• Re-check the docs root at write time via the shared deploy action
• Exempt rule-synthesized components from authored reservation checks
• Pass the release namespace and name to template renders
• Reject trailing documents and empty environment flags
• Reject EnvironmentSet paths that leave the file’s directory
• Resolve symlinks before accepting EnvironmentSet paths
• Make the EnvironmentSet base directory absolute before resolving links
• Check a sealed trait for platform-reserved values unless a checked rule emitted it
• Check every Flux duration field in the form its CRD takes
• Write delivery output for an empty build and validate the OCI flags
• Refuse an –oci-repository registry without a hostname
• Refuse delivery objects that collide with an artifact’s objects
• Check list members for delivery-object collisions
• Refuse an identity shared by two artifacts and an overlong delivery name
• Give collision ownership only to objects Flux applies
• Refuse an artifact kustomize would refuse for a duplicate resource
• Refuse a generated Flux duration outside Flux’s pattern
• Compare a cluster-scoped object without its namespace in the collision check
• Generate each application once in a delivery build
• Refuse a unit name past 253 characters and a registry port outside 1-65535
• Close cnpg-cluster null, authorship and registry gaps
• Read cnpg-cluster properties through their JSON serialization
• Refuse cnpg-cluster values the typed spec would omit
• Refuse only cnpg-cluster zeros the operator would replace
• Refuse cnpg-cluster instances below the CRD minimum of 1
• Refuse cnpg-cluster names and null misspellings CloudNativePG cannot carry
• Repeat the cnpg-cluster name and instances refusals in Generate
• Refuse a cnpg-cluster storage-size policy default that is not a quantity
• Refuse a non-positive cnpg-cluster storage-size policy default
• Refuse a cnpg-cluster resource request above its limit
• Refuse a negative policy cpu/memory default
• Pass deploy-docs dispatch inputs through env and validate them
• Refuse set_latest=true with a dev label before the deploy-docs build
• Emit a shared source from the component deployed first
• Order the tier bundles of a multi-tier application
• Stop persisting the job token in the deploy-docs launcher checkout
• Close three sibling-group gaps
• Refuse a sibling-group member object with no kind
• Name a sibling group’s component and refuse duplicate member trait sub-applications
• Let a placement policy settle a sibling group’s mixed tiers
• Copy a generated OCI chart layer as-is and pin the helm release namespaces in the build test
• Refuse a placement that moves a generated source out of infra, and drop a size hint CodeQL flags
• Refuse a dependency that delays a generated source, and two spellings of one helm key
• Emit admissible cnpg-pooler templates and refuse ObjectStore serverName
• Check cnpg-pooler and cnpg-objectstore resources and cap pooler ephemeral claims
• Refuse cnpg-pooler template ephemeral containers
• Refuse the rest of the pod fields a cnpg-pooler Deployment cannot carry
• Refuse mixed go-kure/.github pins in the merge queue
• Generate a bundle as kure does and tell a same-named trait apart
• Allowlist the GO-2026-6596 false positive on cilium v1.20.2
• Extend postgresql’s placement and dependency policies to every member
• Close three issue-ref guard gaps found in review
• Pass qualified repository names ending in launcher
• Reject ownerless references to any repository
• Ignore URLs, format verbs and nested link targets precisely
• Stop URL stripping at a single quote
• Handle shell trims, indexed verbs and quoted call arguments
• Recognise a document rule’s by-value copy of an authored trait as forwarded
• Keep forwarding marks until a rule’s output is classified, and detach empty slices
• Keep the authored index on a trait a document rule forwards by value
• Stamp a document-forwarded trait with the component it was authored on
• Keep a sibling group’s own pods under its component-label policy
• Keep a sibling group’s routed ports translated on its own pods
• Ignore array trims and starred verbs, catch emphasised refs
• Bound the emphasised-ref pattern like the ownerless one
• Keep scanning array subscripts that hold a #
• Compare a rendered reserved value exactly and refuse a nil intermediate map
• Compare a rendered reserved value by the schema validation applies
• Write a detached copy of a rendered reserved value
• Tell signed zeros apart in a rendered reserved value and correct the schema-less rule docs
• Keep a port-less headless service an owned Service with no routable port
• Count capabilities a lowering rule reads in ConsumedCapabilities
• Keep a manifest source url’s credential out of its errors
• Drop a failed fetch’s cause text and an opaque url from its error
• Name a manifest fetch or read failure by fixed text only
• Name a manifest fetch url by scheme and host only
• Keep a source url’s credential out of every refusal
• Drop an IPv6 zone that holds a bracket from a shown host
• Show a refused url’s host only when it is plainly a host
• Show no host when the userinfo’s @ may sit in IPv6 brackets
• Name no url scheme, and show an ssh host from its raw authority
• Refuse a configmap component over the 1 MiB API size limit
• Trait decorators keep layout intent; traits keep a custom bundle order
• A trait handler that removes an application no longer panics the transform
• Find a trait’s new sub-applications by pointer, not by the bundle’s tail
• Refuse a configmap trait ConfigMap over the 1 MiB API limit
• A sub-application decorator may not change the bundle at all, not just its length
• Match Flux’s force selector and list expansion in the volume warning
• Refuse a configmap trait data key the API server refuses
• Attach a component’s health check to its own application only
• Refuse a sibling group with two pod-running members
• Refuse a trait that replaces or removes a component’s application
• Refuse a trait that renames a component’s application
• Refuse a decorator that renames an application
• Move trait objects a moved Flux object reads into the Flux namespace
• Follow a chart verification Secret when sourceRef names the Flux namespace
• Scope a sibling member’s trait inputs to that member
• Move a certificate trait a moved Flux source reads into the Flux namespace
• Read a typed nil as null at both capability merge sites
• Refuse an uncopyable capability default instead of sharing it
• Read force-applied volumes after the bundle’s patches
• Trace each patched volume to the application that generated it
• Trace patched volumes by an origin tag, not by position
• Tag only the resources kustomize holds, trace envelope members through their envelope
• Build bundle patches untagged, so the force verdict is Flux’s
• Fail a patched build whose result does not serialize, as Flux does
• Read the patched objects from the build’s YAML, as Flux reads them
• Read the patched build with a mirror of Flux’s ReadObjects
• Refuse a trait sub-application’s policy that renames a component’s application
• Refuse a trait or its policy renaming a sibling group member’s application
• Keep a capability rendering’s Go types on both merge sites
• Report the same refused rendering value on every run
• Name a patched force-applied volume by the object it comes from
• Scope the attribution fallback docs, document copy-then-delete
• Read a group sub-application’s name after its policy in the duplicate check
• Refuse a sibling-member rename during the decoration pass
• Name producers that read alike by count in the collision error
• Check a component capability default against the component’s schema
• Merge a capability rendering into nested authored objects
• Check nested Required after the capability rendering is merged
• Refuse a schemaless capability default no trait side validates

