v0.14.0-rc.1

Changelog

• e517f73: feat(build): add an injectable pod-hardening hook to the build executor (ADR-0053 §6) (#303) (@incognick)
• d2540ea: feat(kube): make the in-cluster build namespace configurable on BuildAdapter (#304) (@incognick)
• 420faf7: feat(cli): group install/upgrade under 'burrow cluster'; keep deprecated aliases (#305) (@incognick)
• 2549f23: feat(controlplane): env remove — the symmetric inverse of env add (ADR-0035) (#309) (@incognick)
• 2174481: fix(controlplane): stop reporting a wedged rollout as healthy (#307) (#310) (@incognick)
• 1daaad8: fix(cli): render list tables with tabwriter so long values keep a gutter (#311) (@incognick)
• eb0897c: feat(controlplane): add a metrics range-query verb for time-series reads (#312) (@incognick)
• 5c2832e: docs(adr): ADR-0061 a pod-mutator seam on the deploy path (Proposed) (#313) (@incognick)
• 0edf3fa: feat(kube): add a pod-mutator seam on the deploy path (ADR-0061) (#314) (@incognick)
• f386c3d: test: guard the agent surface against cluster-administration verbs (#315) (@incognick)
• 45ce073: chore: remove the MCP server from the tree (ADR-0062) (#317) (@incognick)
• a2f7186: docs(adr): ADR-0062 remove the MCP server from the tree (Proposed) (#316) (@incognick)
• c948885: docs: add a capabilities reference answering "can Burrow do X?" (#320) (@incognick)
• 631d378: docs(adr): fix two dead links in ADR-0061 (#319) (@incognick)
• ee04bc5: docs(adr): make the index answerable without opening the records (#318) (@incognick)
• 7c7a17c: docs: correct status claims the code does not support (ADR-0009) (#322) (@incognick)
• 743b541: docs(adr): accept ADR-0016 and ADR-0057 (#325) (@incognick)
• 117a89c: docs(adr): ADR-0063 object storage as a provider type (Proposed) (#321) (@incognick)
• d47f897: docs(adr): ADR-0064 removing an add-on keeps its data (Proposed) (#324) (@incognick)
• 2653e3f: fix(controlplane): addon remove keeps the data volume unless asked to delete it (#323) (@incognick)
• 6eb223f: docs(adr): ADR-0065 what belongs on the agent surface (Proposed) (#326) (@incognick)
• 6e05321: docs(adr): ADR-0067 one database instance per environment (Proposed) (#328) (@incognick)
• a5a65e2: docs(adr): ADR-0066 the Postgres add-on runs on CloudNativePG (Proposed) (#327) (@incognick)
• 725215d: docs: record ADR-0063 through ADR-0067 as decided, not yet built (#329) (@incognick)
• b087ac3: docs: correct two status claims overtaken by today's ADRs (#330) (@incognick)
• d88654b: docs(adr): ADR-0068 operational limits are configuration (Proposed) (#332) (@incognick)
• f4b4f79: docs: move per-ADR implementation tracking into issues (#341) (@incognick)
• abd35e6: feat(cli): require the add-on's name typed back for addon remove --delete-data (#344) (@incognick)
• f5da50e: feat(addon): report volumes retained by an earlier removal in addon list (#347) (@incognick)
• 2b329e7: guardrails: deny app.delete and dns.delete by default (#345) (@incognick)
• 6fd135e: docs(adr): ADR-0070 implementation status lives in issues (Proposed) (#343) (@incognick)
• 229d4a9: docs(adr): ADR-0071 a deny gates the operator too (Proposed) (#348) (@incognick)
• 34571ef: docs(adr): ADR-0069 the audit log records mutation, not only guarded operations (Proposed) (#342) (@incognick)
• 6970207: docs(adr): index ADR-0068 through ADR-0071 (#350) (@incognick)
• 52be8e0: fix(addons): one database instance per environment (ADR-0067 §1) (#346) (@incognick)
• 9c371d9: docs(adr): ADR-0072 a release command for deploys nobody is driving (Proposed) (#351) (@incognick)
• edb75ba: feat(guard): report the capabilities absent from the agent binary (ADR-0065 §7) (#353) (@incognick)
• c1ddd13: feat(env): install creates one environment, named prod (ADR-0067 §2-§3) (#354) (@incognick)
• 9000d6f: fix(run): one-off command Jobs honour the pod mutator (ADR-0061) (#355) (@incognick)
• 2633aba: feat(provider): object storage as a backup destination (ADR-0063 §1-§6) (#358) (@incognick)
• 0b3c61a: docs(adr): ADR-0073 placement policy reaches every authored pod (Proposed) (#356) (@incognick)
• 213d5e7: ci: make the docs-only skip actually skip (#360) (@incognick)
• ab2f705: docs(adr): ADR-0074 Burrow observes what it manages, and remembers when it broke (#359) (@incognick)
• bad2caf: feat(kube): a platform pod mutator for the pods running Burrow's own images (ADR-0073) (#366) (@incognick)
• d2958c4: feat(status): say why an app is unavailable, not just that it is (#367) (@incognick)
