v0.8.1

Gate flags: none

Patch on 0.8.0 for kubernetes-inprocess: failed-apply cleanup and product
removal no longer delete objects the release does not own, including
PersistentVolumeClaims, and PodDisruptionBudget (policy/v1) is a supported
kind. Both fixes are backports from main.

Fixed

• fix(executor): delete only owned objects in in-process Kubernetes cleanup and removal (#1199, backport #1211 of #1206)
• fix(executor): apply PodDisruptionBudget in-process and refuse unsupported kinds before mutating (#1200, backport #1214 of #1208)

Upgrade

• Install 0.8.1 hosts from the GitHub Release after verifying SHA256SUMS and the attestation, or with install.sh. No store schema change and no migration. tenkaictl --version reports tenkaictl 0.8.1.
• Failed-apply cleanup (#1199): it deletes only objects the failed attempt created, which apply marks with the tenkai.created-by-attempt annotation. Objects carried over from the previous release or adopted by name stay for the restore. Cleanup never deletes a PersistentVolumeClaim or a Namespace, so a failed first install leaves its new claims behind, and the next install adopts them. Objects applied by 0.8.0 carry no mark, so a failed retry under 0.8.1 keeps them too.
• Removal (#1199): it deletes only objects whose tenkai.instance label (or tenkai.product, on objects applied before that label existed) names the instance being removed. Objects a successor took over by name stay. An object named in the release's manifests that has no Tenkai labels stays, and the removal fails naming it. Delete or label it by hand once nothing uses it, then let the next approved plan retry the removal.
• Supported kinds (#1200): PodDisruptionBudget (policy/v1) applies with server-side apply and is removed with the product. Apply now checks every object's kind and apiVersion before it applies the first one, and an unsupported object fails the step naming the manifest file and the object, with nothing applied. On this line the check runs at apply, not at plan time; plan-time refusal exists only on main.
• Rollback to 0.8.0: the previous binary plus the existing store. 0.8.0 ignores the tenkai.created-by-attempt annotation, refuses PodDisruptionBudget again, and deletes objects by kind and name again during failed-apply cleanup and removal.

v0.8.0

Gate flags: breaking, migration

Products run as named instances that depend on
each other through declared contracts (ADR 0043, ADR 0044). The environment
runtime runs the built-in executors, delivers sealed secrets (ADR 0045), and
issues and rotates workload certificates with peer grants from dependency
bindings (ADR 0046). Operators sign in through host identity on a Unix socket
(ADR 0047), unsubscribed instances are removed by an approved plan
(ADR 0049), and a channel head can be removed on its own. The server
serves web console
v0.3.1
at /ui/. The release candidate v0.8.0-rc.1 published its signed
hosts, SBOM and attestations. Since then only the sekai-keys dependency
moved to the sekai-chisei v2.0.0 tag, with identical code (#1189). Full operator
notes: docs/releases/0.8.0.md.

What's Changed

• chore(keys): pin sekai-keys to the sekai-chisei v2.0.0 tag (#1189)
• chore(release): prepare v0.8.0-rc.1 with console v0.3.1 (#1179)
• ci: retry apt installs on runner DNS failures (#1185)
• feat(catalog)!: remove a product's head from one channel (#1177)
• feat(catalog): promote returns the release digest and accepts an expected head (#1176)
• feat(http): operation results tolerate unknown fields so responses can grow (#1175)
• feat(identity)!: remove the replaced identity issuer once no workload depends on it (#1171)
• feat(identity)!: host trust bundles carry issuers an approved rotation plan proves (#1170)
• feat(identity)!: wait for every instance to take up the next issuer (#1169)
• feat(identity)!: add the next identity issuer to every trust bundle (#1168)
• feat(status)!: show workload certificates near expiry and report renewals (#1167)
• refactor(keys): ship the key-provider adapters and customer-key release as a library crate (#1166)
• feat(executor): renew restart-reload certificates with a rolling restart (#1165)
• feat(planner)!: peer grants from dependency bindings in the dependency document (#1164)
• feat(host-applier): renew host workload certificates without approval (#1163)
• feat(runtime): renew workload certificates on the runtime without approval (#1162)
• feat(executor): refuse identity plans in an environment without a separate runtime (#1161)
• refactor(apply)!: the catalog lease is the only environment execution claim (#1160)
• feat(executor)!: issue workload certificates at apply and deliver them to the target (#1159)
• refactor(reconcile)!: drop the reconcile tick fence (#1157)
• refactor(ha)!: spoke standby leases and receipts in the operational store (#1156)
• feat(executor)!: environment identity issuer created by an approved step (#1155)
• refactor(canary): fence promotion locks with the generic lease (#1150)
• docs(decisions): accept ADR 0046 workload identity and peer policy (#1154)
• feat(planner)!: remove unsubscribed instances of built-in executors by an approved plan (#1153)
• refactor(trust)!: one trust-roots type and one approval envelope for every signed format (#1152)
• feat(cli)!: remote apply returns per-step outcomes (#1149)
• feat(secrets)!: recover sealed values with an offline recovery key (#1148)
• feat(trust)!: a production profile refuses file signing keys (#1147)
• docs(adr): secrets generated by the runtime on first install (ADR 0050) (#1145)
• fix(executor): runtime completions write the environment under its lease (#1144)
• docs(adr): remove instances of built-in executors by an approved plan (ADR 0049) (#1143)
• feat(trust): a hardware signing key per artifact family (#1142)
• refactor(trust)!: route every signing site through ContentSigner, one key per family (#1141)
• feat(executor)!: approved re-wrap of sealed values for new runtimes (#1140)
• feat(runtime): open sealed values with a hardware-backed sealing key (#1134)
• feat(runtime)!: run host removal steps on a built-in runtime (#1133)
• feat(executor)!: write sealed secrets to host targets through the runtime's applier (#1131)
• feat(runtime)!: run host releases through the runtime's local applier (#1129)
• feat(runtime)!: write sealed secrets to helm targets from the environment runtime (#1126)
• feat(runtime)!: run the built-in executors in the environment runtime (#1124)
• docs(adr): the environment runtime runs the built-in executors (#1120)
• feat(executor)!: record a structured cause for failed and rolled back attempts (#1118)
• refactor: route single-file state writes through atomic_state (#1117)
• feat(cli)!: set, list and delete sealed secrets and plan their changes (#1116)
• feat(cli)!: show deployment attempt history with failure detail (#1115)
• feat(executor)!: report out-of-band target changes as drift without acting (#1114)
• feat(catalog)!: admit overlays against a signed release config schema (#1113)
• feat(ops)!: support bundle carries workload state for in-cluster releases (#1107)
• feat(feedback)!: post captured observations to opt-in webhooks (#1106)
• contract(feedback)!: publish observation schema and evidence type (#1105)
• contract(feedback)!: export operation_id, observed_at_ms, and scope (#1104)
• feat(executor)!: verify sealed steps against a runtime-local approval policy (#1103)
• feat(executor)!: runtime sealing keys and client recipient pins (#1099)
• feat(planner)!: bind a dependent instance to one provider of a shared contract (#1098)
• docs(decisions): close renewal, issuer and server-host gaps in ADR 0046 (#1069)
• docs(decisions): accept ADR 0043 and ADR 0044 (#1056)
• docs(decisions): accept ADR 0045 sealed secrets (#1053)
• docs(decisions): harden ADR 0045 against a compromised server (#1046)
• feat(executor)!: derive deploy names from the product instance (#1045)
• feat(planner)!: key an environment's deployed releases by instance (#1044)
• feat(cli): allow a hosts-only bundle for self-upgrade (#1043)
• feat(catalog): refuse a train whose members do not satisfy each other's requirements (#1042)
• feat(cli): show dependency holds and providers in status (#1041)
• feat(executor): dependency document for dependents, re-rendered when providers change (#1040)
• feat(planner): refuse plans that leave an installed dependent unsatisfied (#1039)
• feat(planner): hold unmet required contracts on reconcile (#1038)
• feat(planner): order plans by declared contract dependencies (#1037)
• feat(planner): satisfy requirements from deployed releases (#1036)
• feat(ops)!: host identity on a Unix socket (#1035)
• feat(catalog): compatibility profile v2 with optional requirements and 0.y matching (#1033)
• docs(decisions): ADR 0047 host identity as the default operator sign-in (#1032)
• feat(ops): qualify hub HA with a two-replica drill (#1030)
• docs(release): family releases dispatch from main and cut -rc.N first (#1029)
• ci(release): dispatch binaries from main and accept -rc.N (#1027)
• docs(decisions): ADR 0046 workload identity and peer policy from dependency bindings (#1024)
• perf(apply): skip 2h lease heartbeats and prune catalog history (#1026)
• docs(decisions): ADR 0045 sealed secrets delivered by the environment runtime (#1021)
• perf(catalog): migrate each PG tenant schema once per stamp (#1022)
• fix(cli)!: send declared deploy inputs with remote publish (#1018)
• docs(decisions): ADR 0043 product dependencies and ADR 0044 instances and bindings (#1012)
• feat(cli): load client config so a server host finds its server (#1002)
• chore: expose shared agent skills to Claude Code (#1001)