Performance

• Take entry names only for an entry with traits

Testing

• Fail on any re-added optional field wrapper
• Cover the wrapper-guard dir scan, a later non-RWX claim and the scaler HPA
• Skip nil generated objects in the topology-spread test helpers
• Pin onPodConditions status null default and explicit values
• Cover later-round adoption and NameOrAdopt refusals
• Pin same-origin conflicting identity as a hard error
• Drop an unnecessary PortNumber conversion flagged by unconvert
• Pin the integer readers without validation in front, and the aliasing fix’s content
• Pin the NetworkPolicy selector copy for match expressions
• Pin postgresql empty enums, pooler envelope in Endpoints, custom query paths
• Pin postgresql empty storageSize and null bootstrap siblings
• Adapt per-document adoption test to round-0 LowerRaws
• Pin worker’s scheduling opinions in a golden fixture
• Re-pin worker-scheduling against the release-1 container shape
• Evaluate whole component selectors in the label invariant
• Validate every component selector and count app labels apart from selectors
• Identify synthesized network policies by name in the label invariant
• Count component lowering rules in the label invariant registry coverage
• Pin the multi-event hook Job acceptance for both helm renders
• Cover the helmtemplate component in the label invariant
• Cover the Flux source components in the label invariant
• Name the url-scheme refusal in the null test comment
• Drop a document-rule fixture that mutated the document it was handed
• Run the dependency delivery fixture through the real policy handler
• Expect the reconciliation policy to refuse a sub-millisecond duration first
• Mark the cnpg-cluster schema-shape switch exhaustive
• Cover cnpg-cluster in the component label invariant
• Pin cnpg-cluster in the tier and health-check registries
• Assert the placement tier edge and refresh the dedup phase reference
• Expect the hierarchical delivery tier Kustomizations to depend on the tier before
• Scope the cnpg-cluster storage-size test comment and cover a walStorage template
• Pin the postgresql endpoint label values at the longest admitted name
• Refuse an in-document collision in a document lowered from a raw one
• Capture postgresql’s published property schema before it becomes a lowering rule
• Pin webservice output for a trait mix and an ingress portName
• Drop a redundant plain-Transform check from the rule-read capability test
• Freeze the helmchart side of the helm parity oracle
• Pin the dot at the values ConfigMap truncation boundary
• Reach the external-backend selector conflicts without the reserved key
• Assert each default-tier row is an explicit map entry
• Pin the force warning for the new claim sources
• Attribute a role claim’s force warning to its sub-application
• Pin the post-policy step copy and policy-refusal contracts
• Require each owner decorator’s annotation on the pvc trait’s claim
• Pin that the force warning’s origin tag reaches no output
• Give two test identifiers generic names

[0.1.0-alpha.23] - 2026-09-25

Added

• Export NewNameAllocator for out-of-package rule drivers
• Add verify-merge to rebuild a PR’s merge ref locally

Build

• Update dependency git-cliff to v2.14.2
• Update dependency golangci-lint to v2.14.0
• Update dependency flux-schema-plugin to v0.14.0

Document Format

• Allow pre-release bug fixes to change v1alpha1 output
• Derive networkpolicy policyTypes from key presence
• Retarget a trait-level serviceName’s netpol allow off the router
• Close init/sidecar container entries and wire their missing fields
• Require a positive PVC size for volumes and the pvc trait
• Reject non-integer and negative replicas on every replica-bearing kind
• Check engine-owned trait properties when a handler declares no schema
• Normalize integer kinds readers cannot assert, reject unsigned overflow
• Reject a nameless env entry instead of dropping it
• Reject a wrongly typed affinity sub-field by name
• Refuse a scaler maxReplicas above 1 beside a non-RWX claim
• Reject a non-string inheritedMetadata label or annotation value
• Reject a non-string postgresql, pooler or connection parameter
• Read a null string-map value as absent, not as a wrong type
• Check networkpolicy label and CIDR content at parse time
• Refuse a dotted component name on every workload kind

Fixed

• Drop the no-op pull_request trigger from the Claude workflow
• Fully qualify the cross-repo issue reference
• Align the local test budget with CI’s 5m
• Stop check-kure-dep-sync turning a full clone shallow
• Extend prune-protection to LayoutAugmenter-added resources
• Deep-copy every value buildPodSpec projects out of the config
• Write named scalar property types back as their plain Go type
• Report a wrongly typed required string as a type error
• Reject a wrongly typed resources property by name
• Reject wrongly typed optional scalars in the handler audit
• Word an out-of-int32-range integer apart from a wrong type
• Accept an Enum member whose null nothing strips
• Keep a value’s typed nil matching an empty Enum member
• Pin the kurel-package example image to a version tag
• State the 63-character label limit in the container-name refusal
• Build kure objects from generated constructors (kure v0.2.0-beta.13)
• Report a missing toolchain or module fetch as not computable

Testing

• Pin non-string rejection of string-typed authored properties
• Guard the statefulset and daemonset aliasing mutators against nil
• Pin rejection of a top-level items array on a non-List kind
• Pin a null nodeSelector value as absent in both affinity readers
• Gate the documentation’s YAML fences on their declared mode
• Accept spaced check markers and refuse unreadable ones
• Pin the strict CIDR reason for a leading-zero ipBlock
• Expand the case environment safely on bash < 4.4

[0.1.0-alpha.22] - 2026-09-18

Added

• Enforce environment policy on container securityContext.capabilities
• Validate generated manifests against flux-schema
• Surface per-app consumed capability keys on the transform result
• Partition template-delivery helmchart output by Helm hook group
• Detect the govulncheck env pin and keep golangci-lint pins in sync
• Gate go-kure/.github pin bumps on their real impact
• Shared pod-level builder with full corev1.PodSpec fidelity
• Project DaemonSetSpec fields onto the daemonset kind
• Add the job component with the full JobSpec surface
• Share the DeploymentSpec surface with webservice and worker
• Project podFailurePolicy onto job and cronjob
• Reject undeclared authored component and trait properties
• Re-vendor the forbidden-terms guard on pin bump
• Adopt kure builder-contract release-1 (go-kure/launcher#361)