• 1a445ee: docs(adr): ADR-0068 gains status thresholds as a cluster-scoped occupant (#368) (@incognick)
• b0d190b: feat(controlplane): let a caller ask which environment names are reserved (#369) (@incognick)
• e7118af: test(kube): a new authored pod path cannot arrive without a hook (ADR-0073 §1) (#370) (@incognick)
• 292ae50: docs(adr): ADR-0075 a green PR is a tested PR (Proposed) (#371) (@incognick)
• 542df37: feat(cli): accept the plural spelling of the app and addon groups (#373) (@incognick)
• 2d0ac78: docs(adr): accept ADR-0068 and ADR-0075 (#374) (@incognick)
• 1a4844c: fix(kube): fail a Job wait fast on a pod that cannot start (#378) (@incognick)
• 46e9bd1: docs(adr): ADR-0076 health checks — readiness only, dependencies at deploy time (#376) (@incognick)
• 5f1e844: docs(adr): ADR-0072 becomes lifecycle hooks named for when they run (#375) (@incognick)
• 3615fc3: feat(backup): backups reach the object store, or the row says they did not (ADR-0063 §7) (#379) (@incognick)
• 54e531c: feat(addon): --delete-data backs the data up first, or removes nothing (ADR-0064 §5) (#380) (@incognick)
• 1a1ef49: fix(agent): a stale burrow-agent says how to update burrow-agent (#308) (#381) (@incognick)
• 6712b10: feat(backup): report backup age from what Burrow observed (ADR-0066 §5) (#389) (@incognick)
• d580c46: docs(adr): ADR-0077 placement policy for pods Burrow does not author (#390) (@incognick)
• fdb1b8a: ci: run the k3d integration suite on pull requests (#392) (@incognick)
• 3e704f8: feat(kube): placement policy for pods Burrow does not author (ADR-0077) (#393) (@incognick)
• 345ca1c: ci: drop the merge-queue remnants and bound per-push runs (#382) (#394) (@incognick)
• d292a55: feat(cluster): install and detect the CloudNativePG operator (ADR-0066 §1) (#395) (@incognick)
• cbdb65c: feat(observe): record what breaks to a ledger, and record that it looked (#396) (@incognick)
• e698f1f: feat(controlplane): operational limits are configuration (ADR-0068 §1-§5) (#397) (@incognick)
• bf11f08: feat(controlplane): move the scattered operational constants onto configuration (ADR-0068 §6) (#398) (@incognick)
• 04567e3: feat(observe): list what is broken from the CLI (ADR-0074 §8) (#399) (@incognick)
• 6c1bd07: feat(controlplane): lifecycle hooks for the pre phases (ADR-0072 §1-§3, §8-§10) (#400) (@incognick)
• f298261: feat(controlplane): readiness probes for user applications (ADR-0076 §1-§3, §5-§6) (#401) (@incognick)
• e45e89f: feat(controlplane): post-deploy hooks, told how it went (ADR-0072 §4-§6) (#403) (@incognick)
• be90437: feat(controlplane): deploy-time dependency checks, derived from the registry (ADR-0076 §4) (#405) (@incognick)
• def462f: fix(client): derive each request's timeout from the bound it waits on (#406) (@incognick)
• 77e9c5e: fix(controlplane): settle the rollout once and share the outcome (#408) (@incognick)
• 494f63e: fix(backups): one backup claim per environment (ADR-0067 §1) (#409) (@incognick)
• 646f003: feat(addons): back a Postgres instance with a CloudNativePG Cluster (ADR-0066 §1) (#410) (@incognick)
• eda9d37: feat(addons): remove a CloudNativePG-backed Postgres instance (ADR-0064 over ADR-0066 §1) (#411) (@incognick)
• 30c0812: docs(adr): ADR-0078 the CLI points at a target, and burrow auth is how you choose one (#412) (@incognick)
• 2e073bc: docs(adr): ADR-0079 the observer watches, and latches a transition before recording it (#415) (@incognick)
• f6c197d: docs(adr): ADR-0080 a rollback is not blocked by its own hook (#418) (@incognick)
• 8ea4d62: docs(adr): accept ADR-0055 (@incognick)
• c418b87: chore(examples): drop a stray .mcp.json and ignore the pattern (#421) (@incognick)
• 0c880dd: feat(addons)!: the postgres add-on is a CloudNativePG Cluster and nothing else (ADR-0066 §1) (#419) (@incognick)
• 9eafc75: docs(adr): correct the Status line on ADR-0013 and ADR-0039 (#420) (@incognick)
• 3b3dea8: feat(cli): the CLI points at a target chosen with burrow auth (ADR-0078 §1-§3) (#423) (@incognick)
• f374777: feat(addons): physical backups on CloudNativePG, archived to object storage (ADR-0066 §2, §3) (#426) (@incognick)
• 7e0f98f: feat(cli): every command that changes something names the target it changed (ADR-0078 §4) (#427) (@incognick)
• c8c1817: feat(addons): physical restore of a whole Postgres instance from its repository (ADR-0066 §4) (#431) (@incognick)
• e4d795c: docs(adr): ADR-0081 a Postgres instance may have a standby, ADR-0082 an add-on instance is configured after it exists (#430) (@incognick)