idryx v1.2.2

Idryx 1.2.2

A patch release on the 1.2 surface. The idryx image, ghcr.io/taipanbox/idryx, is signed in the legacy .sig format that the cluster admission controller (policy-controller v0.15.1) reads, so the signature is verifiable there. Its reader takes only that tag, and before this release the image signature was not. cosign stays at v3.1.3, and the release workflow's sign-blob steps are unchanged. Nothing is read, emitted, refused or stored differently, and no frozen name moved: scripts/compat-surface.sh holds that.

What changed since 1.2.1

• The agent-stack-go pin moves to v1.3.0 (bf547eb, merged as #105). A dependency bump. Nothing in idryx's own surface moves with it.
• The agent-stack-go pin moves to the v2 module path, v2.0.0 (#107). The shared wire-type import moves to github.com/TAIPANBOX/agent-stack-go/v2. Nothing an operator sets or sees moves with it.
• The image is signed in the legacy format (#108). The image sign step adds --new-bundle-format=false --use-signing-config=false, with a comment above it. Remove both flags when policy-controller reads bundles.

No other commit lies between the 1.2.1 tag and this release.

Upgrade: the event stream file

This is an operator-visible change that arrived in a patch release, and these notes say so rather than leave it out.

Since agent-stack-go v2, a stream file this service creates is mode 0640, not 0644: the owning account and its group can read it, and no other account can. A new stream file is created only in a directory this service's account owns. An existing file is opened as it is.

A bus directory that is shared between services and not owned by this service's account gets no new stream, unless each file is created beforehand by the uid of the service that writes it. Before you start this release, check who owns the bus directory and the mode of each stream file in it.