Build

• Migrate to Renovate and make the version guard real
• Update toolchain
• Update module golang.org/x/mod to v0.40.0
• Update dependency goreleaser to v2.18.0
• Update module github.com/google/go-containerregistry to v0.22.0
• Update dependency syft to v1.51.1
• Update dependency golangci-lint to v2.13.2
• Update dependency flux2 to v2.9.5
• Update dependency go to v1.26.7
• Update dependency git-cliff to v2.14.1
• Update module google.golang.org/grpc to v1.83.1 [security]
• Update module golang.org/x/crypto to v0.56.0 [security]
• Update module github.com/google/go-containerregistry to v0.22.1
• Update dependency goreleaser to v2.18.1
• Bump Go to 1.26.8
• Update module golang.org/x/mod to v0.41.0
• Update module google.golang.org/grpc to v1.83.2 [security]
• Update dependency hugo to v0.166.0
• Update module golang.org/x/vuln to v1.8.0
• Update dependency flux-schema-plugin to v0.13.0
• Update dependency goreleaser to v2.18.2
• Update dependency syft to v1.52.0

CI

• Allow manual re-publish of an existing tag
• Guard dispatch ref and correct the re-run recovery guidance
• Refuse a dispatch over a live release, split the rerun rows
• Serialize the wrapper, bound the re-run rows, flag docs rollback
• Probe for an existing release on re-attempts, not just dispatches

Document Format

• Enforce policy and support securityContext on init/sidecar containers
• Externalize helmchart values via configMap valuesMode
• Preserve ConfigMap-name uniqueness under truncation; reclassify changelog
• Document configMap-mode reconciliation timing
• Drop hand-written CHANGELOG entry, clarify README
• Complete cronjob CronJobSpec/JobSpec projection
• Document cronjob’s CronJobSpec/JobSpec fields
• Validate pod-level names and gate privileged pod fields
• Pod-level cross-field rules for host namespaces, IPs and UIDs
• Stop declaring a string type on the rolling-update knobs
• Cite the strict-parsing contract behind the selector rejection
• Project the StatefulSetSpec fields onto the statefulset kind
• Project the full PersistentVolumeClaimSpec onto volumeClaimTemplates
• Infer the update-strategy type and close three claim-spec gaps
• Add the kind-named deployment component
• Publish raw affinity, tolerations and topologySpreadConstraints on deployment
• Complete the corev1.Toleration projection
• Pin the raw scheduling projection and state the daemonset break

Documentation

• Correct design.md overclaims and cross-repo issue refs
• Correct template-delivery release-identity wording
• Add AI agent gates (A1-A7) section
• Correct README claims superseded by the capability/divisor enforcement fix
• Fix inaccurate zero-divisor test comment
• Record pkg/patch disposition as a standalone post-generation library
• Address codex review on #308
• Mark package composition as deferred in the Helm comparison
• Drop the cross-package composability overstatement and the universal-typed claim
• Stop implying PropertySchemaProvider closes the typing gap; name lowering rules
• Add missing ContainerCapabilities field to policy struct example
• Add type-name covenant and document-format lifecycle
• Fix covenant/lifecycle accuracy issues from round-1 review
• Fix remaining accuracy and gate-A7 issues from round-2 review
• Fix CapabilityDefinition scope (trait-only, not component)
• Correct PATH-ordering troubleshooting note for pinned golangci-lint
• Clarify why –output’s path is exempt from the CLI Safety path-escape rule
• Correct README errors.As exception list
• Document helmchart valuesMode configMap externalization
• Document kurel build’s LayoutAugmenter rejection
• Document PolicyResult.ConsumedCapabilities (#290)
• Document LayoutAugmentationCoverage and hook-group partitioning
• Drop review-process provenance from durable comments
• Describe the sync-go-version.sh mechanism
• Explain strip-ack/rerun gotcha on pin-impact-ack
• Note the strip-ack rerun gotcha in the pin-impact-ack section
• Fix pin-impact-ack rerun gotcha wording (synchronize/reopened + fork scoping)
• Align the LowerRaws and loweringDoc comments with pair dispatch
• Document ServiceAccountNamer and the rbac trait’s binding subject
• State the config-name/application-name invariant
• Correct why each stricter daemonset rule is stricter
• Drop the cross-package README link the site link check rejects
• Reattach the parseDeploymentIntOrPercent doc comment
• Note that trait-level serviceName and netpol synthesis do not compose
• Correct the last two workload-kind counts, and guard them
• Say where null-as-omission stops, and pin the boundary
• Qualify the bare issue references in the nested-null test
• Stop claiming what the controller does with a paused deployment
• Record why the run-to-completion kinds carry no auto health check
• Finish the six-to-seven count migration and widen its guard
• Correct the job force-replace workaround, which did not work
• Name the three kinds instead of counting them
• Stop claiming these kinds refused the five keys before
• Correct four prose claims about the authored-properties check
• Stop the schemaVersion aside from restating the additive test short a conjunct
• Correct the engineTraitProperties note on what expose/ingress/httproute did before
• Correct four inaccurate claims in the components README
• Bound two more claims the parser fix left unsupported
• Drop a wrong kind count from the parseAffinity test comment
• Replace the parseStringField convention universal with the exceptions
• Correct the securityContext policy-hook claim
• Scope the container securityContext policy claim
• Detect partial publishes and cover post-publication recovery
• Key the completeness check on the tag, drop the scripted deletion
• Use the goreleaser job conclusion as the completion oracle
• Pin the attempt, key on not-success, state two limits
• Let the command flag carried-over job rows
• Find the attempt that ran goreleaser, not the latest
• Require positive release ownership; correct the runner label
• Replace the partial-publish deletion branch with escalation
• Split transient re-run recovery, document the docs-deploy race
• Close the –failed class by enumeration, add the guard-failure row
• Correct two more statements of the guard’s old trigger condition
• Wait for the corrective docs deploy, not just the recovered one
• Replace false universal wrong-type claims with per-parser ones
• Narrow the new wrong-type disclaimer’s own blanket claim
• Don’t overstate null-affinity as ’nothing is enabled’ (codex round 2)
• Scope the passthrough IsList residual to zero in-repo producers
• Fix three wording nits found by codex round 2 confirm
• Describe IsNullValue as the nil predicate it is
• Scope npPortNumber’s accepted-types claim to builtins only
• Give bare F33/F36/round identifiers descriptive subjects
• State the aliasing test’s boundary and cite #425
• Drop the wrong direction count from the daemonset summary
• Name the two surfaces the null contract does not bind
• Stop optionalInt64’s comment asserting what #394 removes
• Close out the remaining stale null/shape-check claims
• Sync mapped docs with the kure release-1 builder contract
• Describe a conflicting same-source scopeOverrides CRD as rejected