Upgrade

• Web console: ui/console.pin moves from v0.2.0 to v0.3.1. The console reads the new instance, drift, history, identity and apply-step fields when the server returns them, and still requires tenkai.http.v1 on /healthz.
• Install 0.8.0 hosts from the GitHub Release after verifying SHA256SUMS and the attestation, or with install.sh. tenkaictl --version reports tenkaictl 0.8.0. Upgrade every server, runtime and host applier before using any new manifest, step or secret feature below; older binaries refuse those shapes and fail closed.
• Store migration (#1044): the SQLite operational store moves from schema 13 to 14, keyed by instance. The first 0.8.0 start writes a verified pre-migration copy beside the store, or refuses to start. Older binaries refuse the migrated store. Postgres hubs run additive tenant DDL (stamp 3, #1099) once per tenant schema.
• Instances (#1044, #1045): existing records stay the default instance of their product. env subscribe --instance and HTTP instance are optional and default to the product. Unlabeled pre-upgrade objects belong to the default instance.
• Unsubscribe (#1153): env unsubscribe needs --version (expected_version) while a release is recorded for the instance, and the next approved plan removes a non-host instance. Helm removals need Helm 3.13 or later.
• Manifests: declare [deploy.identity] (#1159) or [config] (#1113) only after every server and runtime runs 0.8.0. Older servers refuse them.
• Sealed secrets (#1099, #1103, #1116, #1131, #1148): set TENKAI_RUNTIME_APPROVAL_POLICY on each runtime before the first tenkaictl secret set, and set the first sealed value only after every server is upgraded. Host targets need the applier spool on tmpfs and swap off or encrypted.
• Workload identity (#1155, #1159, #1164, #1168 to #1171): the server sends issuer, rotation and peer-grant plans only to runtimes that advertise the matching capability; older runtimes stay idle on them. After upgrade the first plan re-renders certificate holders once. Until it runs, rollbacks and restarts of a caller of a certified provider are refused.
• Host identity (#1035): install writes host-grants.toml, creates the tenkai-viewer, tenkai-operator and tenkai-admin groups and the /run/tenkai socket directory. TCP still requires a bearer or assertion.
• Spoke standby (#1156): tenkaictl spoke-standby promote takes --environment, --state is the restored SQLite store, a...

v0.8.0-rc.1

Gate flags: breaking, migration

Release candidate for 0.8.0. Products run as named instances that depend on
each other through declared contracts (ADR 0043, ADR 0044). The environment
runtime runs the built-in executors, delivers sealed secrets (ADR 0045), and
issues and rotates workload certificates with peer grants from dependency
bindings (ADR 0046). Operators sign in through host identity on a Unix socket
(ADR 0047), unsubscribed instances are removed by an approved plan
(ADR 0049), and a channel head can be removed on its own. The server
serves web console
v0.3.1
at /ui/. Full operator
notes: docs/releases/0.8.0.md.

