chore(main): release 0.41.0

[github-actions]

🤖 I have created a release beep boop

0.41.0 (2026-07-27)

⚠ BREAKING CHANGES

• analyzer: RefusalReason.Code is typed IssueKind, not string.
• attribution: --author-attribution-cluster-annotation-key is renamed to --author-attribution-audit-route-annotation-key, and the chart value attribution.clusterAnnotationKey to attribution.auditRouteAnnotationKey. There is no deprecated alias: an operator still passing the old flag fails to start. The fact-key infix changes from cluster: to route: with no dual-read, so a rolling upgrade has a TTL-bounded window where events commit as the configured committer.
• api: a resync no longer deletes Git documents whose resources are absent from the desired snapshot. Set spec.prune.mode: always on a GitTarget that needs full desired-state convergence. Deleting a resource in the cluster still deletes its file. Ships in the same release as the rule-kind scope change, which it exists to make non-destructive.
• api: ClusterWatchRule is cluster-scope-only and WatchRule.spec.sourceNamespace moved to spec.rules[].sourceNamespace. A namespaced ClusterWatchRule becomes a WatchRule in the tenant namespace; its namespaced items become sourceNamespace: "*" (or explicit names). A target that declares no allowedSourceNamespaces admits NOTHING to a "*" item, so converting without also declaring that policy narrows production data. See docs/UPGRADING.md.
• kustomize: attribute overrides with a dyed render, verify by re-render, delete the re-implementation (#233)
• kustomize: read kustomization.yaml with kustomize, not a hand-written parser (#229)
• gitops-api: layout corpus, support baseline, and doc-link checker (#224)
• rbac: least-privilege RBAC, a strict chart values schema, and informers that stop on 403 (#223)
• bumping crd versions and last edits
• validating webhook is required (even is audit has been configured).
• api: the configbutler.ai API group is now served only at v1alpha2; v1alpha1 manifests and clients must be updated to v1alpha2.
• providerRef no longer accepts a Flux GitRepository (group/kind enum values removed), and the per-Secret insecure_ignore_host_key key is replaced by the --insecure-allow-missing-known-hosts controller flag. See docs/UPGRADING.md for migration steps.
• Field rename for clarity (please check configuration.md)

