v0.38.0

0.38.0 (2026-09-07)

⚠ BREAKING CHANGES

• environments: an Environment serves no consumer until its owners say so, so every existing service claim stops resolving on upgrade — the claim goes Failed with the sentence that fixes it, and the consumers' workloads deploy without the binding's variables rather than failing. After upgrading, declare who may bind on each environment an offering is served from: kitchen api PATCH /environments/<name>/requirements --data '{"serves":["production"]}', adding "preview" and "stage" for the classes of consumer that environment is meant to answer. status.secretName on a service claim now names the first class that resolved rather than "the binding", and the claim's audit detail environment (a string) is now environments (a class-to-environment map).

Features

• environments: an environment declares who may bind, and service bindings stop until it does (#517) (b2c78c9), closes #494
• signals: correlation is a confidence ladder, and the thresholds are the operator's (#520) (92f5a3c)

Documentation

• agents: stop dispatching at 75% usage and checkpoint instead (#515) (d36857a)

Install

helm install kitchen oci://ghcr.io/bermos/charts/kitchen --version 0.38.0 \
  --namespace kitchen-system --create-namespace \
  --set kitchen.baseDomain=apps.example.com \
  --set kitchen.tls.acme.email=you@example.com \
  --set kitchen.tls.acme.dns01.cloudflare.apiTokenSecretName=cloudflare-api-token

The kitchen CLI is not published as a binary; it is built
from this tag by the Go toolchain:

go install github.com/Bermos/Kitchen/cmd/kitchen@v0.38.0

Artifacts

Artifact	Reference	Digest
Operator image	ghcr.io/bermos/kitchen:0.38.0	sha256:04aa855010e72d5ad76add189108b06aef7b099e1fdd64fe9923a9b5eb7c7f70
Auth image	ghcr.io/bermos/kitchen-auth:0.38.0	sha256:63c3ee85dc737a4271833c70b57ee21efb98b7b47007f80fd3de18c7511d950c
Chart	oci://ghcr.io/bermos/charts/kitchen:0.38.0	sha256:6bc831cfe7bba8c603b0730f8b617a51a8b0f1a0c453becdb508c8cd4a0e6592

Both images are linux/amd64 and linux/arm64 and carry a signed
build provenance attestation. The chart is attached below as well.