v0.4.5-rc.3

Leoflow v0.4.5-rc.3

A 0.x (pre-1.0) build — SemVer carries the maturity, there is no separate
alpha/beta, and the pre-alpha series ended at v0.0.1 (ADR 0037). APIs and
on-disk shape may still evolve between minor versions; -rc.N tags are release
candidates gated by the E2E suite. Install this exact release with:

curl -fsSL https://raw.githubusercontent.com/neochaotic/leoflow/v0.4.5-rc.3/install.sh | LEOFLOW_VERSION=v0.4.5-rc.3 sh

A bare curl … | sh installs the latest stable release (/releases/latest
excludes pre-releases), so on a pre-release page it would NOT give you v0.4.5-rc.3.
LEOFLOW_VERSION must sit on the sh side of the pipe (not curl) — a
VAR=x curl … | sh prefix sets the var for curl only, so install.sh would
not see it and would fall back to latest-stable.

Changelog

• 7df0750: build: delete the ADR index generator, which has failed every make ci-local (#989) (@neochaotic)
• bd4cf9b: ci(ui-smoke): cap and cache the browser install, and make the smoke exit symmetrically (#987) (@neochaotic)
• ae5f892: ci: pull service containers from a registry that does not rate-limit by IP (#1018) (@neochaotic)
• 5ba323c: cut-release: let an interrupted cut resume, and promote the docs root on a GA (#990) (@neochaotic)
• 7ee3f59: docs(agents): the lessons this cut paid for, and leoflow.yaml as the standard (#1000) (@neochaotic)
• 01641fb: docs(changelog): one Changed section under Unreleased, not two (#972) (@neochaotic)
• 517c8d2: docs(release): point the RC runbook at v0.4.5, and stop it certifying the wrong cloud (#1012) (@neochaotic)
• 7a6410d: fix(cli): refuse a dbt: block alongside a dag.py instead of dropping the Python (#1015) (@neochaotic)
• 3ae3350: fix(release): a transient flake during a cut no longer costs a tag (#1017) (@neochaotic)
• cf8fbcc: fix: bake a hybrid DAG's dbt projects into the image (#20) (#992) (@neochaotic)
• 8e22123: fix: make additionalProperties:false reachable, and validate a dbt-only project (#15, #996) (#999) (@neochaotic)
• e1349a5: fix: ship the leoflow authoring package in the task image (#17) (#991) (@neochaotic)
• ed8b511: fix: the entry points a newcomer touches first, and two links I broke today (#988) (@neochaotic)
• 73883e9: fix: two dbt entrypoint defects — host path baked in, and an unreachable profiles.yml (#993, #994) (#998) (@neochaotic)
• 5c3fd1c: release: prepare v0.4.5-rc.3 (@neochaotic)
• c62f958: test(e2e): make the mixed-mode e2e prove the path instead of bypassing it (#1008) (@neochaotic)

---

Artifacts are checksummed (SHA-256) and the checksums file is cosign-signed
(keyless). Verify with cosign verify-blob.