What's Changed

• ci: retry apt installs on runner DNS failures (#1185)
• feat(catalog)!: remove a product's head from one channel (#1177)
• feat(catalog): promote returns the release digest and accepts an expected head (#1176)
• feat(http): operation results tolerate unknown fields so responses can grow (#1175)
• feat(identity)!: remove the replaced identity issuer once no workload depends on it (#1171)
• feat(identity)!: host trust bundles carry issuers an approved rotation plan proves (#1170)
• feat(identity)!: wait for every instance to take up the next issuer (#1169)
• feat(identity)!: add the next identity issuer to every trust bundle (#1168)
• feat(status)!: show workload certificates near expiry and report renewals (#1167)
• refactor(keys): ship the key-provider adapters and customer-key release as a library crate (#1166)
• feat(executor): renew restart-reload certificates with a rolling restart (#1165)
• feat(planner)!: peer grants from dependency bindings in the dependency document (#1164)
• feat(host-applier): renew host workload certificates without approval (#1163)
• feat(runtime): renew workload certificates on the runtime without approval (#1162)
• feat(executor): refuse identity plans in an environment without a separate runtime (#1161)
• refactor(apply)!: the catalog lease is the only environment execution claim (#1160)
• feat(executor)!: issue workload certificates at apply and deliver them to the target (#1159)
• refactor(reconcile)!: drop the reconcile tick fence (#1157)
• refactor(ha)!: spoke standby leases and receipts in the operational store (#1156)
• feat(executor)!: environment identity issuer created by an approved step (#1155)
• refactor(canary): fence promotion locks with the generic lease (#1150)
• docs(decisions): accept ADR 0046 workload identity and peer policy (#1154)
• feat(planner)!: remove unsubscribed instances of built-in executors by an approved plan (#1153)
• refactor(trust)!: one trust-roots type and one approval envelope for every signed format (#1152)
• feat(cli)!: remote apply returns per-step outcomes (#1149)
• feat(secrets)!: recover sealed values with an offline recovery key (#1148)
• feat(trust)!: a production profile refuses file signing keys (#1147)
• docs(adr): secrets generated by the runtime on first install (ADR 0050) (#1145)
• fix(executor): runtime completions write the environment under its lease (#1144)
• docs(adr): remove instances of built-in executors by an approved plan (ADR 0049) (#1143)
• feat(trust): a hardware signing key per artifact family (#1142)
• refactor(trust)!: route every signing site through ContentSigner, one key per family (#1141)
• feat(executor)!: approved re-wrap of sealed values for new runtimes (#1140)
• feat(runtime): open sealed values with a hardware-backed sealing key (#1134)
• feat(runtime)!: run host removal steps on a built-in runtime (#1133)
• feat(executor)!: write sealed secrets to host targets through the runtime's applier (#1131)
• feat(runtime)!: run host releases through the runtime's local applier (#1129)
• feat(runtime)!: write sealed secrets to helm targets from the environment runtime (#1126)
• feat(runtime)!: run the built-in executors in the environment runtime (#1124)
• docs(adr): the environment runtime runs the built-in executors (#1120)
• feat(executor)!: record a structured cause for failed and rolled back attempts (#1118)
• refactor: route single-file state writes through atomic_state (#1117)
• feat(cli)!: set, list and delete sealed secrets and plan their changes (#1116)
• feat(cli)!: show deployment attempt history with failure detail (#1115)
• feat(executor)!: report out-of-band target changes as drift without acting (#1114)
• feat(catalog)!: admit overlays against a signed release config schema (#1113)
• feat(ops)!: support bundle carries workload state for in-cluster releases (#1107)
• feat(feedback)!: post captured observations to opt-in webhooks (#1106)
• contract(feedback)!: publish observation schema and evidence type (#1105)
• contract(feedback)!: export operation_id, observed_at_ms, and scope (#1104)
• feat(executor)!: verify sealed steps against a runtime-local approval policy (#1103)
• feat(executor)!: runtime sealing keys and client recipient pins (#1099)
• feat(planner)!: bind a dependent instance to one provider of a shared contract (#1098)
• docs(decisions): close renewal, issuer and server-host gaps in ADR 0046 (#1069)
• docs(decisions): accept ADR 0043 and ADR 0044 (#1056)
• docs(decisions): accept ADR 0045 sealed secrets (#1053)
• docs(decisions): harden ADR 0045 against a compromised server (#1046)
• feat(executor)!: derive deploy names from the product instance (#1045)
• feat(planner)!: key an environment's deployed releases by instance (#1044)
• feat(cli): allow a hosts-only bundle for self-upgrade (#1043)
• feat(catalog): refuse a train whose members do not satisfy each other's requirements (#1042)
• feat(cli): show dependency holds and providers in status (#1041)
• feat(executor): dependency document for dependents, re-rendered when providers change (#1040)
• feat(planner): refuse plans that leave an installed dependent unsatisfied (#1039)
• feat(planner): hold unmet required contracts on reconcile (#1038)
• feat(planner): order plans by declared contract dependencies (#1037)
• feat(planner): satisfy requirements from deployed releases (#1036)
• feat(ops)!: host identity on a Unix socket (#1035)
• feat(catalog): compatibility profile v2 with optional requirements and 0.y matching (#1033)
• docs(decisions): ADR 0047 host identity as the default operator sign-in (#1032)
• feat(ops): qualify hub HA with a two-replica drill (#1030)
• docs(release): family releases dispatch from main and cut -rc.N first (#1029)
• ci(release): dispatch binaries from main and accept -rc.N (#1027)
• docs(decisions): ADR 0046 workload identity and peer policy from dependency bindings (#1024)
• perf(apply): skip 2h lease heartbeats and prune catalog history (#1026)
• docs(decisions): ADR 0045 sealed secrets delivered by the environment runtime (#1021)
• perf(catalog): migrate each PG tenant schema once per stamp (#1022)
• fix(cli)!: send declared deploy inputs with remote publish (#1018)
• docs(decisions): ADR 0043 product dependencies and ADR 0044 instances and bindings (#1012)
• feat(cli): load client config so a server host finds its server (#1002)
• chore: expose shared agent skills to Claude Code (#1001)

Upgrade

• Web console: ui/console.pin moves from v0.2.0 to v0.3.1. The console reads the new instance, drift, history, identity and apply-step fields when the server returns them, and still requires tenkai.http.v1 on /healthz.
• Install 0.8.0-rc.1 hosts from the GitHub pre-release after verifying SHA256SUMS and the attestation, or with install.sh. tenkaictl --version reports tenkaictl 0.8.0-rc.1. Upgrade every server, runtime and host applier before using any new manifest, step or secret feature below; older binaries refuse those shapes and fail closed.
• Store migration (#1044): the SQLite operational store moves from schema 13 to 14, keyed by instance. The first 0.8.0 start writes a verified pre-migration copy beside the store, or refuses to start. Older binaries refuse the migrated store. Postgres hubs run additive tenant DDL (stamp 3, #1099) once per tenant schema.
• Instances (#1044, #1045): existing records stay the default instance of their product. env subscribe --instance and HTTP instance are optional and default to the product. Unlabeled pre-upgrade objects belong to the default instance.
• Unsubscribe (#1153): env unsubscribe needs --version (expected_version) while a release is recorded for the instance, and the next approved plan removes a non-host instance. Helm removals need Helm 3.13 or later.
• Manifests: declare [deploy.identity] (#1159) or [config] (#1113) only after every server and runtime runs 0.8.0. Older servers refuse them.
• Sealed secrets (#1099, #1103, #1116, #1131, #1148): set TENKAI_RUNTIME_APPROVAL_POLICY on each runtime before the first tenkaictl secret set, and set the first sealed value only after every server is upgraded. Host targets need the applier spool on tmpfs and swap off or encrypted.
• Workload identity (#1155, #1159, #1164, #1168 to #1171): the server sends issuer, rotation and peer-grant plans only to runtimes that advertise the matching capability; older runtimes stay idle on them. After upgrade the first plan re-renders certificate holders once. Until it runs, rollbacks and restarts of a caller of a certified provider are refused.
• Host identity (#1035): install writes host-grants.toml, creates the tenkai-viewer, tenkai-operator and tenkai-admin groups and the /run/tenkai socket directory. TCP still requires a bearer or assertion.
• Spoke standby (#1156): tenkaictl spoke-standby promote takes --environment, --state is the restored SQLite store, and every member passes the same --lease-dir. spoke-standby.json is no longer read.
• Reconcile fence (#1157): replicas no longer use tenkai_reconcile_tick_claims. Drop the table once every replica runs 0.8.0.
• Feedback (#1104 to #1106): TENKAI_FEEDBACK_PROVIDER_REGISTRATION mus...

v0.7.1

Gate flags: none

Patch on 0.7.0: kubernetes-inprocess waits renew the apply lease, wait for
the applied revision, and keep diagnosed causes if the lease is lost.
Unknown TENKAI_SOFTWARE_EXECUTOR refuses at start. Full operator notes:
docs/releases/0.7.1.md.