Fixed

• Sync vendored downstream-references guard, cover config files
• Pin downstream-references gate and drift-check to one commit
• Retype renderChart seam for kure’s variadic RenderChart
• Pin the guard drift-check ref to the bumped action digest
• Add missing enforceCapabilities calls and reject zero divisors
• Revert enforceCapabilities addition, fix stale divisor comment
• Pin the guard drift-check ref to the bumped action digest
• Derive the guard drift-check ref from the action pin, not a copy
• Fully qualify the PR reference, survive errexit on a missing pin
• Enforce resource maxima against intrinsic workload defaults
• Resolve follow-up-issue TODO, skip enforcement when no maxima set, widen output-unchanged assertions
• Reject every capability when forbidden list contains ALL
• Reconcile capabilities enforcement docs, qualify issue reference
• Resolve golangci-lint version drift between mise.toml and the Makefile/CI pins
• Use the canonical golangci-lint install.sh URL
• Enforce pinned golangci-lint version; correct gosec rule ID in nolint
• Don’t mask a failed golangci-lint install behind a piped shell
• Set TypeMeta on values ConfigMap and stop wrapping template delivery
• Don’t reject template delivery on inherited valuesMode default
• Reject kurel-build components needing layout-level resources
• Fail loudly when flux CLI or plugin list fails in validate-manifests
• Reword downstream-consumer references caught by check-forbidden-terms
• Correct hook-ordering wording; modernize new code
• Harden hook-group coverage test, fallback pin, and docs
• Normalize multi-event helm.sh/hook annotations before hook-group split
• Drop excluded hook tokens from mixed excluded+custom annotations
• Don’t drop degenerate comma-only hook annotations; fix stale citations
• Harden parity scripts and the govulncheck marker regex
• Widen tool-version pin-detection regexes to any formatting
• Use the same regex for ci.yml count and value extraction
• Sync tool-version-parity docs and precommit gate
• Anchor govulncheck doc-sync extraction to the correct occurrence
• Wire govulncheck doc check into CI, harden checker and syncer
• Doc-sync gaps and CI_VAL whitespace trim for govulncheck checks
• Sed -i -E portability + DEVELOPMENT.md doc-sync gaps
• Tolerate trailing whitespace on the ci.yml pin line; fold golangci-lint recovery instructions into all synced files
• Scope the govulncheck-docs rule to its own customManager
• Strip trailing whitespace from Makefile golangci-lint pin
• Reject duplicate golangci-lint source pins in mise.toml
• Tolerate mise.toml = spacing in duplicate-pin guard
• Tolerate TOML single-quote pins; align syncer’s mise parser with the checker
• Scope mise.toml pin matching to [tools]; guard syncer against duplicate pins
• Tolerate whitespace around the [tools] table header
• Recognize TOML quoted-key [tools] table headers
• Stop the pin-impact gate silently swallowing its own exit code
• Guard –old/–new argument parsing and non-ahead compares
• Add pin-impact-ack override, harden multi-step/dot-segment gaps
• Recognize uses:/run: written as the step’s first YAML key
• Rerun pin-impact on label change, detect compound-line source
• Scan .yaml workflows too, reject mixed deps in one run block
• Bind pin-impact-ack to the reviewed head SHA
• Skip label mutation on fork PRs, fix token auth, use immutable base SHA
• Fail closed on ack-strip failure, cover reopened PRs, tighten perms
• Wire go.mod/versions.yaml/README badge into the mise-sync postUpgradeTasks
• Anchor go.mod’s go-directive sed on content, not line number
• Sync go.mod’s go directive across all three modules
• Drop dead self-substitution sed, harden go.mod directive sync
• Widen go-version postUpgradeTasks fileFilters to every workflow file
• Wire sync-versions.sh generate into the go-version postUpgradeTasks chain
• Sed portability, AGENTS.md sync, and nested go.mod path-filter coverage
• Fail loudly when AGENTS.md is missing in check-go-version
• Commit the generated compatibility.md instead of leaving it untracked
• Let a raw document lowering rule claim its own apiVersion
• Scope a raw rule’s settled apiVersion to its own seed
• Bind a raw seed’s settle group to the registry key that matched
• Spell the raw apiVersion hook RawDocumentAPIVersion, not APIVersion
• Pre-reserve pass-through Applications by API group, not full apiVersion
• Enforce the PodSpec.OS contract and close the podResources object
• Address review round on the shared pod builder
• Forward ServiceAccountNamer and keep Windows pods legal
• Single-source the ServiceAccount identity across the workload kinds
• Synthesize gateway rules from the hostnames shorthand
• Stop claiming upstream parity for two stricter daemonset rules
• Give every generated object its own label map
• Tighten claim-spec validation and pin nested schema parity
• Reject a signed maxUnavailable percentage
• Close a MaxStorageSize bypass and three silent-acceptance gaps
• Close the claim resource-list schema to storage
• Reject non-string name, size and mountPath on claim entries
• Treat a null volumeClaimTemplates as absence, not a type error
• Read an explicit null as omission on every optional field added here
• Classify a typed nil as null, and read null lists as absence
• Read an explicit null storage quantity as omitted
• Deep-copy projected spec values instead of aliasing the config
• Compare both defaulted halves of the deadline rule, and check replicas
• Admit the deployment kind through the parser and the health-check map
• Qualify issue references and harden two test assertions
• Read an explicit null as omission on every deployment-spec field
• Read every top-level null as omission, bound both rolling-update percentages
• Read a claim’s whole access-mode set in the non-RWX guard
• Deep-copy the deployment’s projected spec values
• Skip the auto health check when a deployment is paused
• Make the maxFailedIndexes Indexed-mode refusal reachable
• Refuse the two job values that were read as omissions
• Make job reachable from the traits it is allowed to carry
• Refuse the empty podReplacementPolicy the parser was dropping
• Refuse the cronjob keys a retyped job document leaves behind
• Wait on the job, since kstatus can read one
• Stop the job from dropping a template and waiting on a paused one
• Refuse the dotted job name that admission would reject
• Accept the engine-read scope property on every authored trait
• Reject a property authored with the wrong container type
• Drop the spec-level traits key that made the quickstart unparseable
• Guard the test job’s build-essential install with command -v
• Guard on make as well as gcc, and qualify the issue reference
• The guard’s message must not claim publication succeeded
• Probe the release on every path, fail closed on an undetermined answer
• Retry the release probe, and stop the waiver claiming more than it can
• Read an explicit null as absence in every components parser
• Read an explicit null as absence in the six comma-ok parsers
• Re-point the inherited optional* call sites at their delegates
• Route remaining null-omission checks through authoredValue
• Cite the issue that actually tracks the parseAffinity sub-fields
• Close the capability type switch and read a null rendering as absent
• Type-check a declared default on the Go-built path too
• Address codex round-1 review findings for #431 null contract
• Reject a mistyped postgresql affinity block instead of discarding it
• Close the null and nodeSelector holes in postgresql affinity
• Report the lowest-sorted bad map key, not whichever one iteration reaches
• Follow #444’s optional*-wrapper removal in postgresql affinity
• PodAntiAffinityType null must be absence too (codex round 1)
• Reject a list-shaped passthrough object
• Reject passthrough envelopes with a null items, and freeze the validated object
• Make the passthrough list rejection binding, and finish the freeze
• Validate the emitted passthrough body in one place
• Scope the null-items rejection to List-suffixed kinds, and fix nil-slice freeze (codex round 1)
• Read a null NetworkPolicy peer selector as absent, not as empty
• Reject a null NetworkPolicy peer envelope
• Stop a null ingress/egress satisfying the joint requirement
• Reject a null ingress/egress rule element
• Reject a malformed peer selector instead of widening it
• Reject a null matchLabels value instead of rendering “”
• Reject a malformed NetworkPolicy key or label value, don’t widen
• Reject a wrong-typed protocol and a lossy numeric port
• Classify NetworkPolicy label values by reflect.Kind, not exact type
• Classify NetworkPolicy port numbers by reflect.Kind too
• Declare the NetworkPolicy port schema instead of leaving it open
• Classify NetworkPolicy port-name and protocol by reflect.Kind
• Scan matchExpressions for matchLabelKeys clashes
• Reject mistyped tolerations, copy projected scheduling
• Reject scheduling shapes the apiserver refuses
• Read a nested null in a toleration entry as omission
• Close the admission and schema gaps the last fix left open
• Require matchFields values, make the parity guard bidirectional
• Normalize an emitted explicit null, and close two escapes in the matchFields parity guard
• Strip an emitted null unconditionally, without a PlatformReserved exception
• State the null contract and align its readers
• Narrow the Enum rule and reach the null guard past a missing Items
• Key the built-in Enum check to the rule the validator enforces
• Correct the tolerationSeconds row’s compatibility class and close the daemonset coverage gap
• Finish the optional*-to-parse* rename after the #440 rebase
• Restore authored-null handling, add matchLabelKeys/mismatchLabelKeys overlap check
• Validate required node-affinity label values, not preferred
• Close three defects the release-1 contract adoption exposed
• Stop an override outvoting a bundled CRD, and a panic at emission
• Reject an authored namespace on a cluster-scoped manifest or CRD

