v0.4.1

Install

helm install continuo oci://ghcr.io/carolsimone/charts/continuo \
  --version 0.4.1 -n continuo --create-namespace

Changed

• Comment-only: files/dbt-commands.yaml now names the demo repository by its
  new name, continuo-demo (renamed from continuo-dbt-demo). No rendered
  template, values key, or behavior changes; PATCH when released.
• validation.imageTag default bumped v0.4.0 → v0.4.1. The
  continuo-python-runtime-<engine> image now installs its runtime and engine
  adapter from PyPI (versioned) instead of building from source, and the
  adapter packages were renamed to continuo-<engine>-adapter. The image name,
  entrypoint, run/validation-op commands, uid 65532, and adapter
  discovery are unchanged, so it is a drop-in; an unmodified existing values
  file that keeps imageTag: "v0.4.0" still installs and runs. PATCH when
  released.

v0.4.0

Install

helm install continuo oci://ghcr.io/carolsimone/charts/continuo \
  --version 0.4.0 -n continuo --create-namespace

Added

• networkPolicy.enabled now also renders an allow-acme-solver policy when
  ingress.enabled=true: cert-manager's HTTP-01 solver pods (label
  acme.cert-manager.io/http01-solver, port 8089) answer ACME challenges
  through the ingress controller, and the chart's default-deny would otherwise
  block the challenge so certificate issuance times out. Selects only pods
  carrying cert-manager's solver label, so it is inert for installs that
  terminate TLS elsewhere or bring their own certificate Secret. No values
  schema change; an unmodified existing values file renders the same
  manifests as before unless both toggles are already on.

Changed

• Bumped the default validation.imageTag (and its _helpers.tpl fallback)
  from v0.3.0 to v0.4.0. The runner at that release adds python-csv node
  support. No values key changes shape, so an unmodified existing values file
  keeps working and simply picks up the new default on upgrade. Installs
  pinning validation.imageTag must re-pin to v0.4.0 (or drop the
  override to track the chart's default) before upgrading, the same way as
  any other continuo-python-runtime-<engine> tag bump — an unmirrored or
  stale pin otherwise renders healthy at install and only fails later, at the
  next release promotion, as a validation-pod ErrImagePull. A pin to an
  older tag is now caught at render time rather than left as a warning here:
  see the validation.imageTag capability gate under Breaking below.

Breaking

• Renamed service ui-service to ui: the services[] entry, Deployment,
  Service, NetworkPolicy, and ingress backend now use the name ui.
  Image is now continuo-ui. The default ingress.tls.secretName also
  changed, from ui-service-tls to ui-tls: any install with
  ingress.tls.enabled=true that relies on this default (rather than
  setting ingress.tls.secretName explicitly) must rename/recreate the
  Secret before upgrading, or TLS termination breaks.
• Renamed service agent-runner to agent-chat; its database
  continuo_agent is now continuo_agent_chat (renamed in place on
  upgrade — see NOTES). Image is now continuo-agent-chat. The
  global.agentRunnerGrpcAddr values key is renamed to
  global.agentChatGrpcAddr; any install overriding it must rename the
  key before upgrading.
• Renamed service remediation-agent to agent-remediation; database
  continuo_remediation_agent is now continuo_agent_remediation (rename in
  place on upgrade — see NOTES); consumer group
  remediation-agent-remediation-requested is now
  agent-remediation-remediation-requested. Image is now
  continuo-agent-remediation.
• Renamed service manifest-controller to topology-controller; consumer
  group manifest-controller-release-requested is now
  topology-controller-release-requested (drained group deleted on upgrade —
  see NOTES). Image is now continuo-topology-controller. Stream names are
  unchanged — manifest.loaded.candidate:v1 still names the dbt-manifest
  artifact this service loads, not the service itself.
• validation.imageTag, when set explicitly, is now checked against the tag
  ranges known to predate python-csv validation support: _helpers.tpl's
  continuo.validation.image fails the render (rather than only warning here)
  when the tag matches v0.1.x-v0.3.x, or when it isn't shaped like a
  released tag ("vX.Y.Z" or "vX.Y.Z@sha256:<digest>") at all — an
  unparseable tag can't be checked against that known-bad range, so it fails
  closed the same way. BREAKING only for an install that explicitly pins
  validation.imageTag to one of those tags (or to something unparseable):
  it previously rendered and installed, silently running a validation runner
  that ignores a python-csv node's csv_source contract field and reports
  success without checking the file's header, letting a mismatched-header csv
  promote unvalidated; it now fails helm template/helm install/helm upgrade outright, naming the tag and the required floor. No values key is
  added, renamed or removed, and an install that has never overridden
  validation.imageTag (or that already pins v0.4.0 or later) is
  unaffected. Re-pin to v0.4.0 or later, or drop the override, before
  upgrading.

