v9.0.9

9.0.9 (2026-11-04)

Bug Fixes

• ci: enable verified template sync proposals (#564) (f008c21)

v9.0.8

9.0.8 (2026-11-03)

Bug Fixes

• ci: adopt template sync tag collision repair (#559) (ad334f8), closes #558

v9.0.7

9.0.7 (2026-11-02)

Bug Fixes

• test: wait for the restarted PostgreSQL source before reading (#548) (6d1e8a9), closes #547

v9.0.6

9.0.6 (2026-11-02)

Bug Fixes

• security: renew the reassessed fixture openpgp exception (#540) (70e3d3d)

v9.0.5

9.0.5 (2026-11-01)

Bug Fixes

• contract-probe: expose bounded completed failure diagnostics (#538) (1f616fe)

v9.0.4

9.0.4 (2026-10-31)

Bug Fixes

• ci: drop the stale-triage input retired in v19.0.0 (#533) (dd9bc12)

v9.0.3

9.0.3 (2026-10-28)

Bug Fixes

• ci: filter vendored TODOs in KHoist (#519) (00de655)

v9.0.2

9.0.2 (2026-10-28)

Bug Fixes

• security: pin scanned EDC artifacts without a BOM fetch (#517) (1f1e1f4), closes #516

v9.0.1

9.0.1 (2026-10-28)

Bug Fixes

• deps: patch the Go network dependency (#512) (b878056)

v9.0.0

9.0.0 (2026-10-27)

Features

• reject new legacy UI declarations (#506) (e4f9e76)

BREAKING CHANGES

• Remove spec.ui from new publications. Explicitly apply the verified release CRD before upgrading workloads: helm show crds ./release-chart.tgz > release-crds.yaml; kubectl apply -f release-crds.yaml. Helm rollback leaves this CRD installed; full schema rollback explicitly applies the previous verified release CRD. Follow docs/ui-admission-upgrade.md and verify the live rule and product readiness.

• test: align installed admission and release migration checks

Part of #443. Select the actual consumer-approved image signer from the released CD workflow, retain signature/absence guards before fixture schema changes, and check both protocols against the delivered policy. Preserve the appearance negative control and full signed historical rollback coverage. Correct the source helper mode, documentation link/indentation, and reviewed historical-schema guidance.

• chore: Apply megalinter fixes

• test: preserve released admission schema capture bytes

Part of #443. Keep the signed v8 schema capture as raw test input, with its original checksum and real API-server validation unchanged. Preserve the formatter changes to ordinary JSON reports and tables after comparing parsed values, recording raw and formatted report digests. No formatter or admission check is disabled.

• test: preserve status semantics through workload rollouts

Part of #443. Keep complete stored status observations and exact equality across the CRD-only step. During real workload revisions, compare all status content while requiring valid nondecreasing condition transition timestamps and current-generation readiness. Add 56 behavioral controls that reproduce the prior false rejection and reject lost or changed status, altered specifications, replaced identities and malformed or backwards clocks.

• test: preserve phase-ordered UI migration status