Features

• --author-attribution={true|false} is now allowing you to enable or disable the need for kube-api configuration (at the cost of loosing the real author). (7860294)
• /readyz now waits for healthy audit ingress and valid pingable Reds connection (c10a4da)
• acceptance: accept benign repo-hygiene passengers instead of refusing the folder (#242) (49327fd)
• acceptance: treat a release-referenced values file as read-only context (#245) (d25c013)
• allow end-user to create explicit commit with specific message (which also ends the automatic commit window). (abd6a48)
• Allowing commit author and message config (04a592b)
• analyzer: make the scan report a KRM document that says what it knows (#275) (a3daa6b)
• API-surface trigger gating, Redis key prefix, pkg/manifestanalyzer + scan-folder/scan-repo rename (#221) (0a940b3)
• api: add GitTarget.spec.prune.mode and stop inferring deletions (#260) (f103ca8)
• api: rename API group version v1alpha1 -> v1alpha2 (a7c4dcd)
• api: scope by kind — per-item WatchRule source namespaces, cluster-only ClusterWatchRule (#259) (982e816)
• audit webhooks it is (ff31254)
• bi-directional ArgoCD advise/tests + strip Argo tracking-id from Git writes (#225) (ddd75cb)
• bumping apiservice-audit-proxy and it's all TLS now (9d431c2)
• bumping crd versions and last edits (4fcffa3)
• chart: Redis-optional install by default; rename modes to configured-author/attributed-author (#211) (3bd40c0)
• ClusterProvider — source clusters by name, reconcile-time namespace authorization (#251) (5065b09)
• commit signing (5e8ad9c)
• CommitRequest can be attributed by validating webhook handler since it's an internal command (58dd37a)
• commitrequest: controller-driven, audit-attributed finalize (C-B2) (cc426d8)
• commitrequest: eager message attach (stage 4) (d5113a1)
• commitrequest: resolve-on-push with the pushed SHA (stage 5) (c9093d3)
• commitrequest: the Rejected outcome with a structured reason (stage 6) (d800fb4)
• config-plane split, immutable GitTarget.spec.kubeConfig for remote-cluster mirroring (#249) (9dc5da7)
• count loc (f819e9a)
• deduplicated audit ingestion for aggregated API, removes the option to indicate cluster id (35443db)
• demand driven audit ingestion (only for types that we need) (dbfce5e)
• Field rename for clarity (please check configuration.md) (9f101b0)
• first phase for commit batching based on author (e742e8c)
• gitops-api: layout corpus, support baseline, and doc-link checker (#224) (c48cc58)
• gitops-api: place new resources to match the repo's existing layout (#202) (97a9c87)
• gitops-api: treat higher-level KRM objects (HelmRelease, Argo Application, KRO) as first-class documents (#203) (e5722a7)
• git: write-boundary L1/L2 preconditions, WriteBoundaryRefused status, and go 1.26.5 refresh (#216) (e9a2476)
• immutable gittargets and gitdestinations (167a800)
• kustomize: attribute overrides with a dyed render, verify by re-render, delete the re-implementation (#233) (61ed1e7)
• kustomize: edit images/replicas overrides through to kustomization.yaml (#198) (a8ce917)
• kustomize: read kustomization.yaml with kustomize, not a hand-written parser (#229) (6b3f202)
• let's get all testing to Kubernetes 1.36 (905ff29)
• make unresolved attribution explicit and harden operations (#257) (e41f69c)
• manifest-analyzer: repo-walker onboarding discovery (F8 first cut) (22e9e92)
• manifestanalyzer,git: refuse unsupported GitTarget folder content in the writer (6264d5d)
• metrics overhaul as a step into more observability (1a7cd19)
• overlay: prove new-object placement; author images/replicas overrides and $patch:delete (#244) (38590d1)
• prevent nested gittargets (c407fa4)
• rbac: least-privilege RBAC, a strict chart values schema, and informers that stop on 403 (#223) (21a0565)
• read Flux/Argo credential Secrets; drop Flux GitRepository providerRef (fc7a765)
• refuse weird files in GitTarget path, but do allow .gittargetignore (1bf3820)
• rename snapshotTemplate to reconcileTemplate, and default now includes type and last resourceVersion (e26676d)
• render-root scoping + tolerate patches and patched overlays reading ../../base (#239) (e9d6be1)
• replacing Makefile by Taskfile (bd3b709)
• require value for GitTarget.Path, since hooking up GitTarget to repo root must be deliberate (39e02a6)
• reworking metrics to new architecture (b502afe)
• scan-repo: adopt external-base overlays instead of refusing them (#243) (c7650f9)
• secrets: stop retaining Secret values in the control plane (#208) (535c5ed)
• status: two-axis GitTarget status (Ready + Synced/phase), serviceability roll-up (cea0b35)
• stream: /scale rides the parent type's stream (DEC-A, stages C-A1+C-A2) (4741e66)
• support --additionalSensitiveResources (in addition to v1/secrets) (3ae1ebd)
• support "offical_first" for situations where the offical kube-api audit events arrives slightly before the additional body event. (380dc1e)
• support claim based commit author attribution (06eaf8c)
• support flexible manifest placement / editting (d43d268)
• support for subresources (working kubectl scale deployment) (0f34d50)
• switching to apiservie-audit-proxy (1843cff)
• typeset,watch: M12 first slices — type lifecycle events + per-type reconcile/sweep (e3f0bd8)
• typeset: registry owns discovery grace; catalog shrunk to a per-scan normalizer (6d0dba4)
• validating webhook is required (even is audit has been configured). (96ec390)
• watch-first ingestion (28389c9)
• watch: CommitRequest watermark barrier primitive (C-B1) (781bfd6)
• watch: diff watch-derived vs audit-derived desired sets (Phase 1 payoff) (c8ba472)
• watch: parallel watch-state stream behind --watch-state-stream (097230b)
• watch: surface a refused GitTarget folder as a Blocked stream (5bdc43d)