v0.3.0

What's Changed

• feat(release-controller): kind threading + skip-compile branch (python nodes step 5) by @carolsimone in #407
• fix(manifest-controller): wait out a Redis that is not reachable yet at startup by @carolsimone in #408
• Production execution records carry their log and structured result by @carolsimone in #409
• Executor python runtime dispatch (python nodes step 6) by @carolsimone in #410
• ci(release): install the published chart before declaring the release good by @carolsimone in #411
• Reject a release when two models claim the same warehouse table by @carolsimone in #412
• fix(k8s-controller): give the compile leg an object key MinIO will accept by @carolsimone in #413
• Code-version history in the graph (graph versioning PR 2) by @carolsimone in #415
• feat: promoted seeds run through the standard run lifecycle by @carolsimone in #414
• chore(deps): bump the go-minor-patch group across 10 directories with 5 updates by @dependabot[bot] in #419
• chore(deps): bump the npm-minor-patch group in /ui-service with 6 updates by @dependabot[bot] in #418
• Code-version read paths: OrchestratorQuery RPCs + CLI (graph versioning PR 4) by @carolsimone in #416
• Failure-precedent case base: GetPrecedents + CLI, :PREVIOUS removal (graph versioning PR 3) by @carolsimone in #420
• Remediation switch: fix prompts read the graph and the release code bundle (graph versioning PR 5) by @carolsimone in #421
• remediation-agent: refuse a non-sql fallback source path (closes the python residual) by @carolsimone in #422
• fix(ui): keep manually placed graph nodes where the operator drops them by @carolsimone in #423
• Multi-file proposal chassis: proposals carry N file edits (python-node remediation PR A) by @carolsimone in #425
• fix(ui): stop re-framing the dependency graph once the operator zooms it by @carolsimone in #426
• fix(ui-service): sort NodesPanel same-status rows by completed_at, add Completed column by @carolsimone in #427
• chore(deps): bump the go-security group across 6 directories with 1 update by @dependabot[bot] in #424
• fix(k8s-controller): failed runs report the sentinel message, not marker noise by @carolsimone in #428
• Python-node remediation: shadow-release verified contract fixes by @carolsimone in #429
• fix(executor-controller): restore the adapter → port arrow for UnitOfWork by @carolsimone in #435
• feat(state,orchestrator,agent-runner): /livez so a wedged consumer restarts the pod by @carolsimone in #436
• refactor(lifecycle): one pkg/lifecycle, and the v1 shutdown bug fixed in the two services still carrying it by @carolsimone in #438
• fix(pkg/lifecycle): close two shutdown-path races and stop double-spending the grace period by @carolsimone in #439
• Merged runtime image: executor, chart, e2e, docs by @carolsimone in #437

Full Changelog: v0.2.0...v0.3.0

v0.2.0

Install

helm install continuo oci://ghcr.io/carolsimone/charts/continuo \
  --version 0.2.0 -n continuo --create-namespace