What's Changed

• fix(executor): keep diagnosed causes when an in-process wait loses the apply lease (#999)
• fix(executor): refuse unknown TENKAI_SOFTWARE_EXECUTOR instead of falling back to shell (#998)
• fix(executor): wait for the applied kubernetes revision, not merely Available (#996)
• fix(executor): renew the apply lease during in-process waits and name the workload failure cause (#986)
• fix(examples): keep the service load balancer and local-path storage in the reference cluster (#984)

Upgrade

• Install 0.7.1 hosts from the GitHub Release after verifying SHA256SUMS and the attestation, or with install.sh. The SQLite schema stays 13; no store migration. tenkaictl --version reports tenkaictl 0.7.1.
• kubernetes-inprocess (#986, #996, #999): a wait longer than the apply lease TTL keeps the lease. An upgrade waits until the applied revision is the one serving, not merely Available on leftover pods. If the lease is still lost, the error names the last workload causes first. Diagnosis of ReplicaSets and pods needs list in the environment namespace; without it the wait continues on conditions and names the read error.
• TENKAI_SOFTWARE_EXECUTOR (#998): an unknown or uninstalled value refuses tenkai-server and embedded hosts at start instead of running undeclared releases as shell. Unset (or shell) remains the process default. /readyz advertises software_executor:<kind> for the default that actually runs.
• Reference cluster example (#984): the bundled k3s unit keeps the service load balancer and local-path storage. An operator who already installed that product publishes a newer version and applies it as an upgrade.
• Rollback to 0.7.0: the previous binary plus the existing store. No schema change. 0.7.0 ignores failed_target_error.<product> and still treats an unknown TENKAI_SOFTWARE_EXECUTOR as shell. A 0.7.0 host can report an in-process upgrade complete while old pods keep the Deployment Available.

v0.7.0

Gate flags: breaking, migration

One Tenkai on a bare host. Tenkai installs a single-node cluster as a
privileged host release and delivers releases into it from one control
plane, with the server never running as root (ADR 0041). The release
candidate v0.7.0-rc.1 passed the bare-host drill on its published binaries.
Full operator notes: docs/releases/0.7.0.md.

What's Changed

• chore(release): prepare v0.7.0-rc.1 (#980)
• feat(ops): bare host to cluster to in-cluster release with one Tenkai (#979)
• feat(executor)!: uninstall a host release through an approved plan (#973)
• fix(host): keep CAP_SETUID in the host applier's permitted set (#975)
• feat(executor)!: host executor runs install and health steps through the root-side applier (#970)
• fix(executor): an unavailable executor target leaves the deployment as it was (#972)
• fix(tenkaictl): print the schema type count on init, not every name (#964)
• docs: make the README a five-minute front door (#961)
• feat(release): ship tenkai-host-applier with the Linux release hosts (#965)
• test(connectivity): name the error when a staged bundle import errors (#966)
• feat(host): tenkai-host-applier binary, systemd unit, and polkit rule (#948)
• feat(host): durable applied-state record and generation critical section (#941)
• feat(host): host apply request format and root-side verification (#937)
• fix(providers)!: scope tenant-mode feedback targets under tenkai.feedback_export.v2 (#959)
• test(postgres): give every live test unique tenant and environment names (#957)
• fix(catalog): settle a just-released file lock before refusing as held (#955)
• fix(providers): capture feedback observations in tenant-mode catalog partitions (#954)
• fix(auth): report a committed grant-rule change as done, and fail closed when unsure (#952)
• fix(providers)!: move terminal outcomes to tenkai.terminal_outcome.v2 with tenant-scoped targets (#944)
• fix(catalog)!: sign recall notices and topology drills over the bytes sent (#951)
• test(worker-pool): poll the live fixture instead of sleeping a fixed 80 ms (#950)
• fix(providers): mark a feedback observation delivered only when admitted (#946)
• fix(auth): read stored grant rules one row at a time (#936)
• feat(apply)!: resolve the software executor per release (#938)
• fix(catalog): index a prefix of PostgreSQL property values so large plans store (#942)
• fix(criticality)!: sign derived criticality over the bytes the producer sent (#933)
• fix(postgres): live lease tests do not wait on the runner's disk at commit (#939)
• feat(storage): take a verified pre-migration copy of the SQLite store (#927)
• fix(executor)!: sign runner attestations over the bytes sent and name accepted schemas (#929)
• feat(ops): install Tenkai hosts with one verified command (#928)
• fix(release): stop the Linux host build failing on SIGPIPE from ldd (#930)
• fix(trust): check signer windows at an artifact's signed time (#925)
• feat(manifest): signed deploy.executor field (#922)
• fix(auth): stored grant rules only add to what the grant file grants (#924)
• ci(release): accept signed vX.Y.Z-rc.N tags and publish them as pre-releases (#923)
• fix(release): build Linux hosts at a glibc 2.28 floor and refuse newer (#921)
• docs(capabilities): list server self-upgrade and release binaries as shipped (#918)
• docs(release): complete the 0.6.0 upgrade notes (#919)
• docs(adr): per-release software executor and privileged host releases (#908)
• ci(release): signed-tag verification, SBOM, family release manifest, notes from CHANGELOG (#897)