Testing

• Rename derived-memory-limit test to match what it proves
• Cover PatchError.Error() and Unwrap; fix patch README claim
• Cover helmchart valuesMode: configMap and its LayoutAugmenter wrapper
• Fix dot-boundary index in ConfigMap-name truncation test
• Cover PolicyResult.ConsumedCapabilities
• Cover hook-group partitioning, DNS-1123 safety, and coverage predicate
• Cover coverage-forward, prune-protection e2e, and fail-closed guard
• Pin grouping-key oracles; drop bare plan-step references
• Cover cronjob CronJobSpec/JobSpec fields and widened schedule
• Assert full unrecognized-key messages
• Assert hostnames survive alongside authored gateway rules
• Cover the generated claim spec end to end
• Pin three guards that survived deletion
• Observe every nested unknown-key guard on a claim entry
• Rename the claim-schema walker after a post-rebase collision
• Pin the shared non-RWX guard’s effect on the older kinds
• Fail rather than panic on an unset replicas pointer
• Pin that the non-RWX strategy guard survives scale-to-zero
• Fail rather than panic in the deployment aliasing mutator
• Pin worker’s topology spread under a non-noop policy
• Close three oracle gaps in the worker scheduling tests
• Pin whole scheduling objects, not field subsets
• Correct two over-broad scope claims in scheduling test comments
• Record the cross-PR cleanup where the next reader will hit it
• Pin IsNullValue directly, including the shapes nothing reached
• Pin that an absent NetworkPolicy port key errors, not panics
• Walk all four schemaPodSpec flag combinations in the ordering guard
• Pin the half of the Lt/Gt check no test could reach
• Guard the second-render index in the aliasing control
• Guard the new preferred-affinity test before indexing

[0.1.0-alpha.21] - 2026-08-21

Added

• External-secret envFrom and mountPath workload injection
• Validate external-secret envFrom keys and mountPath volume name
• Lowering engine core, property validator, extension channel, PlatformReserved
• Expose as a registered lowering rule
• Add ContractDescriber optional interface and HandlerContracts accessor
• Record lowering-rule identity in Origin.Rule
• Shared full-fidelity pod/container schema for builtin components

Build

• Bump Go to 1.26.6 for stdlib CVE fixes

CI

• Add merge_group trigger to pr-review.yml
• Run checks + AI review on draft PRs (GitLab mr-review parity)
• Bump govulncheck to v1.7.0 and pin it via workflow env
• Reword the govulncheck pin comment to drop downstream names

Changed

• Use the shared govulncheck gate

Dependencies

• Group the cloudnative-pg and controlplaneio-fluxcd modules
• Bump github.com/google/go-containerregistry