Added

• remediation-agent.env.REMEDIATION_PR_OPENING_GRACE_PERIOD (default "10m") — how long the remediation-agent reconciler's opening sweep waits, measured against the claim's own pr_claimed_at, before releasing a stranded pr_state='opening' proposal back to 'failed' for retry. Sits alongside the existing REMEDIATION_PR_POLL_INTERVAL in the same free-form env map, so no schema change is required; an unmodified existing values file already gets this default via the chart's own env defaults.
• validation.imageTag — pins the external continuo-validation-<engine> image version independently of the chart appVersion (default v0.2.0). The key is optional (not in validation's required list), so a release that predates it — e.g. one upgraded with helm upgrade --reuse-values — still validates and falls back to the chart's current default in templates/_helpers.tpl's continuo.validation.image. An explicit imageTag: null override collapses to that same "key absent, use the default" path (Helm drops a null-valued override key before merging). A present-but-empty string ("") is different — it survives the merge as a deliberate misconfiguration — and is rejected: at helm lint/install time by the schema's minLength: 1, and at helm upgrade --reuse-values time (where the schema cannot see the merged value) by a fail in the same helper. Accepts an optional @sha256:<digest> suffix ("vX.Y.Z@sha256:<digest>") for an immutable pin — a plain tag is mutable, since continuo-validation's publish workflow re-pushes :vX.Y.Z on every tag; see values.yaml/README.
• helm upgrade NOTES.txt now reminds operators that the validation image is externally released and pinned by validation.imageTag independently of appVersion, and that private-registry mirrors need it mirrored explicitly — an unmirrored bump otherwise renders healthy at install and only fails later, at the next release promotion, as a validation-pod ErrImagePull.

Changed

• The validation image is now the externally released continuo-validation-<engine> (from github.com/carolsimone/continuo-validation), replacing the chart-appVersion-tagged continuo-validation-runner-<engine>; global.imageTag no longer applies to it.

Fixed

• Service pods now carry a checksum/config annotation over the shared
  ConfigMap, so helm upgrade restarts the pods whose configuration actually
  changed. Services read that ConfigMap through envFrom, and Kubernetes never
  refreshes environment variables in a running pod, so changing REDIS_HOST,
  S3_BUCKET, LOG_LEVEL or validation.engine previously rendered an
  identical Deployment and every pod kept serving the old value indefinitely.
  The engine case corrupted output rather than merely going stale:
  executor-controller rolls on an engine change because its validation image
  reference changes, so manifest-controller would have kept uploading the
  previous engine's SQL to the new engine's validator. Upgrade note: an
  upgrade that changes any shared ConfigMap value now performs a rolling
  restart of the affected services; an upgrade that changes none does not, as
  the digest covers only values derived deterministically from values.yaml
  (generated credentials live in Secrets).
• manifest-controller now reads and re-renders SQL in the dialect of the
  engine the install actually targets, instead of always assuming Postgres. The
  shared ConfigMap gained a WAREHOUSE_ENGINE key derived from the existing
  validation.engine value — no new values key, so unmodified overrides keep
  working. On a validation.engine: trino install, the candidate SQL uploaded
  for blue/green validation was previously re-rendered through sqlglot's
  postgres dialect, emitting constructs Trino rejects (a cast came out as
  CAST(x AS TEXT) rather than CAST(x AS VARCHAR)), so validation could fail
  on SQL the warehouse would otherwise have accepted. An engine with no dialect
  mapping now fails the service at startup rather than silently emitting another
  engine's SQL.
• Redis-backed services (manifest-controller, ui-service) no longer start
  before the bundled Redis is reachable. They previously raced the Redis
  StatefulSet, crashed on connect, and entered CrashLoopBackOff — whose
  exponential backoff (10s, 20s, 40s, 80s...) kept them down well after Redis
  became ready, so the restart loop cost more time than the wait it replaced. A
  wait-for-redis initContainer now gates them, mirroring the existing
  wait-for-migrations gate for Postgres-backed services. Bundled installs only;
  BYO installs point at Redis that is already running and render no initContainer.
• The quickstart's /etc/hosts step is documented with the two things operators
  actually get stuck on: it must be run from a real terminal, because sudo reads
  the password from the controlling terminal and exits with a terminal is required to read the password in an IDE pane or agent shell; and the password
  it asks for is the local account password, not the Dex demo login printed
  directly below it. The chart README now also documents a browser
  --host-resolver-rules flag that resolves the issuer hostname without root,
  for operators who cannot use sudo at all.