Bug Fixes

• allow generated names with a commit request (#155) (ff27eba)
• Allow GitTarget to respond quickly to changes in the tracked GitFolder (591d310)
• attribution: partition author facts by declared audit route (#263) (0d61128)
• attribution: resolve the audit route from one ClusterProvider read (#264) (686fb00)
• audit messages that indicate conflict (409) can't end up in Git anymore (should never happen given that they also don't end up in etcd). (ec47c52)
• better reconcile (f3dcf56)
• central APIResourceCatalog so that we have one abstraction/cache to which things the current apiserver is serving. (3d6cb62)
• ci: free runner disk after image loads; diagnose e2e rollout timeouts (#187) (b89432f)
• ci: pin Trivy platform when scanning release digests (#191) (08d557d)
• controller: retry Declare on the settle cadence instead of stalling 10m (b4cafce)
• e2e: deliver image via k3d direct mode, keep retry + pin verification (#186) (31abd14)
• e2e: gate cluster readiness on healthy API discovery (5b81718)
• e2e: retry k3d image import when the tools-node tarball race drops the image (#185) (e426206)
• first relevant commit can also include optional files (is now included). (5801b5d)
• fixing flaky e2e test (83e9f17)
• gate audit body joins by rule relevance (605964a)
• git: push a window closed by a no-op resync (stage 3) (103ad36)
• gittarget can just be created without existing gitprovider (don't block, just give a good error). (ee20cfd)
• green CI — guard anonymous-access nil deref and skip audit webhook TLS for committer-only e2e (1e23e16)
• Handle deletion 'updates' by checking for terminating and deletionTimestamp (fdf4214)
• Have working printcolumns (eca9ae8)
• heal: drain a deferred heal when an atomic finalizes the window; fix drifted comments (23c881b)
• heal: restore periodic checkpoint healing via a deferred-until-idle heal resync (9a06fe8)
• ignore subresource audit events (that was hard to debug!) and replaced debug dump mechanism (#153) (23a2d65)
• improve and test GitTarget isolation behaviour (0787b1b)
• kustomize: a digest: override no longer strips the tag out of the source file (#231) (8a835f0)
• kustomize: refuse a folder kustomize cannot build, and read the override chain from the renderer (#232) (960e3bd)
• kustomize: stop writing the build's own output into the build's input (#234) (8444cd0)
• materialization: retry a failed Declare-time initial backfill (af6c5b8)
• prevent PrepareBranch call for cold cases (f760c36)
• prevent race in creating gitea org (ddbcbb3)
• Preventing reconcile code from ignoring ns boundary (d3b0ecf)
• race condition in HelmRelease causing unstable e2e tests (03b95ab)
• readds support for wildcards (8e1b3ab)
• reconicle fail on restart and wildcard (26511a9)
• release: give the analyzer job the bash it was written for (#279) (8bb4490)
• release: sign and attest GitHub release assets directly (#201) (10f8962)
• resolving a flaky unit test (04715a2)
• sanitize: strip the kcp.io/cluster annotation from Git writes (#227) (d9b6d9d)
• showing spec.message at commitrequests (54225eb)
• timing issues when adding a new WatchRule in e2e: simplifying the ingestion resolves this (a688620)
• upgrade to latest a apiservice-audit-proxy should resolve our non 0 shallow events, also included tests to verify that we don't misread deletecollection events as shallow (903d792)
• wainting for the right status to return (cc701d6)
• watch for changes in dependent resources (8c9aeb8), closes #145
• watch: a cluster-wide selection must not collapse named-namespace streams (#255) (10a530a)
• watch: enforce ClusterProvider admission wherever rules compile (#258) (82d0c39)
• watch: only backfill-reconcile a type on its first TypeSynced (8f2ad84)
• WatchRule leaking resources from other namespaces in live event stream (1676a42)