Documentation

• Document the doc-sync composite actions in docs-build/doc-gate
• Document and demonstrate external-secret workload injection
• Document mount-path collision rejection, fix stale line citation
• Specify raw-document entry point for lowering engine
• Stop citing spike-only TransformAll as current-branch fact
• Document the lowering engine’s public API in package READMEs
• Stop scoping emitted-property validation to schema-declaring rules
• Drop dangling cross-reference to untracked review notes
• Fix stale ExposeHandler/RenderingSchema references in design-capability-schema.md
• Fix two stale references caught by scoped wave-2 re-review
• Sync pkg/oam doc comment with lowering engine scope
• Fix stale RegisterTraitLowering reference for built-in expose
• Document ExposeRendering.NetworkPolicy (doc-gate fix)
• Document NameAllocator namespace scoping and LowerRaws metadata validation
• Correct round-13’s forwarded-trait claim, document two deferred gaps
• Document ContractDescriber, HandlerContracts, and Origin.Rule
• Correct “engine never reads” claim re: ContractMetadata.Version
• Document Origin.Rule’s forwarded-element exception
• Qualify draft-review claim on rollout dependency (codex confirm-round, wording)
• Correct the go.work ignore rationale

Fixed

• Consume canonical doc-sync scripts from go-kure/.github
• Trigger CI on ready_for_review so draft-gated jobs actually run
• Forward service interfaces through trait decorators
• Reject mistyped envFrom/mountPath and close asymmetric volume collision
• Forward LayoutAugmenter conditionally, reject mount-path collisions
• Stop claiming applyTraits already enforces PlatformReserved
• Correct policy-ordering, schema-parity, and PlatformReserved gaps in expose lowering
• Close final-review gaps in hostname-wildcard reservation, lowering-rule registration, and docs
• Make handler/lowering-rule collision checks reciprocal
• Preserve stamped origin across a second lowering round
• Stop validateSettled dropping registered custom trait handlers
• Catch a same-round sibling name collision in NameAllocator
• Reject an empty Kind() at document-lowering registration
• Enforce AdditionalProperties on an object field with no sub-schema
• Exempt built-in trait-lowering rules from CapabilityDefinition
• Admit registered component handlers during settled validation
• Publish component-lowering schemas alongside trait rules
• Skip capability re-merge for sealed traits in lowering-rule dispatch
• Write normalized collection values back onto validated properties
• Defer trait-component restrictions for lowerable component types
• Gate LowerRaws dispatch on apiVersion, not kind alone
• Record every emitted sibling in LoweringStep.To; reject cross-round name reuse
• Namespace-scoped raw dedup, sealed nested traits, lowerable-type leak, NaN/Inf rejection
• Accept networkPolicy under the expose capability’s rendering
• Scope NameAllocator reservations by namespace
• Validate claimed raw document metadata before lowering
• Support annotations on the httproute trait
• Don’t seal traits a component rule merely forwards
• Give a chain of exactly MaxLoweringDepth-1 expansions room to settle
• Enforce strict-capabilities’ missing-CapabilityDefinition check for lowering rules
• Apply CapabilityDefinition schema to lowering rules without VAD
• Enforce lowering-rule PropertySchema on emitted intermediate components/traits
• Reserve pass-through document identities against LowerRaws collision detection
• Scope pass-through identity reservation to the terminal kind
• Close five round-9 Codex gaps in the lowering engine
• Seal document-rule nested traits, validate policy lowering-rule schemas
• Stamp nested document-rule output, reserve expose gateway fields
• Seal raw-entry nested traits, defer trait validation past forwarding
• Re-vendor check-forbidden-terms.sh to canonical
• Correct rule-class label and forwarded-component Rule stamping
• Preserve Origin.Rule on document-forwarded policies
• Reuse the computed rule identity in LoweringStep, not a rebuilt one
• Keep ready_for_review in pr-review caller (A6 finding)
• Make resources/securityContext/env full-fidelity per round-2 review
• Reject unsupported postgresql resource names, fix stale docs
• Reject 6 more admission-invalid values instead of accepting them
• Fix 4 more admission-invalid gaps, revert numeric-quantity rejection
• Validate extended-resource quantities, resourceFieldRef prefix, fileKeyRef path, and lifecycle exec args
• Validate env fieldRef paths, resourceFieldRef selectors, and envFrom object names
• Reject 4 more contradictory/unsafe security-context and resource inputs
• Reject 5 more silently-dropped or overcommit-invalid inputs
• Wire CronJob volumes for fileKeyRef, reject non-bool hardening flags
• Reject standard-resource request>limit and empty httpGet paths
• Reject 15+ more silently-typed fields, fix httpGet.path regression
• Reject 4 more silently-wrong-type array/scalar fields
• Reject mistyped securityContext/workingDir, document fileKeyRef gap
• Reject mistyped nested securityContext profiles and envFrom prefix
• Reject mistyped lifecycle object and non-string procMount
• Enforce probe bounds and reject unresolvable named ports
• Correct 5 findings from wave-12 review of PR #284
• Correct 3 findings from wave-13 review of PR #284
• Correct 2 findings from wave-14 review of PR #284
• Correct 2 findings from wave-15 review of PR #284
• Correct 2 findings from wave-16 review of PR #284
• Correct 4 findings from wave-17 review of PR #284
• Correct 3 findings from wave-18 review of PR #284
• Correct 3 findings from wave-19 review of PR #284
• Correct 6 findings from wave-20 review of PR #284
• Correct wave-21 bot finding, plus 9 self-found unknown-key siblings
• Reject unknown resourceFieldRef/envFrom-ref keys, correct fileKeyRef doc
• Reject unknown keys and malformed types across remaining valueFrom/pvc/lifecycle fields
• Qualify generated PVC object names by component to avoid collisions
• Reject RWOP+other-modes and CAP_SYS_ADMIN+no-escalation, preserve explicit empty storageClass
• Reject malformed accessModes/storageClass, close per-type volume field sets, fix PVC re-qualification
• Make qualified PVC names collision-free across hyphenated component/volume names
• Validate qualified PVC names against DNS-1123 limits

Testing

• Cover F5 capability-def schema defaults for trait-lowering rules
• Cover ContractDescriber/HandlerContracts and Origin.Rule identity
• Fix vacuous assertion in untouched-component rule-identity test

[0.1.0-alpha.20] - 2026-08-03

Dependencies

• Bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2
• Bump kure to v0.2.0-beta.8 with shared dependency updates

Fixed

• Bump grpc to v1.82.1 for GO-2026-6061
• Decode raw Cilium rules strictly; bump kure to v0.2.0-beta.9

[0.1.0-alpha.19] - 2026-07-15

Added

• Synthesize ingress allows for external routing backends via explicit selector

Fixed

• Distinct resource names for multi-endpoint endpoint-ingress policies
• Resolve #227 backendRef retargeting across dependency/tier bundles
• Only register components that own a Service as backendRef targets