Upgrade

• Signed statements (#929, #933, #951): runner attestations, derived criticality, recall notices and topology drills move to .v2 schemas signed over the bytes sent. .v1 is still verified and never produced. Upgrade every server and tenkaictl that imports derived criticality, recall notices or drill evidence before switching producers to .v2; releases before 0.7.0 refuse .v2 as malformed. Runner agents and servers upgrade in either order. Re-sign .v1 derived criticality before tenkaictl bundle build.
• Outcome export (#944): register tenkai.terminal_outcome.v2@2.0.0 from api/tenkai-terminal-outcome-v2.schema.json (keep .v1; tenant-mode hubs also add target kind tenkai.tenant_deployment), then upgrade with TENKAI_OUTCOME_PROVIDER_REGISTRATION naming .v2. A host whose registration still attests .v1@1.0.0 refuses to start. Remove the .v1 registration once no older replica runs and nothing queued before the upgrade is undelivered.
• Tenant-mode feedback export (#959): add target kind tenant_feedback_observation (keep feedback_observation), then upgrade with TENKAI_FEEDBACK_PROVIDER_REGISTRATION using target_kind=tenant_feedback_observation. Rows queued before the upgrade keep their old target. Community hosts are unchanged.
• Per-release executor (#922, #938): declare [deploy] executor only after every server and runtime that reads the catalog runs 0.7.0. Moving a product to another executor is a remove followed by an install. On a server that sets TENKAI_SOFTWARE_EXECUTOR, management API apply now uses it for undeclared releases, like the reconciler.
• Host releases (#937, #941, #948, #965, #970, #973, #975): hosts without executor = "host" releases need no change. To use them, install the applier with install.sh --role server --with-host-applier, add the root-owned trust roots and host approval policy in /etc/tenkai, and set TENKAI_HOST_SPOOL_DIR. Host steps are never auto-approved. A 0.6.0 server refuses plans with host or remove steps.
• In-cluster releases (#972): env cluster-config set accepts a path whose file does not exist yet; a release with a missing cluster config is refused before it changes anything and converges once the file appears.
• Signer windows (#925, ADR 0042): stored artifacts are checked at their signed time, so not_after on a rotated key no longer breaks what it already signed. Live admissions still check at now. Older binaries in a rolling deploy still check at their own clock (they refuse more, never accept more).
• Stored grant rules (#924, #936, #952): a stored rule only adds to what the grant file grants. An unreadable or invalid row is withheld and reported (stored_grant_rules_withheld on /healthz). A write whose outcome is unknown is audited grant_rule.*.failed (was refused) and makes that replica not ready until it reads again; alerts on *.refused should also match *.failed. Do not write a later rule format until every replica runs 0.7.0.
• SQLite (#927): the first start that migrates an older schema writes <db>.pre-v<found>.<ms>.<id>.db beside the store; it needs free space about the store's size, or the start is refused with the store untouched. The schema stays 13, so a 0.6.0 store opens without migration.
• Hub PostgreSQL (#942, migration): the first use of each tenant schema rebuilds catalog_object_properties_lookup on a 256-character value prefix. Writes to that tenant's catalog properties wait for it. Rolling deploys and rollback stay correct.
• Linux hosts (#921): glibc 2.28+ on x86-64 (0.6.0 needed 2.39). Musl is not supported.
• Rollback to 0.6.0: the SQLite schema is unchanged, so the store opens without a restore. Restore the 0.6.0 values of TENKAI_OUTCOME_PROVIDER_REGISTRATION and, on tenant-mode hubs, TENKAI_FEEDBACK_PROVIDER_REGISTRATION first; 0.6.0 refuses to start with the 0.7.0 values. 0.6.0 refuses .v2 signed statements, manifests that declare [deploy] executor, and plans with host or remove steps.
• Rust library API (breaking): ExecutionOptions.software_executors replaces software_executor; DeploySection.executor, plan::Step.host and plan::Action::Remove are new; grant-rule store types, CatalogGraph observation writes and runner attestation signing changed. See the pull requests for exact signatures.

v0.7.0-rc.1

Gate flags: breaking, migration

Release candidate for 0.7.0: one Tenkai on a bare host. Tenkai installs a
single-node cluster as a privileged host release and delivers releases into
it from one control plane, with the server never running as root (ADR 0041).
Full operator notes: docs/releases/0.7.0.md.

What's Changed

• feat(ops): bare host to cluster to in-cluster release with one Tenkai (#979)
• feat(executor)!: uninstall a host release through an approved plan (#973)
• fix(host): keep CAP_SETUID in the host applier's permitted set (#975)
• feat(executor)!: host executor runs install and health steps through the root-side applier (#970)
• fix(executor): an unavailable executor target leaves the deployment as it was (#972)
• fix(tenkaictl): print the schema type count on init, not every name (#964)
• docs: make the README a five-minute front door (#961)
• feat(release): ship tenkai-host-applier with the Linux release hosts (#965)
• test(connectivity): name the error when a staged bundle import errors (#966)
• feat(host): tenkai-host-applier binary, systemd unit, and polkit rule (#948)
• feat(host): durable applied-state record and generation critical section (#941)
• feat(host): host apply request format and root-side verification (#937)
• fix(providers)!: scope tenant-mode feedback targets under tenkai.feedback_export.v2 (#959)
• test(postgres): give every live test unique tenant and environment names (#957)
• fix(catalog): settle a just-released file lock before refusing as held (#955)
• fix(providers): capture feedback observations in tenant-mode catalog partitions (#954)
• fix(auth): report a committed grant-rule change as done, and fail closed when unsure (#952)
• fix(providers)!: move terminal outcomes to tenkai.terminal_outcome.v2 with tenant-scoped targets (#944)
• fix(catalog)!: sign recall notices and topology drills over the bytes sent (#951)
• test(worker-pool): poll the live fixture instead of sleeping a fixed 80 ms (#950)
• fix(providers): mark a feedback observation delivered only when admitted (#946)
• fix(auth): read stored grant rules one row at a time (#936)
• feat(apply)!: resolve the software executor per release (#938)
• fix(catalog): index a prefix of PostgreSQL property values so large plans store (#942)
• fix(criticality)!: sign derived criticality over the bytes the producer sent (#933)
• fix(postgres): live lease tests do not wait on the runner's disk at commit (#939)
• feat(storage): take a verified pre-migration copy of the SQLite store (#927)
• fix(executor)!: sign runner attestations over the bytes sent and name accepted schemas (#929)
• feat(ops): install Tenkai hosts with one verified command (#928)
• fix(release): stop the Linux host build failing on SIGPIPE from ldd (#930)
• fix(trust): check signer windows at an artifact's signed time (#925)
• feat(manifest): signed deploy.executor field (#922)
• fix(auth): stored grant rules only add to what the grant file grants (#924)
• ci(release): accept signed vX.Y.Z-rc.N tags and publish them as pre-releases (#923)
• fix(release): build Linux hosts at a glibc 2.28 floor and refuse newer (#921)
• docs(capabilities): list server self-upgrade and release binaries as shipped (#918)
• docs(release): complete the 0.6.0 upgrade notes (#919)
• docs(adr): per-release software executor and privileged host releases (#908)
• ci(release): signed-tag verification, SBOM, family release manifest, notes from CHANGELOG (#897)

