v2.2.1

Wardryx 2.2.1

The wardryx image, ghcr.io/taipanbox/wardryx, is signed in the legacy .sig format that the cluster admission controller (policy-controller v0.15.1) reads. Its reader takes only that tag, so the image signature was not verifiable there before this release. cosign stays at v3.1.3, and the release workflow's sign-blob steps are unchanged. Nothing else changes in behaviour: no decision, approval, token or record format moves, and no name compat/1.0.json freezes is removed or renamed.

Changed since 2.2.0

• #116, chore(deps): move agent-stack-go to the v2 module, v2.0.0. The shared wire-type import moves from github.com/TAIPANBOX/agent-stack-go to its /v2 module path. Nothing an operator sets or sees moves with it.
• #117, ci(release): sign the image in the legacy format policy-controller reads. The image sign step adds --new-bundle-format=false --use-signing-config=false.

No other commit lies between the 2.2.0 tag and this release.

Upgrade: the event stream file

This is an operator-visible change that arrived in a patch release, and these notes say so rather than leave it out.

Since agent-stack-go v2, a stream file this service creates is mode 0640, not 0644: the owning account and its group can read it, and no other account can. A new stream file is created only in a directory this service's account owns. An existing file is opened as it is.

A bus directory that is shared between services and not owned by this service's account gets no new stream, unless each file is created beforehand by the uid of the service that writes it. Before you start this release, check who owns the bus directory and the mode of each stream file in it.