[0.1.0-alpha.18] - 2026-07-14

Added

• Implement EndpointProvider on webservice
• Postgresql pooler EndpointProvider + per-endpoint NP naming
• Derive ingress-synthesis target from expose backendRefs

Changed

• Tighten builtin rbac and flux patch schemas
• Adopt shared check-forbidden-terms action for scan parity

Fixed

• Scrub downstream references from generated notes
• Scan full tree for downstream refs on PRs (PR/merge-queue parity)
• Fail fast on invalid egress peers
• Preflight downstream-reference guard before every CI push

[0.1.0-alpha.17] - 2026-07-13

Added

• Target the platform component label in synthesized NetworkPolicies
• Parametrize the platform label/annotation domain (default gokure.dev)
• Guard against launcher leading kure on shared direct deps
• Add EndpointProvider and endpoint-ingress NetworkPolicy synthesis

CI

• Enforce no-downstream-references guard and document the rule

Changed

• Genericize downstream references in comments, READMEs, fixtures

Dependencies

• Bump go-kure/kure to v0.2.0-beta.7 and align shared deps

Documentation

• Genericize downstream references in design docs

Fixed

• Run tag-collision checks in preview + guard next dev version
• Publish external-secret shorthand design doc and fix traits link
• Harden kure-dep-sync guard per PR review
• Always refresh remote-tracking base ref in kure-dep-sync guard

[0.1.0-alpha.16] - 2026-07-11

Added

• Accept storageClassName + volumeSnapshotClassName via capability rendering
• Synthesize per-component egress NetworkPolicy from a non-authorable input

[0.1.0-alpha.15] - 2026-07-10

Changed

• Unify schema vocabulary on PropertySchema
• Preserve YAML aliases and validate schema keys

Fixed

• Make unsupported-field error name the correct allow-set

Testing

• Cover param aliases and document merge-key rejection

[0.1.0-alpha.14] - 2026-07-09

Added

• Authored secretName override on ingress TLS

[0.1.0-alpha.13] - 2026-07-09

Added

• External-auth (oauth2-proxy) ingress annotations
• Expose ComponentName() accessor on sub-app configs
• External-secret data[] shorthand (derive remoteRef.key + property)

Documentation

• External-secret data[] shorthand design spike

Fixed

• Accept security-context in validTraitTypes

[0.1.0-alpha.12] - 2026-07-08

Added

• Add Description to PropertySchema + populate builtin handler descriptions
• Hostnames shorthand + platform-default ssl-redirect

[0.1.0-alpha.11] - 2026-07-07

Added

• Support privateKey (algorithm/size/rotationPolicy/encoding) in certificate trait
• Consume EnvironmentPolicy storage/scaler defaults in scaler/pvc/postgresql

Documentation

• Document Policy defaults & enforcement in pkg/oam README

[0.1.0-alpha.10] - 2026-07-04

Documentation

• Note capability-injected fields are not user-required in trait schemas

Fixed

• Don’t mark capability-injected fields as user-required in schemas

[0.1.0-alpha.9] - 2026-07-03

Added

• Add PropertySchema() to rc.1 public built-in handlers

Changed

• Give resources requests/limits independent sub-maps

Documentation

• Refresh github-workflows.md Last Updated date
• Note shared handler registration and property schemas

[0.1.0-alpha.8] - 2026-07-02

Added

• Property-schema vocabulary + handler-schema interface
• Platform-managed TLS + hostname validation
• Synthesise parentRefs from capability
• Add prerelease bump scope

Dependencies

• Bump external-secrets/apis to latest pseudo-version
• Bump github.com/cilium/cilium from 1.19.4 to 1.19.5
• Bump github.com/google/go-containerregistry
• Bump github.com/cert-manager/cert-manager
• Bump sigs.k8s.io/gateway-api from 1.5.1 to 1.6.0
• Bump github.com/cloudnative-pg/cloudnative-pg
• Adopt Flux 2.9 API set + kure v0.2.0-beta.6

Documentation

• Note k8s.io/api constant convention

Fixed

• Use k8s.io/api constants for well-known K8s values

Performance

• Source-aware Go build cache, split by job purpose

[0.1.0-alpha.7] - 2026-06-19

Dependencies

• Bump the k8s-ecosystem group across 1 directory with 3 updates

[0.1.0-alpha.6] - 2026-06-19

Added

• Add security-context OAM trait handler

Dependencies

• Bump github.com/cloudnative-pg/plugin-barman-cloud
• Bump github.com/backube/volsync from 0.15.0 to 0.16.0

Documentation

• Reference security-context trait in build command README

Fixed

• Reject non-integral float values in toInt64

[0.1.0-alpha.5] - 2026-06-05

Added

• Add oci component handler
• ScopeOverrides for cluster-scoped CRs without in-source CRD
• Single-source docs map + enforcement tooling; mount existing docs

CI

• Enforce docs sync (check-doc-sync, link-check, doc-gate)

Documentation

• State mandatory documentation-sync rule (Part C cascade)
• Correct backend to claude-max-proxy:3456
• Add per-package READMEs (errors, kurel CLI ref, oam overviews)
• Add section intros, api-reference index, and generator markers
• Refresh AGENTS structure + mark doc-sync enforced
• Publish OAM model + component/trait handler references
• Getting-started narrative + mount capability schema
• Use absolute pkg.go.dev links for cross-package refs

Testing

• Cover oci auto health-check GVK + flux namespace

[0.1.0-alpha.4] - 2026-06-03

Added

• Add crd and manifests component handlers

Build

• Tidy go.mod (promote apiextensions-apiserver to direct)
• Bump Go to 1.26.4 (fixes 3 stdlib vulns) and fold in govulncheck tweaks

CI

• Add merge_group trigger and harden change detection for merge queue
• Cap govulncheck memory (GOMEMLIMIT + -scan package) to avoid runner OOM

Dependencies

• Bump the k8s-ecosystem group across 1 directory with 2 updates
• Bump github.com/go-kure/kure

Fixed

• Build linux-only release artifacts

[0.1.0-alpha.3] - 2026-06-02

Fixed

• Emit the flux namespace for helmchart auto health checks (#234)