Upgrade

• Signed statements (#929, #933, #951): runner attestations, derived criticality, recall notices and topology drills move to .v2 schemas signed over the bytes sent. .v1 is still verified and never produced. Upgrade every server and tenkaictl that imports derived criticality, recall notices or drill evidence before switching producers to .v2; releases before 0.7.0 refuse .v2 as malformed. Runner agents and servers upgrade in either order. Re-sign .v1 derived criticality before tenkaictl bundle build.
• Outcome export (#944): register tenkai.terminal_outcome.v2@2.0.0 from api/tenkai-terminal-outcome-v2.schema.json (keep .v1; tenant-mode hubs also add target kind tenkai.tenant_deployment), then upgrade with TENKAI_OUTCOME_PROVIDER_REGISTRATION naming .v2. A host whose registration still attests .v1@1.0.0 refuses to start. Remove the .v1 registration once no older replica runs and nothing queued before the upgrade is undelivered.
• Tenant-mode feedback export (#959): add target kind tenant_feedback_observation (keep feedback_observation), then upgrade with TENKAI_FEEDBACK_PROVIDER_REGISTRATION using target_kind=tenant_feedback_observation. Rows queued before the upgrade keep their old target. Community hosts are unchanged.
• Per-release executor (#922, #938): declare [deploy] executor only after every server and runtime that reads the catalog runs 0.7.0. Moving a product to another executor is a remove followed by an install. On a server that sets TENKAI_SOFTWARE_EXECUTOR, management API apply now uses it for undeclared releases, like the reconciler.
• Host releases (#937, #941, #948, #965, #970, #973, #975): hosts without executor = "host" releases need no change. To use them, install the applier with install.sh --role server --with-host-applier, add the root-owned trust roots and host approval policy in /etc/tenkai, and set TENKAI_HOST_SPOOL_DIR. Host steps are never auto-approved. A 0.6.0 server refuses plans with host or remove steps.
• In-cluster releases (#972): env cluster-config set accepts a path whose file does not exist yet; a release with a missing cluster config is refused before it changes anything and converges once the file appears.
• Signer windows (#925, ADR 0042): stored artifacts are checked at their signed time, so not_after on a rotated key no longer breaks what it already signed. Live admissions still check at now. Older binaries in a rolling deploy still check at their own clock (they refuse more, never accept more).
• Stored grant rules (#924, #936, #952): a stored rule only adds to what the grant file grants. An unreadable or invalid row is withheld and reported (stored_grant_rules_withheld on /healthz). A write whose outcome is unknown is audited grant_rule.*.failed (was refused) and makes that replica not ready until it reads again; alerts on *.refused should also match *.failed. Do not write a later rule format until every replica runs 0.7.0.
• SQLite (#927): the first start that migrates an older schema writes <db>.pre-v<found>.<ms>.<id>.db beside the store; it needs free space about the store's size, or the start is refused with the store untouched. The schema stays 13, so a 0.6.0 store opens without migration.
• Hub PostgreSQL (#942, migration): the first use of each tenant schema rebuilds catalog_object_properties_lookup on a 256-character value prefix. Writes to that tenant's catalog properties wait for it. Rolling deploys and rollback stay correct.
• Linux hosts (#921): glibc 2.28+ on x86-64 (0.6.0 needed 2.39). Musl is not supported.
• Rollback to 0.6.0: the SQLite schema is unchanged, so the store opens without a restore. Restore the 0.6.0 values of TENKAI_OUTCOME_PROVIDER_REGISTRATION and, on tenant-mode hubs, TENKAI_FEEDBACK_PROVIDER_REGISTRATION first; 0.6.0 refuses to start with the 0.7.0 values. 0.6.0 refuses .v2 signed statements, manifests that declare [deploy] executor, and plans with host or remove steps.
• Rust library API (breaking): ExecutionOptions.software_executors replaces software_executor; DeploySection.executor, plan::Step.host and plan::Action::Remove are new; grant-rule store types, CatalogGraph observation writes and runner attestation signing changed. See the pull requests for exact signatures.

v0.6.0

What's Changed

• feat(auth): accept platform JWT and OIDC tokens in one process by @Sannrox in #595
• feat(planner): fit model_runtime variants to accelerator facts by @Sannrox in #598
• feat(executor): fetch model weights from hf:// and oci:// into the verified cache by @Sannrox in #599
• feat(executor): vLLM model_runtime executor on the in-process Kubernetes path by @Sannrox in #606
• feat(executor): select model_runtime executors by engine and run them under the executor guard by @Sannrox in #612
• test(executor): add ignored GPU coverage and docs for vLLM by @Sannrox in #613
• docs(executor): compare TGI, NIM, and MLX against the runtime contract by @Sannrox in #617
• feat(model): define two-way model-release evidence schema by @Sannrox in #618
• feat(model): export signed model-runtime evidence through the outbox by @Sannrox in #619
• feat(catalog): require passing eval evidence to promote model_runtime by @Sannrox in #620
• feat(apply): evaluate post-apply SLO health gates by @Sannrox in #621
• feat: notify after apply with signed webhooks by @Sannrox in #622
• feat(ops): carry model-scale weights in a signed companion chunk store by @Sannrox in #624
• feat(ops): first-install a dark site from one signed offline bundle by @Sannrox in #625
• feat(ops): add rollout-time benchmarks with a CI regression gate by @Sannrox in #653
• feat(api): expose delivery hold set, release, and retry over HTTP by @Sannrox in #654
• feat(api): list releases, channels and migrations by @Sannrox in #656
• feat(api): add a resumable change-event stream by @Sannrox in #655
• feat(api): expose the environment approval policy over HTTP by @Sannrox in #657
• feat(api): read observed Docker and model runtime state by @Sannrox in #658
• perf(executor): shorten in-process Kubernetes readiness polling by @Sannrox in #659
• feat(auth): refuse agent-initiated mutations named in the act claim by @Sannrox in #660
• feat(ops): host preflight recorded as signed evidence by @Sannrox in #661
• feat(trust): signed offline key revocation and rollover procedure by @Sannrox in #662
• feat(ops): on-site key-provider profile and key ceremony by @Sannrox in #666
• feat(ops): PKCS#11 HSM key-provider adapter by @Sannrox in #667
• feat(ops): KMIP key-provider adapter by @Sannrox in #668
• feat(ops): distribute customer keys as releases by @Sannrox in #670
• chore: smaller dev builds by @Sannrox in #697
• docs: add a release-owned changelog by @Sannrox in #700
• feat(planner): declare replica topologies and refuse placement that violates anti-affinity by @Sannrox in #701
• feat(model-runtime): refuse hf:// origin in isolated environments without a mirror by @Sannrox in #702
• feat(api): register environments and edit their configuration over HTTP by @Sannrox in #704
• feat(ops): scheduled server-mode backup with status and restore drill by @Sannrox in #706
• ci: cancel a pull request's superseded runs by @Sannrox in #708
• docs: land with pinned auto-merge and classify CI failures instead of rerunning by @Sannrox in #710
• fix(deps): patch the rustls-webpki, webpki-roots and ctutils advisories by @Sannrox in #712
• feat(ops): stage, verify and import offline bundles through the server, with a content inventory by @Sannrox in #715
• feat(config): custom CA bundle for all outbound TLS clients by @Sannrox in #716
• docs(auth): first administrator grant, with a startup check by @Sannrox in #717
• docs: one-way transfer guide for offline bundles by @Sannrox in #718
• feat(ops): clock-drift guard for signatures, leases and approvals by @Sannrox in #719
• feat(ops): import hook for an external content scanner before unpack by @Sannrox in #720
• feat(ops): scheduled signed audit export by @Sannrox in #721
• feat(ops): Tenkai-only redacted support bundle export by @Sannrox in #722
• test: isolated-network conformance for install, deploy, upgrade and rollback by @Sannrox in #723
• feat(ops): operational event kinds for signed webhooks, with delivery status by @Sannrox in #726
• feat(config): read secret settings from owner-only files or a secret directory by @Sannrox in #729
• feat(ops): SMTP digest sink for operational events by @Sannrox in #730
• feat(ops): carry OCI image layers in the signed offline chunk store by @Sannrox in #731
• refactor: shrink crate compile fan-out by @Sannrox in #733
• feat(executor): classical model_runtime for registry descriptors by @Sannrox in #734
• feat(auth): document site-local directory OIDC bridge by @Sannrox in #735
• chore: reclaim leftover instruction and path drift by @Sannrox in #736
• feat(planner): require signed registry attestation for classical promotion by @Sannrox in #737
• docs: name the classical model parent epic by @Sannrox in #738
• feat(ops): include usage records in signed audit export by @Sannrox in #739
• feat(offline): carry signed Tenkai hosts in the bundle by @Sannrox in #740
• feat(ops): sign releases, bundles and approvals through an external signer by @Sannrox in #741
• feat(executor): add MLX model_runtime for Apple silicon hosts by @Sannrox in #742
• refactor(storage): return StoreError instead of tonic::Status by @Sannrox in #744
• feat(storage): use PostgreSQL as the sole enterprise hub store by @Sannrox in #746
• feat(planner): require N distinct human plan approvals by @Sannrox in #745
• feat(ops): seed registry from a verified bundle on an empty host (#627) by @Sannrox in #751
• feat(executor): single-use runtime enrollment and revocable runtime credentials (#630) by @Sannrox in #752
• fix(oci): read TENKAI_OCI_STORE once when selecting the artifact store by @Sannrox in #753
• test: overlay host settings per thread instead of changing the process environment by @Sannrox in #754
• feat(executor): Tenkai upgrades and rolls back tenkai-runtime as a signed release by @Sannrox in #755
• feat(ops): delta offline bundles against a named base release, and N-1 content retention by @Sannrox in #756
• feat(executor): TGI model_runtime executor on the in-process Kubernetes path by @Sannrox in #757
• feat(api): runner registry with list, inspect and revoke with a reason by @Sannrox in #758
• feat(executor): NVIDIA NIM model_runtime executor with entitlement-gated images by @Sannrox in #760
• feat(api): create, list and download exports over HTTP by @Sannrox in #762
• feat(ops): verified upgrade and rollback of tenkai-server with a store-schema preflight by @Sannrox in #763
• feat(server): native TLS listener with optional mutual TLS by @Sannrox in #766
• feat(server): the enterprise profile refuses to start while an authoritative surface is missing by @Sannrox in #768
• feat(ops): report the server version and each runner's version skew by @Sannrox in #771
• feat(trust): runner CA, CSR enrollment, certificate admission and renewal for runtime agents by @Sannrox in #772
• feat(trust): rotate the runner CA with both CAs accepted, and deliver the trust bundle by @Sannrox in #773
• docs(trust): runner certificates at isolated sites by @Sannrox in https://git...

