v0.1.0-rc.1

Changelog

Features

• 872f1f1: feat(api): CRD types and manifests for policy.querdian.dev/v1alpha1 (geilername maximilian.marschall@3xm.at)
• 4ec5fcc: feat(auth): OIDC bearer-token authentication (T1.7) (geilername maximilian.marschall@3xm.at)
• b046148: feat(chart): add Helm chart with RBAC, network policies and tracing env (geilername maximilian.marschall@3xm.at)
• 213ce3b: feat(chart): optional Grafana dashboard ConfigMap; keep Go tests out of the packaged chart (geilername maximilian.marschall@3xm.at)
• 354d12b: feat(cmd): register the LogQL and TraceQL enforcers (geilername maximilian.marschall@3xm.at)
• a66d7d3: feat(cmd): register the PromQL enforcer (geilername maximilian.marschall@3xm.at)
• 2487741: feat(config): static config file and flags (geilername maximilian.marschall@3xm.at)
• e33041c: feat(controller): snapshot lifecycle and leader-elected status writer (geilername maximilian.marschall@3xm.at)
• f715343: feat(dashboards): add Grafana overview dashboard and docs (geilername maximilian.marschall@3xm.at)
• 3c07a5b: feat(fanout): merge Loki log stream responses (geilername maximilian.marschall@3xm.at)
• 45de2f7: feat(fanout): redact Tempo search metadata and filter tag lists (geilername maximilian.marschall@3xm.at)
• af75bce: feat(fanout): sum Loki stats, volume and pattern responses (geilername maximilian.marschall@3xm.at)
• 076d5ca: feat(logql): add clean-room lexer (geilername maximilian.marschall@3xm.at)
• 14ad169: feat(logql): add parser, AST and canonical String (T3.2) (geilername maximilian.marschall@3xm.at)
• f8db76f: feat(logql): filter denied labels out of Loki series responses; share the series filter in enforce (geilername maximilian.marschall@3xm.at)
• 995a697: feat(logql): inject policy matchers, scan denied labels, or-lift and fan-out (geilername maximilian.marschall@3xm.at)
• c1b4bb6: feat(logql): label, detected_* and series endpoints with string-set merge (geilername maximilian.marschall@3xm.at)
• 8a260c7: feat(observability): add tracing, metrics, logging and privacy helpers (geilername maximilian.marschall@3xm.at)
• da541d4: feat(policy): DNF normalisation with semantic-equivalence fuzzing (geilername maximilian.marschall@3xm.at)
• 8b8ac73: feat(policy): compile CRDs into indexed rules with status results (geilername maximilian.marschall@3xm.at)
• de7b5f3: feat(policy): snapshot and resolver with tenant binding (geilername maximilian.marschall@3xm.at)
• 1862e80: feat(promql): expand match[] on series, labels and label values (geilername maximilian.marschall@3xm.at)
• 714fa52: feat(promql): filter denied labels out of series responses (geilername maximilian.marschall@3xm.at)
• 29e9ba4: feat(promql): or-lift queries for policies with several terms (geilername maximilian.marschall@3xm.at)
• fe1a323: feat(promql): single-term injection and denied-label checks (geilername maximilian.marschall@3xm.at)
• ea02190: feat(proxy): Loki tail WebSocket fan-out (T3.7) (geilername maximilian.marschall@3xm.at)
• 9b8b131: feat(proxy): apply Plan.ResponseFilter to streamed 2xx responses, failing closed (geilername maximilian.marschall@3xm.at)
• 6b14322: feat(proxy): log the cause of failed merges and fan-outs; surface it in E2E test output (geilername maximilian.marschall@3xm.at)
• e9e3d28: feat(quickstart): 24 h of deterministic demo history and provisioned dashboards (geilername maximilian.marschall@3xm.at)
• 83c228f: feat(quickstart): enable the policy dashboard on localhost:8081 (geilername maximilian.marschall@3xm.at)
• edaf515: feat(quickstart): kind quickstart with Keycloak, Grafana, LGTM stack and verify script (T5.3) (geilername maximilian.marschall@3xm.at)
• 7b57c78: feat(quickstart): redacted-label demo for the order team (geilername maximilian.marschall@3xm.at)
• f21434b: feat(routes): settle Loki detected_labels and POST query via black-box test (geilername maximilian.marschall@3xm.at)
• 44f388e: feat(server): register Loki/Tempo mergers, trace-by-ID filter and per-request policy context (geilername maximilian.marschall@3xm.at)
• cd0db92: feat(server): route WebSocket tail requests through a tail planner and ServeTail (geilername maximilian.marschall@3xm.at)
• f1d3078: feat(server): wire auth, policy, enforcement and proxy into the proxy and management servers (geilername maximilian.marschall@3xm.at)
• b826f7e: feat(site): client-side documentation search (geilername maximilian.marschall@3xm.at)
• 2732148: feat(site): typo-tolerant documentation search (geilername maximilian.marschall@3xm.at)
• 8592968: feat(traceql): add TraceQL parser with filter location and canonical String (geilername maximilian.marschall@3xm.at)
• 86e5415: feat(traceql): add clean-room TraceQL lexer (geilername maximilian.marschall@3xm.at)
• 8ae8986: feat(traceql): filter trace-by-ID responses by policy (geilername maximilian.marschall@3xm.at)
• fa63d79: feat(traceql): inject policy DNF and enforce denied attributes for Tempo (geilername maximilian.marschall@3xm.at)
• 74bfe5a: feat(ui): show label redaction in the policy dashboard (geilername maximilian.marschall@3xm.at)
• f8395db: feat: opt-in redaction of label values in query results (labels.redact) (geilername maximilian.marschall@3xm.at)
• 5b07e0b: feat: optional read-only policy dashboard (geilername maximilian.marschall@3xm.at)
• 4fe659e: feat: repository scaffold and governance files (geilername maximilian.marschall@3xm.at)

