Reference · v0.0.1

v0.0.1 release notes

Customer-facing summary of the release candidate, supported evaluation scope and unresolved production evidence.

AudienceAll customers · change authoritiesReading time8 minutesCommands in context2 guided stepsReviewed sourcefcc5871 · 30 July 2026

Exact release scope. This page documents the reviewed v0.0.1 source at fcc5871. Check release status before enabling a gated capability.

Release identity

Field	Value
Documentation line	v0.0.1
Reviewed branch	release/v0.0.1
Reviewed commit	fcc5871aa1523315e2663265fbcc97cd9767a3f6
Review date	30 July 2026
Availability	Gated release candidate; not GA

Documentation sourcerelease/v0.0.1fcc5871Reviewed 30 July 2026

Implemented release scope

✓
Self-hosted control plane, durable OperationRuns, authorization, audit, evidence and recovery contracts
✓
Provider accounts and infrastructure planning; Hetzner and IONOS stable/production-gated, AWS and Azure disabled
✓
kubeadm cluster create, prepare, scale, one-minor upgrade, replace and delete behind gates
✓
Read-oriented Kubernetes operations behind phased flags
✓
Built-in/custom add-on planning, preflight and installation behind gates
✓
Sonobuoy conformance orchestration and evidence contracts
✓
Signed/digest-pinned self-hosted distribution and update governance contracts

Commands for this step

Stage the chart and package the governed release

Only the protected release workflow may create customer release artifacts. Customers consume the signed output rather than rebuilding it.

Protected workflowRun only on an approved maintainer, security, or release system.

PrivilegedPowerShell

Stage the governed Helm chart

Stage a chart bound to exact API/agent digests, SBOMs, provenance, compatibility, signing and conformance evidence.

Before you run it

All referenced artifacts verified
Exact image digests
Protected signing context
Approved candidate commit

PowerShell · release-stage-helm-chart

& ./scripts/stage-helm-chart.ps1 `
  -OutputPath ./artifacts/staged-chart `
  -ChartSourcePath ./charts/clusterpilot `
  -CompatibilityManifestPath ./artifacts/compatibility-manifest.json `
  -CompatibilitySignaturePath ./artifacts/compatibility-manifest.json.sig `
  -ReleaseMetadataSchemaPath ./schemas/v1/release-metadata-index.schema.json `
  -CompatibilitySchemaPath ./schemas/v1/compatibility-manifest.schema.json `
  -BackendImageDigest "sha256:<api-digest>" `
  -BackendSbomPath ./artifacts/sbom/api.cyclonedx.json `
  -BackendProvenancePath ./artifacts/provenance/api.intoto.jsonl `
  -AgentImageDigest "sha256:<agent-digest>" `
  -AgentSbomPath ./artifacts/sbom/agent.cyclonedx.json `
  -AgentProvenancePath ./artifacts/provenance/agent.intoto.jsonl `
  -OfficialRegistryHost ghcr.io `
  -OfficialRegistryNamespace <owner> `
  -SigningPrivateKeyPath "<protected-signing-private-key>" `
  -SigningPublicKeyPath ./release-signing-public-key.pem `
  -SigningKeyId "<release-signing-key-id>" `
  -ConformanceReleaseBundlePath ./artifacts/conformance/release-bundle.tar.gz `
  -CandidateCommitSha "<candidate-commit-sha>" `
  -ConformanceBundleCandidateCommitSha "<candidate-commit-sha>" `
  -ConformanceRequiredSupportState preprod-validated `
  -Configuration Release `
  -SkipBuild

Expected result

The staged chart contains immutable runtime identities and the complete governed evidence chain.

Reviewed sourcescripts/stage-helm-chart.ps1

PrivilegedPowerShell

Package the complete governed release

Create the customer release bundle, signed metadata and chart from verified candidate inputs.

Before you run it

Protected release runner
All exact-head protected gates green
Signed compatibility and conformance evidence
Approved release decision

PowerShell · release-package-artifacts

& ./scripts/package-release-artifacts.ps1 `
  -OutputPath ./artifacts/release `
  -ChartSourcePath ./charts/clusterpilot `
  -CompatibilityManifestPath ./artifacts/compatibility-manifest.json `
  -CompatibilitySignaturePath ./artifacts/compatibility-manifest.json.sig `
  -ReleaseMetadataSchemaPath ./schemas/v1/release-metadata-index.schema.json `
  -CompatibilitySchemaPath ./schemas/v1/compatibility-manifest.schema.json `
  -BackendImageDigest "sha256:<api-digest>" `
  -BackendSbomPath ./artifacts/sbom/api.cyclonedx.json `
  -BackendProvenancePath ./artifacts/provenance/api.intoto.jsonl `
  -AgentImageDigest "sha256:<agent-digest>" `
  -AgentSbomPath ./artifacts/sbom/agent.cyclonedx.json `
  -AgentProvenancePath ./artifacts/provenance/agent.intoto.jsonl `
  -OfficialRegistryHost ghcr.io `
  -OfficialRegistryNamespace <owner> `
  -ReleaseNotesPath ./docs/testing/release-v0.0.1-release-readiness-traceability.md `
  -SigningPrivateKeyPath "<protected-signing-private-key>" `
  -SigningPublicKeyPath ./release-signing-public-key.pem `
  -SigningKeyId "<release-signing-key-id>" `
  -ConformanceReleaseBundlePath ./artifacts/conformance/release-bundle.tar.gz `
  -CandidateCommitSha "<candidate-commit-sha>" `
  -ConformanceBundleCandidateCommitSha "<candidate-commit-sha>" `
  -ConformanceRequiredSupportState preprod-validated `
  -Configuration Release `
  -SkipBuild

Expected result

Canonical checksummed and signed customer artifacts are written to the governed output directory.

Stop conditions and operator notes

Only the protected release workflow may publish these artifacts.
Omit -SkipBuild when the governed job is responsible for producing binaries at the same exact commit.

Reviewed sourcescripts/package-release-artifacts.ps1

Not a v0.0.1 supported feature

Capability	Current boundary
Add-on upgrade / uninstall	Contract stubs only
Exec / port-forward	Contracts exist; built-in runtime does not execute
Generic Kubernetes mutation, RBAC admin, Secret write, Helm mutation	Disabled and startup-rejected
Brokered dashboard SSO	Preprod-only and disabled
General control-plane OIDC/SAML/SCIM	Not a broad supported v0.0.1 capability
Autonomous remediation	Not part of the operating model
Universal compliance or sovereignty certification	No such product claim

v0.0.1 release notes

Release identity

Implemented release scope

Not a v0.0.1 supported feature

Remaining release boundary