v0.1.1 — multi-arch images

Multi-architecture images, a validated chart values contract, and a security scanning baseline.

If you are on Apple Silicon, this is the first release that works. 0.1.0 published linux/amd64 only, so an install on arm64 left every Continuo pod in ImagePullBackOff.

Install

helm install continuo oci://ghcr.io/carolsimone/charts/continuo \
  --version 0.1.1 -n continuo --create-namespace

Upgrading from 0.1.0 needs no values changes.

Multi-architecture images

Every service image now publishes for linux/amd64 and linux/arm64, including the dbt base image. Go builder stages cross-compile via BUILDPLATFORM/TARGETARCH rather than emulating, so build times stay reasonable on x86 runners.

Two guards keep it honest: CI fails the build if a published image is not multi-arch, and each arm64 image is smoke-run under QEMU to catch a wrong GOARCH slipping through.

Chart

• values.schema.json validates your values on helm lint, install, and upgrade — typos and wrong-shaped overrides now fail before template rendering rather than at runtime.
• NOTES.txt prints real post-install access instructions, including the Dex port-forward and /etc/hosts steps the quickstart login actually needs.
• A changelog (deploy/continuo/CHANGELOG.md) with a CI gate requiring it to be updated whenever the chart's user-facing surface changes.

Two schema bugs from 0.1.0 are fixed: services[].image overrides and resource keys beyond cpu/memory (such as ephemeral-storage or nvidia.com/gpu) were being rejected despite being supported.

Security

• govulncheck and gitleaks now block a merge; Trivy dependency and config scans run advisory.
• Dependabot covers Go, npm, uv, GitHub Actions, and Docker.
• google.golang.org/grpc bumped to v1.82.1 for GO-2026-6061.

Fixes

• orchestrator no longer prunes dedup rows still referenced by the outbox.
• executor-controller garbage-collects failed one-shot Job pods after 24 hours.

Status

Beta. dbt remains the only supported runtime.

Full changelog: v0.1.0...v0.1.1

v0.1.0

First tagged release of Continuo — a control plane for data pipelines with built-in agentic remediation.

This is the release that made Continuo installable by someone other than its author: every service image published to a public registry, and a single Helm chart that stands the whole system up.

Install

helm install continuo oci://ghcr.io/carolsimone/charts/continuo \
  --version 0.1.0 -n continuo --create-namespace

Apple Silicon users: use v0.1.1 instead. The images in this release are linux/amd64 only, so an install on arm64 fails with ImagePullBackOff. Multi-arch publishing landed in 0.1.1.

What's in it

• One chart installs everything. All ten backend services, plus optional bundled quickstart datastores (PostgreSQL, Redis, Neo4j, MinIO, Dex) with auto-generated passwords — or point external* / existingSecret values at datastores you already run.
• Images on GitHub Container Registry at ghcr.io/carolsimone/continuo-*, pinned by digest at deploy time.
• Hardened by default. Every workload runs non-root (uid 65532) with dropped Linux capabilities, seccompProfile: RuntimeDefault, resource requests and limits, behind default-deny NetworkPolicies.
• Database bootstrap included. The db-init step idempotently creates all nine service databases and runs Flyway migrations.

Status

Beta. dbt is the only supported runtime. Evaluate freely; read deploy/README.md before running it anywhere that matters.