v0.5.0

Platform Orchestrator Helm chart 0.5.0

This release makes configurable roles usable as granular orchestrator roles.
Operators can discover the authoritative permission catalog and combine
entity-specific read and write permissions instead of granting one broad write
capability.

Included versions

Component	Version
Control plane	v2.1.0
Data plane	v3.1.0
IAM	v2.2.0
Runner	v3.0.0
Console	v1.2.0
Kubernetes runner chart	0.3.0
NATS Helm dependency	2.14.0

What changed

• IAM publishes a catalog of 34 supported permissions with stable identifiers,
  display names, descriptions, entity groups, and access levels.
• Control-plane and data-plane operations enforce their entity-specific
  permissions.
• The console role editor loads and groups the catalog so roles can be built
  without guessing identifiers or payloads.
• Role create and update requests reject unknown permission identifiers.
• The chart routes the permission catalog endpoint to IAM and checks that route
  as part of its contract suite.
• Existing built-in and configurable roles retain their previous effective
  access through explicit legacy permission implications.

Upgrade

Upgrade normally from chart 0.4.3. IAM v2.2.0 is compatible with the legacy
permission checks used by the previous control plane and data plane, which
allows the workloads to roll independently. No database migration beyond the
schema already shipped in 0.4.3 is required.

Qualification

• All component unit suites and Docker or kind integration suites passed,
  including legacy-role equivalence and granular allow/deny cases.
• The chart passed ct lint and all rendered contract tests.
• A temporary build was deployed over the existing WX1 0.4.3 installation.
  A role limited to module read/write could use module APIs while project and
  deployment writes returned 403.
• The WX1 installer completed base, Redis, and PostgreSQL deployment stages,
  independent verification, and scoped teardown against the upgraded system.