Slizen v0.2.3-rc.1

Slizen v0.2.3-rc.1

This is a prerelease for external staging trials, not a production-readiness claim.

Release identity:

• tag: v0.2.3-rc.1
• commit: 7662a1fb5974a6fc369ca486d2a59c85f68cd3b7
• image: ghcr.io/slizendb/slizen@sha256:e30ad22f4cb23462af9f05322ff97d6796fc521e2e80dc181c42107e4193b92a
• platforms: linux/amd64, linux/arm64

The latest and 0.2 aliases remain on verified stable v0.2.2:
sha256:7989b6ff17659b3f1b2f1d3feec8af6422b48f1f5486eb77247a5c82ba86b627.

What changed

• Bounded two-hit cache admission reduces cold-start origin reads without increasing the configured global cache limits.
• Supported proxied writes invalidate before dispatch and use cache epochs so overlapping reads cannot restore superseded values.
• Exact option-free SET can refresh an already admitted cache-policy key after upstream success; it does not admit cold keys.
• slizenctl compatibility report provides a deterministic offline command-contract preflight.
• Observe-first Helm/Kubernetes packaging now includes default-deny ingress, explicit peer controls, bounded resources, staging values, dashboards, alerts, and rollback-oriented operator documentation.
• Metrics now cover active connections, configured cache bounds, miss reasons, tracker-capacity drops, and Go/process collectors.
• Release artifacts are self-contained and bound to the exact tag, commit, image digest, and provenance.

Exact-image evidence

The published digest was tested against Valkey 8.1.9 with four isolated,
100,000-operation scenarios:

Scenario	Physical origin GET reduction	Cache hit ratio	Direct p99	Slizen p99
uniform	97.516%	97.487%	1.082 ms	1.819 ms
skew-80/20	97.969%	97.959%	1.211 ms	1.889 ms
skew-99/1	99.201%	99.182%	1.530 ms	2.049 ms
moving-flash	99.130%	99.096%	7.108 ms	8.979 ms

All scenarios had valid physical INFO commandstats evidence, zero request
failures, zero value mismatches, zero validation failures, and zero validation
mismatches.

The direct path had lower p99 in every scenario. The defensible product claim
is reduced upstream GET load for these exact workloads, not that Slizen
makes Redis or Valkey faster and not that every workload receives a 99%
reduction.

Artifacts

• slizen-0.2.3-rc.1.tgz — release-bound Helm chart with bundled operator docs
• slizen-observe-sidecar-0.2.3-rc.1.yaml — raw observe-first sidecar pattern
• release-evidence-manifest.json — version/commit/image/artifact identity
• SHA256SUMS — checksums for every attached evidence file
• exact-image workload, benchmark, status, audit, hot-key, and demo evidence

The image, Helm chart, and raw sidecar manifest have GitHub-native build
provenance attestations.

Known limitations

• Single-node developer preview; Redis or Valkey remains the source of truth.
• Direct writes to the origin can remain stale until local TTL expiry.
• Limited Redis command compatibility.
• No Redis Cluster or Sentinel discovery/failover.
• No downstream RESP authentication/TLS, no upstream Redis/Valkey TLS, and no built-in admin API authentication.
• Every sidecar replica has independent disposable cache state.
• External self-service staging is not considered proven until an unfamiliar operator completes the install, rollback, failure drills, and soak gate without maintainer intervention.