[0.1.0-alpha.2] - 2026-05-30

Added

• Restore app parameter on cilium-networkpolicy parseProperties
• Rename daemonset Service port name from tcp to http
• Revert volsync sub-app name to {sourcePVC}-backup
• Accept inline secretStoreRef/provider in external-secret trait
• Add FluxNamespace forwarding for configmap+helmchart combos

[0.1.0-alpha.1] - 2026-05-29

Added

• Certificate trait uses nested issuerRef {name,kind}
• Support scope property for ingress/httproute sub-app naming
• Synthesize per-component allow-ingress NetworkPolicy at cluster post-build
• Parse networkPolicy.trafficSources on ingress/httproute traits
• Add passthrough component for arbitrary objects
• Register passthrough component type

CI

• Redesign release workflows — Create/Promote/Bump/Publish

Dependencies

• Bump kure to v0.2.0-beta.0 and align flux/containerregistry deps
• Bump kure to v0.2.0-beta.3 and align k8s deps

Documentation

• Add README with index, profile guide, and custom-capability explanation
• Document launcher’s intentional kure package boundary
• Document and example the passthrough component

Fixed

• Correct cluster profile issuerRef fields and custom-capability app; support custom traits in parser
• Change default HelmRelease interval from 10m to 60m
• Deep-copy passthrough object so source properties are never mutated
• Upgrade golang.org/x/net to v0.55.0 to address GO-2026-5026

[0.1.0-alpha.0] - 2026-05-22

Added

• Add docs site and versioned release workflow
• Migrate pkg/launcher, pkg/patch, cmd/kurel, pkg/cmd/kurel from kure
• Pkg/errors — ValidationError, ParseError, and error helpers
• Pkg/oam — handler interfaces
• Pkg/oam — ClusterProfile and CapabilityBinding types
• Pkg/oam — Policy interface, Enforceable, NoopPolicy
• Runtime skeleton — Transformer registry and pipeline types (#47)
• Transform pipeline — Transform, TransformWithPolicy, and pipeline stages (#53)
• Built-in webservice, expose, and ingress handlers (partial #48, #49, #50)
• Add build command — OAM vertical slice (#55)
• Add worker, cronjob, daemonset handlers with fixture parity (#48, #54)
• Add statefulset handler and certificate/scaler/pvc traits (#48, #49, #54)
• Add external-secret, configmap, networkpolicy, cilium-networkpolicy, volsync traits (#49, #50)
• Add postgresql component handler (#48)
• Add httproute trait handler and expose gateway dispatch
• Add port field, Service generation, and servicePortProvider to daemonset (#86)
• Rename helmrelease→helmchart, add gitopsEngine to ClusterProfile, implement helmchart handler (#82, #84)
• Add kurel.yaml package descriptor and parameter substitution (#51)
• Implement helmchart delivery: template (#83)
• Allow routing traits on helmchart components via explicit servicePort (#89)
• Add CapabilityDefinition schema for custom trait rendering (#66)
• Port rbac, fluxcd-patches, fluxcd-postbuild, prune-protection traits from the downstream operator (#97 #98 #99 #100)

Build

• Bump kure to v0.2.0-alpha.8; add helmchart template e2e test

CI

• Add AI PR review and Claude Code workflows
• Replace shared workflows with callers to go-kure/.github
• Optimize pipeline — parallel jobs, single test run, Hugo cache, path filtering
• Cancel in-progress runs when new push arrives on same branch
• Drop go build cache, bump timeouts for slow S3 upload
• Force legacy cache API to route through in-cluster cache server
• Rename runner label autops-kube -> autops-kube-kure
• Explicitly set ACTIONS_CACHE_URL in workflow env to override job dispatch
• Switch to ACTIONS_RESULTS_URL for cache routing, fix artifact steps
• Expand workflow path filter and fix coverage comment threshold

Changed

• Rename oam.Policy struct to ApplicationPolicy

Dependencies

• Bump k8s.io/apimachinery from 0.35.3 to 0.36.0
• Bump github.com/go-kure/kure
• Align dependencies with kure main

Documentation

• Add initial design document
• Update module path references from kure to launcher in READMEs
• Add Organization Resources section referencing go-kure/.github
• Add GitHub Actions workflow reference
• Phase 0 design documents for OAM runtime
• Second iteration of Phase 0 OAM design documents
• Record Phase 0 design decisions and close open questions
• Finalize Phase 0 design — trim options docs, complete kurel-package §6, add changelogs
• Add examples covering all Phase 1 component and trait types
• Update design.md to v1.3 — OAM-native architecture
• Design capability schema for built-in and custom handlers
• Fix cluster-profile terminology, narrow universal-scope claim, update deferred ref

Fixed

• Correct import ordering in pkg/cmd/kurel/cmd.go
• Correct import ordering in pkg/launcher test files
• Split kure/launcher import groups for goimports compliance
• Add test to build gate needs to catch skipped cascade on failure
• Guard against empty Hugo version parse from mise.toml
• Add validate to build gate needs so lint failure blocks merge
• Add CHANGELOG.md to check-mounts verification
• Bump Go to 1.26.3 and x/net to v0.53.0
• Remove phantom pkg/errors and pkg/logger from repo tree
• Correct stale GVK references in design-kurel-package.md
• Address final review findings before PR #58 merge
• Enforce Policy capability constraints in pipeline
• Use pkg/errors instead of fmt.Errorf in builtin handlers
• Replace remaining fmt.Errorf in decode.go and expose.go
• Evaluate ClusterProfile capabilities before Transform
• Parse ClusterProfile strictly; reject unknown fields
• Add semantic validation to ParseClusterProfile
• Guard cronjob history limits against int32 overflow
• Promote cert-manager to direct dep; validate PVC access modes
• Reject explicitly empty accessModes list in pvc trait
• Address external-secret shorthand, volsync naming, and coverage
• Preserve decodingStrategy in external-secret remoteRef shorthand
• Align postgresql customQueries validation and bootstrap recovery tests with the downstream operator
• Remove wrong deprecation from ingress/httproute; fix default backend port
• Validate implicit backends; extend ingress with per-path backend override
• Tighten implicit-backend port guards for ingress and httproute
• Tighten parameter coercion validation
• Validate parameter defaults at parse time and coerce plain-string defaults
• Reject map and slice defaults for string parameters at parse time
• Reject invalid interval string in helmchart ToApplicationConfig
• Add actions: read permission to release-create workflow

Testing

• Expand builtin handler coverage to meet 80% threshold
• Document prune-protection narrow scope; strict target validation in fluxcd-patches