chore(main): release 0.41.0

[github-actions]

Release 0.41.0

Nine commits since v0.40.1. Two of them are worth the release on their own: attribution no longer needs Redis, and the machinery underneath it is now the shape a second replica needs.

Attribution without Redis

Naming the human behind a commit used to mean running Valkey. It no longer does.

Attribution facts moved from a Redis keyspace the watch side polled to a log it follows, with an in-process index in front of it. Two consequences:

• --author-attribution-transport=memory carries the facts in an in-process ring buffer. A single-replica install now gets named commit authors with no Valkey/Redis at all — running a StatefulSet just to write alice instead of the bot into git log was out of proportion, and now you don't have to.
• The resolver stopped polling. It used to wake every 150ms and re-read Redis, looking again to paper over a race. It now registers a waiter and blocks: the fast path is a map read, the waiting path a channel receive. No Redis call remains on that path at all.

Redis stays the default and is still the right choice for anything you'd call production — it is the only transport whose facts survive a restart, and the only one that can reach a second process.

One step toward HA

The Redis transport is now one stream per (audit route, type), fan-out, with every follower reading every entry from its own cursor. That is deliberately the shape multiple processes need: no consumer groups, because each replica needs the whole stream, not a share of it.

This is a step, not the destination — HA is not shipped, and memory is refused at startup with more than one replica precisely because it cannot cross a process boundary. But the attribution side is no longer the thing standing in the way.

The index is keyed by route first, which matters more than it looks: one index serves the whole process while streams are per (route, type), so a type-keyed index would pool two clusters' facts and could hand a watch event on cluster B an author from cluster A.

⚠ Breaking: placement no longer infers from your repository

A new document's path now comes only from what you declared, the folder's single kustomization root, or the built-in canonical path. It is never inferred from where the repository happens to keep the other documents of that type.

Sibling-cohort inference is gone. The reason is not primarily the bug it produced: inference let a human's edit to the repository change where the operator writes next, with no Kubernetes object changing and nothing in status recording the move. The bug is the evidence — a vacuous namespace guard let one namespace's object append into another's file, which legitimized the bundle for every later object, and collapsed a whole type into a single file. A rule inferred from mutable state has failure modes that feed themselves.

The kustomize-root fallback stays, because it is not inference: a file no kustomization can reach is never rendered, so placing a new document beside the folder's one root follows from there being one root. Two roots is still ambiguous and still declines.

If you relied on inference, declare the layout with spec.placement.byType / default. See UPGRADING.md.

⚠ Breaking: two smaller ones

• Attribution metric labels. exact_deletecollection_item is replaced by collection_uid and collection_scope, which carry different confidence: a UID the API server said it deleted, versus a match on namespace, selector and window alone. Dashboards selecting result=~"exact_.*|weak" should select result!="absent" instead, or they will read the collection tiers as misses.
• Analyzer refusal wording. A solvable render-root refusal no longer calls itself unsupported. Both strings are documented as unstable and nothing switches on them.

Also in this release

• Azure DevOps now works. ADO rejects any fetch whose capability list omits multi_ack, which go-git only implements from v6 — so ADO could not be fetched at all before. This moves to go-git v6 rather than bundling a system git binary, which measured at +723 MB of image and left the CRITICAL scan gate blind to git, OpenSSH and OpenSSL. Covered by a credential-free simulator in CI plus opt-in tests against a real tenant. (#297, guide)
• A write no longer overwrites the fact about a deletion, so an object edited by one person and deleted by another is credited to whoever deleted it. (#289)
• One encoder for the mirror, replacing two that could disagree. (#290)
• Design record for the fact stream. (#283)

Upgrading

Nothing to do unless you relied on placement inference, or your dashboards select attribution result labels by prefix. Both are covered above.

---

Full changelog

See CHANGELOG.md in this PR's diff for the generated entry.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-actions]

🤖 Created releases:

• v0.41.0

🌻