Bug fixes

• abb1c02: fix(chart): give every backendProtection target its own policy name (geilername maximilian.marschall@3xm.at)
• dfed768: fix(deps): bump x/net and Tempo protobuf types; filter unmappable Tempo advisories (geilername maximilian.marschall@3xm.at)
• 57d0b71: fix(deps): require Go 1.27.2 (geilername maximilian.marschall@3xm.at)
• 1bfe673: fix(fanout): merge index/volume_range branches that Loki answers with an empty vector (geilername maximilian.marschall@3xm.at)
• 73e6d61: fix(fanout): merge single-step volume_range vectors as matrices (geilername maximilian.marschall@3xm.at)
• fd33e89: fix(logql): express tenant binding of metric queries as a negative matcher (geilername maximilian.marschall@3xm.at)
• be3a0d1: fix(promql): deny U__-escaped label names on label values (geilername maximilian.marschall@3xm.at)
• 0193fa2: fix(proxy): forward client headers by allow-list, reject protocol switches (geilername maximilian.marschall@3xm.at)
• 2bc6eea: fix(proxy): reject every repeated single-valued parameter (geilername maximilian.marschall@3xm.at)
• d063fc7: fix(proxy): withhold upstream error text from redacted requests (geilername maximilian.marschall@3xm.at)
• 21afe09: fix(quickstart): traces dashboard defaults to 12 h so slow spans exist for every user (geilername maximilian.marschall@3xm.at)
• c2f4968: fix(site): use hugo.Data instead of deprecated site.Data (geilername maximilian.marschall@3xm.at)
• a6d8cff: fix(traceql): reject backtick strings in the lexer (geilername maximilian.marschall@3xm.at)
• 5de26cc: fix(traceql): reject quoted attribute names on tag values (geilername maximilian.marschall@3xm.at)
• cd4cbb6: fix: bump Go to 1.27.3 (GO-2026-6809) (geilername maximilian.marschall@3xm.at)
• 70fed4c: fix: resolve go.mod/go.sum conflict markers from t1.6 merge (geilername maximilian.marschall@3xm.at)

Other changes

• ed52cd2: Merge main into t3.8-loki-e2e (geilername maximilian.marschall@3xm.at)
• 6a336af: Merge remote-tracking branch 'origin/main' into feat/label-redaction (geilername maximilian.marschall@3xm.at)
• 23f483c: build(tempopb): copy the OTLP protobuf types instead of importing Tempo (geilername maximilian.marschall@3xm.at)
• 66d67d2: ci,docs: chart and e2e CI jobs, issue/PR templates, CODEOWNERS, contribution requirements (geilername maximilian.marschall@3xm.at)
• af923ba: feat(proxy,fanout): request normalisation, header handling, streaming proxy and fan-out executor (geilername maximilian.marschall@3xm.at)
• dad9465: feat(routes,enforce): add Enforcer types and default-deny route tables (geilername maximilian.marschall@3xm.at)
• 2d5342c: fix(enforce/traceql): reject compare() unless the root span is covered (geilername maximilian.marschall@3xm.at)
• 4c9e482: fix(enforce/traceql): reject trace-level intrinsics unless the root span is covered (geilername maximilian.marschall@3xm.at)
• a0a9bdd: fix(logql,routes): reject templates reading all labels when labels are denied; drop legacy Tempo search params (geilername maximilian.marschall@3xm.at)
• 4cd702e: wip(e2e): Loki differential, equivalence, tail and isolation suite (T3.8) (geilername maximilian.marschall@3xm.at)
• 0170f1e: wip(quickstart): demo data generator, backfill manifests, dashboards (geilername maximilian.marschall@3xm.at)
• 7005cab: wip(quickstart): fix Keycloak JVM flags and verify assertions (geilername maximilian.marschall@3xm.at)
• 2842115: wip(quickstart): fix helm values file, docs draft (geilername maximilian.marschall@3xm.at)
• 259b878: wip(quickstart): kind quickstart scripts and manifests (T5.3) (geilername maximilian.marschall@3xm.at)
• 45e3efe: wip(quickstart): single backendProtection target, verify fixes (geilername maximilian.marschall@3xm.at)
• ea7be92: wip(quickstart): verify history and dashboards, dashboards test, tempo memory (geilername maximilian.marschall@3xm.at)

Verify

cosign verify ghcr.io/querdian-dev/querdian:0.1.0-rc.1 \
  --certificate-identity-regexp '^https://github.com/querdian-dev/querdian/\.github/workflows/release\.yml@refs/tags/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com