v0.4.6-rc.1

Leoflow v0.4.6-rc.1

A 0.x (pre-1.0) build — SemVer carries the maturity, there is no separate
alpha/beta, and the pre-alpha series ended at v0.0.1 (ADR 0037). APIs and
on-disk shape may still evolve between minor versions; -rc.N tags are release
candidates gated by the E2E suite. Install this exact release with:

curl -fsSL https://raw.githubusercontent.com/neochaotic/leoflow/v0.4.6-rc.1/install.sh | LEOFLOW_VERSION=v0.4.6-rc.1 sh

A bare curl … | sh installs the latest stable release (/releases/latest
excludes pre-releases), so on a pre-release page it would NOT give you v0.4.6-rc.1.
LEOFLOW_VERSION must sit on the sh side of the pipe (not curl) — a
VAR=x curl … | sh prefix sets the var for curl only, so install.sh would
not see it and would fall back to latest-stable.

Changelog

• ee64686: build(migrate): compile the migrate CLI from our go.mod instead of shipping a third-party image (#1039) (#1045) (@neochaotic)
• 12068c7: build: move the DAG task base image to Debian 13 (trixie) (#1038) (@neochaotic)
• edf5c6b: chore(deps): bump actions/checkout from 4 to 7 (#965) (@dependabot[bot])
• 9bd609a: chore(deps): bump actions/setup-python from 5 to 7 (#964) (@dependabot[bot])
• b47961c: chore(deps): bump docker/setup-qemu-action from 3.7.0 to 4.3.0 (#967) (@dependabot[bot])
• d38c69a: ci: run the readiness-budget and Hugo gates per PR, not only at the release cut (#1057) (@neochaotic)
• 8c71818: ci: scan container images for CVEs, with a policy that can stay on (#1034) (@neochaotic)
• b2929f1: feat(runtime): publish a py3.13 task base, deprecate py3.10, and make the published-Python list singular (#1037) (@neochaotic)
• 80411e5: fix(agent): make execution_timeout kill the task's process group (#1074) (@neochaotic)
• bc386ac: fix(agentrpc): stop database errors reaching the task pod, keep them in the log (#1077) (@neochaotic)
• c54df03: fix(api): give readiness its own connection and one budget, and floor the chart timeout (#1046) (@neochaotic)
• b2afbb3: fix(api): make /readyz assert the schema invariant boot asserts, on every probe (#1023) (#1033) (@neochaotic)
• 5aa800a: fix(api): stop database errors reaching tenants, keep them in the log (#1069) (@neochaotic)
• 70794e0: fix(chart): mount the database CA into the migration Job, and stop it being BestEffort (#1054) (@neochaotic)
• 6bd3213: fix(cli): make exclude_paths reach the image build, and stop baking dbt's host artifacts (#1059) (@neochaotic)
• 57b812e: fix(cli): shell-quote dependency and system-package specs in the generated Dockerfile (#1066) (@neochaotic)
• fbb97c6: fix(helm): keep the migration hook's pod out of the control-plane selector (#1075) (@neochaotic)
• b248375: fix(helm): refuse an allowMetadataEgress entry wider than one host (#1065) (@neochaotic)
• 6fe6d5a: fix(helm): refuse an inverted autoscaling range, and stop the NetworkPolicy hiding the metrics port (#1073) (@neochaotic)
• a2370f3: release: prepare v0.4.6-rc.1 (@neochaotic)
• cc1a73d: test(cli): pin both branches of the DAG base-image choice against a stamped binary (#1035) (@neochaotic)

---

Artifacts are checksummed (SHA-256) and the checksums file is cosign-signed
(keyless). Verify with cosign verify-blob.