runner: v0.3.0

0.3.0 (2026-07-30)

Features

• compat: apply-time COMPAT-001 fail-closed gate + compat_result metadata (#1358) (81043d9), closes #1215
• compat: formalize the 7 version couplings against matrix.json (#1214) (#1252) (fd4b5e0)
• connectors: helm_registry keyless OCI ECR — in-cluster token refresh (#1185) (#1303) (409e2b8)
• fabric: activate azure namespace placement — federated-identity per-namespace provisioner (#1408) (7c56870)
• fabric: activate gcp namespace placement — Workload-Identity per-namespace provisioner (#1405) (e43bd0b)
• fabric: activate vcluster placement path + delivery renderer (#1307) (a7de7e5), closes #1231
• fabric: namespace-placement keyless-mint dispatch seam (#1013) (#1138) (5b870e8)
• fabric: per-namespace cloud identity (AWS IRSA) for namespace placement (Closes #957) (#1029) (3cc73a7)
• fabric: runner-injected kube-conn seam + activate gcp & azure vcluster placement (#1392) (03ca029)
• fabric: vcluster provisioner seam — helm-create + exportKubeConfig (#960) (#1239) (c16dc75)
• keyless: couple the three alethia_app literals so they cannot drift silently (#1552) (#1554) (5d85383)
• placement: activate alibaba placement (both tiers — keyless RRSA-signed ACK + per-namespace RAM identity) (#1431) (e3ebe7e)
• placement: activate hetzner-talos placement tier (Talos-API kubeconfig from persisted talosconfig) (#1433) (701eba9)
• runner: registry-token cross-account keyless registry refresher (B2/PR B) (Part of #925) (#1036) (fb77a43)
• runner: alethia db-authproxy — in-process token mint + TLS upstream + wire splice (pg & mysql) (#1521) (36bbad2)
• runner: azure-mysql keyless bootstrap SQL dialect + AAD token scope (#1456) (1f25368)
• runner: keyless MySQL bootstrap SQL — aws AWSAuthenticationPlugin + gcp IAM grants (#1506) (#1541) (f1f302d)
• runner: scan BYO charts pulled from an OCI registry (#1300) (#1313) (e18d171)

Bug Fixes

• core,runner: make git clone/pull cancellable via context (#987) (#1025) (efc55fe)
• e2e: pin the project templates' providers so the nightly stops resolving live (#1573) (6586eb5)
• infracost: checksum-verify, timeout, and config-driven version (#983) (3eca757), closes #946 #950
• runner,console: stop persisting live runner_token at rest; re-mint on update (#945) (#1014) (8d9fcb0)
• runner: ActivateTokenCloud restores a pre-existing token on cleanup (#988) (#1020) (f7cb0a7)
• runner: cross-compile the runner image for its target arch (multi-arch build bug) (#1052) (17ab6d9), closes #1050
• runner: derive CloudAccountID from ambient env in the self-operator path (#1190) (d5791ef)
• runner: fail the audit job when the verify verdict can't persist (#991) (cd2950c), closes #986
• runner: nil-guard resolveAccountID (#989) (#1018) (d052776)
• runner: set X-Amz-Expires on the EKS presigned token (#1040) (#1209) (85ccd39)
• runner: single config-driven tofu version + panic-safe id truncation (#964) (977396c), closes #947 #949
• runner: StreamWake reuses the configured transport + gets an idle deadline (#953) (#1024) (d29cee5)
• security: write secret-bearing files owner-only (0600) (#961) (e684a6a)