v0.5.0

What's Changed

• feat(cli): sign in tenkaictl with OIDC PKCE by @Sannrox in #527
• feat(executor): add a Docker host executor for multi-container releases by @Sannrox in #529
• docs: align tenkai operator skill with login and env config by @Sannrox in #541
• fix(executor): reject Docker volume paths that inject --mount fields by @Sannrox in #542
• fix(cli): serialize token cache refresh across processes by @Sannrox in #543
• fix(executor): list Docker container names during apply cleanup by @Sannrox in #548
• fix(executor): hash Docker runtime names so hyphenated scopes cannot collide by @Sannrox in #554
• perf(executor): pull Docker images before replace and skip matching containers by @Sannrox in #555
• feat(planner): auto-approve plans from an environment policy by @Sannrox in #556
• feat(cli): publish signed, digest-pinned releases from CI with non-interactive authentication by @Sannrox in #557
• fix(server): shut down gracefully on SIGTERM as well as SIGINT by @Sannrox in #558
• feat(server): resolve tenkai-executor-guard at startup and document server host install by @Sannrox in #559
• docs(skill): close remote continuous-delivery gaps in the tenkai operator skill by @Sannrox in #567
• fix(executor): restore the previous Docker containers when an upgrade fails by @Sannrox in #568
• fix(executor): recreate Docker containers when their env_file changes by @Sannrox in #569
• feat(executor): complete Docker host networking and registry image admission by @Sannrox in #570
• feat(catalog): enforce signed software compatibility profiles before deployment by @Sannrox in #571
• feat(executor): support completion-gated Docker initialization jobs by @Sannrox in #572
• docs: remove external product references by @Sannrox in #574
• feat(executor): deliver release-owned Docker configuration files by @Sannrox in #573
• fix(http): publish capability in contract routes by @Sannrox in #576
• feat(executor): declare Docker runtime user, mounts, and restart policy by @Sannrox in #575
• feat(planner): release delivery metadata approval gates and delivery holds by @Sannrox in #578
• fix(auth): pin remote publication trust roots by @Sannrox in #577
• fix(planner): hold failed targets until deliberate retry by @Sannrox in #579
• feat(cli): versioned json-v1 command results in remote mode by @Sannrox in #580
• fix(approval): confine automatic signers to environment policy by @Sannrox in #587
• fix(approval): require human signatures for downgrades by @Sannrox in #591
• fix(approval): refresh stale automatic approvals by @Sannrox in #592
• test(reconciler): cover failed-target hold boundaries by @Sannrox in #593
• chore: prepare 0.5.0 crate bump and release notes by @Sannrox in #594

Full Changelog: v0.4.2...v0.5.0

v0.4.2

Release notes: v0.4.2

Crate version: 0.4.2. Tag: v0.4.2.

Pair with release readiness. Contributor credits
belong on the GitHub Release generated notes.

Scope

Pre-1.0 patch on published GitHub release
v0.4.1. Operators get
web console
v0.2.0 at
/ui/, which adds environment subscribe, catalog publish, promote, and recall,
and a reconcile tick over the existing tenkai.http.v1 routes. The workspace
is split into crates (#523), which changes source-build feature flags.

Base: tag v0.4.1 (bf0f835). Open release-blocking issues at crate-bump
time: none. Follow-up #511 stays open.