Performance Improvements

• build: cache Go build + module dirs in Dockerfile builder (#194) (55ed662)

Documentation

• adding architectural overview (e932402)
• adding DAG overview of tasks (#177) (f7a8b6a)
• adding designs with use cases (31b7857)
• adding skills and working on status design (e55b63a)
• Adjusting docs to how it all works now (f8c7796)
• and simpler (c27f7ab)
• And the last claude additions for today (76191b3)
• architecture tweaks and cleaning docs (f9aca70)
• boundary: consolidate support records (#241) (3b937f9)
• capture contextual-namespace + SOPS single-file decisions, add folder fixtures (1bd8af7)
• cleaning and moving to finished (bb79343)
• cleaning branch work (d07233a)
• cleaning up and more clarity (51396a2)
• Cleaning up docs (96b249d)
• cleaning up old docs (791d2f9)
• clear the markdownlint backlog and gate structure tree-wide (#265) (81b7648)
• continue designing for this approach (27ba3db)
• continue docs clean-up, and other small things from review (80c380c)
• created new plan, and hopefully found why the tests are so flaky (9e610e6)
• desiging the next phase (c2d3ce8)
• designing gittargetignore (19ffc7e)
• document learnings, and some tests to see how this behaves (64a0c19)
• fighting over abstractions, and what the exact value is of certain parts (f9227fc)
• final review on architecture.md (046b538)
• first design (7d60c22)
• five-PR plan for WatchRule source namespaces, plus PR 1 — namespace-scoped resync (#254) (a60590b)
• getting all design docs together so that we can cleanup (17339c0)
• getting audit ingestion (63de7d8)
• getting better (7bd1f32)
• getting claude to review it again, with some questioning of my own (e133724)
• getting codex feedback (a42145c)
• getting docs in and small fixes and tests (160640a)
• getting docs in line and reporting on current findings (76929d8)
• getting more details in the plan (135820b)
• getting more whys into the architecture document (5762a4a)
• Getting next steps in (ac12d25)
• getting started hints for aggregated API usage (7d86434)
• getting the plan ready for execution (6eb3787)
• gitops-api: onboarding repo-discovery design (F8); archive shipped F1/F7 (#213) (4469e2b)
• Improving quick-start quality by moving to helm (cf25552)
• initial docs (also some findings from preps for Cozysummit) (fbbfcec)
• investing in good designs is worth it I guess (4cb5f45)
• let clean it up a little bit for now (026443a)
• Let's get an elaborate description of the e2e tests (9091712)
• Let's just commit it then (401d194)
• materialization: correct the stale watch-first sync comment; scope Slice D (c3e6122)
• More details in the document (1b51f1c)
• moving architecture along with the rewrite (6e1193a)
• Phase 2.5 status + Monday resume plan (3-agent CI green once; stability TBD) (b285ac5)
• planning and designing for new features (856beee)
• planning the implementation (d6e174b)
• reconcile residual-flake findings across the stream design docs (90a1e7e)
• record Phase 2.5 implementation status and measured impact (dba83ac)
• reorder readme steps for devcontainer (#178) (7856f69)
• review the configuration surface, and record three consumer asks against the published contract (#272) (1f0b5d1)
• reworking docs and tuning the new CRD (8ebceaf)
• second design (2146289)
• some claude (5315440)
• the plan is ambitious now I would say (24457fb)
• typeset-grace: pin the exact typeset surface, consumers, and per-stage interface delta (8e45ff8)
• types: make ResourceIdentifier.Key() a stated, tested contract (#273) (80989ea)
• Working on plans (7bb77bb)
• working on refining the design of this new pipeline (7b15e2d)
• working on vision docs (394d8bf)

---

This PR was generated with Release Please. See documentation.