v3.0.0

Runner v3.0.0

This breaking release defines HTTPS as the runner-facing transport. NATS
JetStream remains an internal, durable implementation detail behind the runner
gateway and is not exposed to runner agents or deployment Jobs.

Runner agents authenticate with short-lived Ed25519 JWTs and long-poll their
runner-specific HTTPS endpoint. Deployment Jobs use deployment-scoped tokens
to download bundles and upload results and bounded encrypted logs. Commands
remain durable while an agent is offline, and encrypted delivery receipts let
any gateway replica acknowledge, retry, or reject a command without sticky
sessions.

The runner image now supports the central and protected-side gateway processes
in addition to agent and deployment execution. Central deployments should run
at least two stateless gateway replicas. A separate public gateway URL is used
for external and ECS Jobs, while directly scheduled Kubernetes Jobs can use a
cluster-internal Service URL.

Edge mode adds a persistent HTTPS outbox for results and encrypted logs when
the return path is unavailable. Multi-node installations require shared
ReadWriteMany storage. Air-gap mode places a gateway and JetStream inside the
protected compartment and exchanges signed files through the boundary. A
separately authorized reverse relay is required to return results and logs; a
physically one-way diode cannot provide that path.

Use Kubernetes runner chart 0.3.0 and data-plane v3.0.0. Do not mix this
runner with the v2 data-plane or the 0.2.x runner chart.

The simple and edge paths were exercised locally with real JetStream, two
gateway replicas, and a Kind runner that deployed a real Kubernetes resource.
The physical diode path and live ECS execution were not qualified. Logs remain
bounded encrypted objects; this release does not add live log tailing.

v2.0.0

Runner v2.0.0

This breaking release replaces the direct runner HTTP transport with durable
NATS JetStream commands, results, and encrypted log objects.

Remote runners now require NATS_URL, ORG_ID, and RUNNER_ID, plus one of
NATS_TOKEN, NATS_CREDS_FILE, or mTLS client credentials. The old runtime
private key and remote API endpoint are no longer consumed.

The image supports simple and edge operation. Edge mode persists outbound
results and logs while disconnected and requires shared ReadWriteMany storage
when the Job and flusher can run on different nodes. Logs remain bounded,
encrypted objects rather than a live stream.

The signed file relay and protected-side NATS process for the air-gap design are
included, but the physical diode path was not tested and is not qualified by
this release.

Use Kubernetes runner chart 0.2.0. Do not mix this image with v1 data-plane
images or the 0.1.x runner chart.

chart-v0.3.0

Kubernetes agent runner chart 0.3.0

This breaking chart release deploys runner v3.0.0 and standardizes the
runner-facing protocol on outbound HTTPS. Runner agents and deployment Jobs no
longer receive NATS endpoints or broker credentials.

All modes use an Ed25519 runner identity stored in a Kubernetes Secret:

• simple connects to the central HTTPS runner gateway and relies on central
  JetStream for durable command buffering.
• edge adds a persistent outbound result and encrypted-log outbox. It
  requires an RWX-capable StorageClass on multi-node clusters.
• airgap deploys a protected-side gateway and JetStream. Signed file relays
  transfer commands and bundles into the compartment and results and logs back
  through a separately authorized return path.

Private gateway CAs and mutual TLS are supported. The chart validates mode,
identity, gateway URL, protected-side Secret, and outbox combinations before it
renders.

Simple, edge, and air-gap manifests were linted and rendered. Simple and edge
were exercised with a real local gateway and runner deployment. The physical
diode path was not tested and is not qualified by this release.

chart-v0.2.0

Kubernetes agent runner chart 0.2.0

This breaking chart release deploys runner v2.0.0 and replaces the old private
key and direct HTTP runner configuration with NATS transport settings.

Configure nats.url and a token, NATS credentials file, or mTLS client
credentials. Edge mode also requires a ReadWriteMany storage class for its
persistent outbound spool. The optional protected-side NATS and diode relay
templates are included for the air-gap design, but the physical diode path was
not qualified in this release.

v1.0.3

Full Changelog: v1.0.2...v1.0.3

v1.0.2

Full Changelog: v1.0.1...v1.0.2

v1.0.1

Full Changelog: v1.0.0...v1.0.1

v1.0.0

Initial public release.