v0.4.7-rc.1

Leoflow v0.4.7-rc.1

A 0.x (pre-1.0) build — SemVer carries the maturity, there is no separate
alpha/beta, and the pre-alpha series ended at v0.0.1 (ADR 0037). APIs and
on-disk shape may still evolve between minor versions; -rc.N tags are release
candidates gated by the E2E suite. Install this exact release with:

curl -fsSL https://raw.githubusercontent.com/neochaotic/leoflow/v0.4.7-rc.1/install.sh | LEOFLOW_VERSION=v0.4.7-rc.1 sh

A bare curl … | sh installs the latest stable release (/releases/latest
excludes pre-releases), so on a pre-release page it would NOT give you v0.4.7-rc.1.
LEOFLOW_VERSION must sit on the sh side of the pipe (not curl) — a
VAR=x curl … | sh prefix sets the var for curl only, so install.sh would
not see it and would fall back to latest-stable.

Changelog

• c5735f7: docs(adr): withdraw D9's claim about how the OIDC slice leaves are loaded (#1152) (@neochaotic)
• ca369ac: docs(config): the slices bind from env, and the chart cannot carry the two maps (#1148) (@neochaotic)
• b331561: docs(dbt): say which dbt runs the parse, because it differs by edition (#1109) (@neochaotic)
• 1010a60: docs(release): refresh §3a for the v0.4.7 tranche, and stop retiring work that was never done (#1151) (@neochaotic)
• d008827: feat(api): let clear re-run a task on the image that produced it (#1138) (@neochaotic)
• fe5c7eb: feat(cli): leoflow build — one command for a whole workspace (#1115) (#1118) (@neochaotic)
• 68f6879: feat(cli): make include_paths copy the files it says it copies (#1062) (#1113) (@neochaotic)
• 668976a: feat(lite): a way to start clean, and a banner that admits what it inherited (#1104, #1105) (#1107) (@neochaotic)
• 98e7f60: feat(lite): seed a declared connection the environment already carries (#1103) (#1108) (@neochaotic)
• 4b82344: fix(api): give clearTaskInstances the Airflow defaults, so an unflagged call cannot destroy state (#1149) (@neochaotic)
• 6d60aed: fix(api): stop reporting a database outage as the caller's fault (#1087, #1071) (#1097) (@neochaotic)
• dc96fe7: fix(chart): gate the probes on a startupProbe, so a slow boot is not a restart loop (#1150) (@neochaotic)
• 81f48bf: fix(chart): make config.cors.allowedOrigins mean something, without widening CORS on upgrade (#1147) (@neochaotic)
• 1e06711: fix(chart): the migration Job was the only workload ignoring pod placement (#1056) (#1111) (@neochaotic)
• 269db27: fix(cli): make a 401 say when the saved token belongs to another server (#1102) (#1106) (@neochaotic)
• 8cb5107: fix(cli): make the wrong-server 401 hint name a command that exists (#1123) (@neochaotic)
• 748ef13: fix(cli): say when a ! in exclude_paths was ignored (#1081) (#1110) (@neochaotic)
• 9abd64a: fix(config): require the OIDC tenant pin at boot, so a login-proof deployment says so (#1146) (@neochaotic)
• aa05761: fix(dbt): a dbt-only DAG was dropping the secrets it declared (#997) (#1112) (@neochaotic)
• f8db184: fix(dbt): refuse an unusable derived task id by name, and pin id stability (#1114) (#1117) (@neochaotic)
• 112e386: fix(dbt): warn loudly when granularity=folder merges two unrelated groups (#1114) (#1116) (@neochaotic)
• 531a242: fix(dev): build each venv on the interpreter the project declares (#1092) (#1093) (@neochaotic)
• 7d18339: fix(server): bound the pod informer's warm-up so a cold cache cannot withhold the listeners (#1141) (@neochaotic)
• 5f0200e: release: prepare v0.4.7-rc.1 (@neochaotic)
• f9fc437: test(e2e): lock what the control plane says when its database dies mid-flight (#1101) (@neochaotic)
• 627c006: test(executor): stop waitForFile handing an empty file to its caller (#1120) (@neochaotic)

---

Artifacts are checksummed (SHA-256) and the checksums file is cosign-signed
(keyless). Verify with cosign verify-blob.