v0.5.0 — Guided application onboarding

Highlights

• Guided application onboarding in the dashboard: register existing applications, configure manual http-small or deployment-derived profiles, review discovery findings and permissions, approve overrides, and create a first preview. Resume saved baselines and approvals from Catalog.
• Safer preview creation with immutable-image requirements for deployment-derived overrides, reviewed profile revision guards, and clear verification levels. HTTP reachability does not establish downstream routing proof.
• Kubernetes orchestration improvements: reviewed DNS replacements, explicit namespace isolation policies, Server-Side Apply ownership, and event-driven reconciliation with PostgreSQL notifications and recovery sweeps.
• Updated onboarding, dashboard, and operator documentation, plus fixes for startup permission configuration and deployment-derived acceptance fixture synchronization.

Upgrade notes

This release includes database migrations 014_namespace_policy.sql and 015_reconcile_notifications.sql. Existing installations retain legacy connectivity; fresh installations default to isolation and require explicit infrastructure allowances. Changing policy mode or configuration requires draining previews and stopping controller replicas. See the orchestration guide.

Artifacts

• CLI archives for macOS and Linux (amd64/arm64), and Windows (amd64), with SHA256SUMS.
• Control-plane image: davey/envy:0.5.0 (also v0.5.0 and latest).
• Demo images: davey/envy-demo:0.5.0-v1 and 0.5.0-v2.
• Helm charts: oci://registry-1.docker.io/davey/envy-chart and oci://registry-1.docker.io/davey/envy-quickstart, version 0.5.0.

Validation

The onboarding changes passed make check, 60 web tests, live disposable-installation browser walkthroughs for both profile paths, and the deployment-derived Argo acceptance scenario. Browser and backend evidence are recorded separately in the validation report.

Full Changelog: v0.4.0...v0.5.0