runner: v0.2.0

0.2.0 (2026-07-19)

Features

• addons: W4.5 — secret knobs render to a runner-seeded k8s Secret, never the manifest (Closes #640) (#656) (ea3a718)
• breakglass: audited, gated, blast-radius-bounded privileged recovery backend + CLI (#364) (d001598)
• byo-iac: deploy-time binding resolution + bind-sheet UI for BYO-IaC targets (#687, #823) (#824) (6c67392)
• canvas: a BYO-IaC environment reads as an architecture (W8) (#527) (b913323)
• connectors: four-cloud OIDC-only + cloud-shell parity (AWS/Azure/Aliyun ↔ GCP) (7e8caac)
• connectors: four-cloud OIDC-only + cloud-shell parity (AWS/Azure/Aliyun ↔ GCP) (a50d9ab)
• db: add PROBE_CLUSTER job kind + environment_probes history table (BYOC B2.1) (#449) (c7e6732)
• e2e/aws: pre-apply cost ceiling + stale-cluster preflight + single-NAT (BYOC A1.4) (3565daf)
• e2e/aws: pre-apply cost ceiling + stale-cluster preflight + single-NAT (BYOC A1.4) (605483c)
• hetzner: surface in-cluster data-service endpoints + credential refs (FT-2) (#511) (4e18b67)
• keyless: per-cloud keyless DB credential auth — GCP Cloud SQL IAM / Azure Entra (#722) (#766) (394ab3c)
• observability: OpenTelemetry traces + metrics on the traceparent substrate (#346) (cf8caf8)
• observability: self-hosted error tracking (Sentry SDK → GlitchTip, env-gated) (#362) (594a4ce)
• runner: detect and repair apply-orphaned resources — a failed apply could permanently wedge an environment (#526) (#543) (8c04139)
• runner: executeBuild — schedule in-cluster kaniko builds, capture digests (Closes #588) (#606) (0939afc)
• scanner: W5 Path A seam #0 — describe BYO chart workloads (#648) (#663) (a5ebaa7)
• services: W2 #0 seam — resolved_image output field + BUILD job kind + result contract (#597) (73650f4)
• surface GitOps/ArgoCD status — Deploy tab, canvas badges, cluster card (Closes #574) (#642) (190fd29)

Bug Fixes

• ci: make Go modules tidy standalone + fix the CLI mirror sync (#851) (65c7406)
• runner: flag orphan_risk on non-cancel mid-apply interruption (audit #8) (#396) (8a706df)
• runner: resolve BYO chart git tokens per-repo, not once per job (#468) (1a9549d)
• runner: un-break dev — executeBuild now uses the canonical imagebuild renderer (#611) (7b84b52)
• runner: wire the PROBE_CLUSTER executor — every probe job was failing (#528) (#533) (6998054)
• secrets: stop AWS generated secret values leaking into execution_metadata (audit P1) (#393) (07a1c72)
• security: stop persisting argocd admin password in execution_metadata (#427) (7d086ab)