Compatibility and migration

Surface	Impact for 0.4.2
Crate version	0.4.1 → 0.4.2 for tenkai and every workspace crate
SQLite SCHEMA_VERSION	Remains 12. No migration
Hub Postgres schema	Remains 12
Runtime / auth / federated / model / plan / provider contracts	Documented *_CONTRACT_VERSION / PLAN_FORMAT_VERSION remain 1
HTTP contract	Id stays tenkai.http.v1. Console v0.2.0 requires exactly this contract
Web console	ui/console.pin moves from v0.1.0 to v0.2.0
Source builds	ui and postgres are tenkai-server features (#523): community --features tenkai-server/ui, hub -p tenkai-server --features postgres,ui
GitHub Release assets	Same names as 0.4.1: community ui hosts, hub tenkai-server-postgres-<platform>, tenkai-http-v1.schema.json, SHA256SUMS, and attestations for linux-x86_64 and darwin-aarch64
Toolchain	rust-version = "1.96.1"
Defaults	Signing/approval fail closed; tenant mode / enterprise flags default off

Operator upgrade notes

1. Embedded / SQLite: install 0.4.2 hosts from the GitHub Release after
   verifying SHA256SUMS and the attestation. No store migration.
   tenkaictl --version reports tenkaictl 0.4.2. See
   release binaries.
2. Web console: management actions in the console call the same lifecycle
   routes as tenkaictl and need the management capability. Nothing changes
   in server authorization. A credential refused by the server loses that
   scope's console controls for the session.
3. Source builds: replace --features ui with --features tenkai-server/ui
   for the workspace, or build -p tenkai-server --features ui. The hub
   build is cargo build --release --locked -p tenkai-server --features postgres,ui.
   TENKAI_UI_BUNDLE still skips the download and still enforces the pinned
   checksum.

Rollback

Previous 0.4.1 binary plus the existing Tenkai-owned SQLite (embedded) or
Postgres (hub) store. No schema change in this patch; the previous binary
serves console v0.1.0 again. Recovery never depends on sekai-chisei.

User-visible changes

Added

• Web console v0.2.0: subscribe an environment to a product channel; publish,
  promote, and recall releases with signing kept outside the browser; request
  one reconcile tick and read its per-environment report

Changed

• Workspace split into tenkai-wire, tenkai-http, tenkai-server,
  tenkaictl, tenkai-executor, and tenkai-postgres; ui and postgres
  are now tenkai-server features (#523)

Fixed

• Web console no longer sends a management action clicked while the browser
  was offline when it reconnects; the outcome shows as unknown instead

Migration

• None. SCHEMA_VERSION remains 12. HTTP contract id stays tenkai.http.v1.

Out of scope for 0.4.2

• A route that lists a caller's grants for the console
• Advertising product high_availability capability
• Extra platforms or crates.io
• Rewriting docs/releases/0.4.1.md
• #511 (export operation-bound feedback observations)

v0.4.1

Release notes: v0.4.1

Crate version: 0.4.1. Tag: v0.4.1.

Pair with release readiness. Contributor credits
belong on the GitHub Release generated notes.

Scope

Pre-1.0 patch on published GitHub release
v0.4.0. Operators get
the hub tenkai-server-postgres GitHub asset, --ui-dir symlink refuse, and
bind-before-legacy-import so /healthz answers while a large store opens.

Base: tag v0.4.0 (36c20ff). Open release-blocking issues at crate-bump
time: none. Follow-up #511 stays open.

Compatibility and migration

Surface	Impact for 0.4.1
Crate version	0.4.0 → 0.4.1
SQLite SCHEMA_VERSION	Remains 12. No migration
Hub Postgres schema	Remains 12
Runtime / auth / federated / model / plan / provider contracts	Documented *_CONTRACT_VERSION / PLAN_FORMAT_VERSION remain 1
HTTP contract	Id stays tenkai.http.v1
Optional Postgres hub	Same feature and TENKAI_POSTGRES_URL; GitHub Release now attaches tenkai-server-postgres-<platform>
Spoke / CLI embedded	Still refuse TENKAI_POSTGRES_URL (ADR 0029)
GitHub Release assets	Community hosts built with --features ui plus hub tenkai-server-postgres-<platform> (--features postgres,ui) for linux-x86_64 and darwin-aarch64, plus tenkai-http-v1.schema.json, SHA256SUMS, and GitHub artifact attestations
Toolchain	rust-version = "1.96.1"
Defaults	Signing/approval fail closed; tenant mode / enterprise flags default off

Operator upgrade notes

1. Embedded / SQLite: install 0.4.1 community hosts from the GitHub
   Release after verifying SHA256SUMS and the attestation, or
   cargo build --release --locked. No store migration. tenkaictl --version
   reports tenkaictl 0.4.1. See release binaries.
2. tenkai-server community host: still built with --features ui and
   serves the pinned console at /ui/. --ui-dir refuses symlinks that leave
   the console root. See
   run tenkai-server.
3. Tenant-mode hub: this is the first published tag that attaches
   tenkai-server-postgres-<platform> (--features postgres,ui). Verify
   checksum and attestation the same way as community hosts. Keep
   TENKAI_POSTGRES_URL, management credentials, JWT or OIDC trust, and
   --tenant-mode. Non-loopback Postgres URLs still require verified TLS.
   Source build remains valid:
   cargo build --release --locked --features postgres --bin tenkai-server.
4. Spoke / community: leave TENKAI_POSTGRES_URL unset. That refuse is
   unchanged.
5. Large legacy stores: tenkai-server binds first and answers /healthz
   while import runs. /readyz returns 503 until the store is open. Graph
   import commits in batches and resumes after a restart.

Rollback

Previous 0.4.0 binary plus the existing Tenkai-owned SQLite (embedded) or
Postgres (hub) store. No schema change in this patch. Recovery never depends
on sekai-chisei.

User-visible changes

Added

• GitHub Release attaches hub tenkai-server-postgres-<platform> built with
  --features postgres,ui for linux-x86_64 and darwin-aarch64, next to
  the five community --features ui hosts (#514)

Fixed

• tenkai-server binds the listener and serves /healthz before legacy
  graph import; /readyz returns 503 until the store is open (#516)
• Legacy graph import commits in batches and resumes after a readiness
  restart (#516)

Security

• --ui-dir /ui file map refuses symlinks that would leave the console
  root (#515)

Migration

• None. SCHEMA_VERSION remains 12. HTTP contract id stays tenkai.http.v1.

Out of scope for 0.4.1

• Advertising product high_availability capability
• Catalog service extraction
• Identity-plane DB co-location
• Extra platforms or crates.io
• Rewriting docs/releases/0.4.0.md
• #511 (export operation-bound feedback observations)

What's Changed

• feat(ops): attach postgres,ui hub tenkai-server release asset by @Sannrox in #517
• fix(server): refuse --ui-dir symlinks outside the console root by @Sannrox in #518
• fix(server): bind listener before legacy store import by @Sannrox in #519
• chore: prepare 0.4.1 crate bump and release notes by @Sannrox in #521

Full Changelog: v0.4.0...v0.4.1