v1.76.5

sluis v1.76.5

Image	ghcr.io/truvity/sluis/sluis:1.76.5
Sidecar image	ghcr.io/truvity/sluis/resource-proxy:1.76.5
Module images	ghcr.io/truvity/sluis/sluis-{issuer,github,slack,google,cloudflare,backup}:1.76.5
Chart	oci://ghcr.io/truvity/charts/sluis:1.76.5
TypeScript	@truvity/sluis@1.76.5 on GitHub Packages
Go	go get github.com/truvity/sluis@v1.76.5

The TypeScript package is published to GitHub Packages at this
version; installing it needs a token that can read packages
(docs/sdk/typescript/sluis.md). The Go module at
this tag is the policy engine, identity and tokens; authz and
directory are not built yet, and docs/sdk/go/sluis.md says
so.

The Lambda zips are one per module, each holding bootstrap built for that module and
refusing to run as another: sluis-issuer_1.76.5_linux_arm64.zip (the issuer, the
signer and the console),
sluis-github_1.76.5_linux_arm64.zip,
sluis-slack_1.76.5_linux_arm64.zip, sluis-google_1.76.5_linux_arm64.zip,
sluis-cloudflare_1.76.5_linux_arm64.zip and
sluis-backup_1.76.5_linux_arm64.zip (deployed as the backup and the restore
function). The single sluis-lambda zip is no longer published
(docs/reference/sluis/lambda.md). The telemetry layer is
otlp-lambda-layer_<version>_linux_<arch>.zip from truvity/observability;
sluis ships none.

sluisctl is its own archive, because it is the one thing here that
runs on somebody's own laptop.

Changelog

Features

• 0cef8a0: feat(deploy): spec, the deploy names and checks without the Pulumi SDK (@excavador)
• 2dd37d2: feat(deploy): spec.ChartSecret, one entry of the chart's secrets value (@excavador)
• eb34330: feat(audit): deploy/spec, the audit deploy names and checks without the Pulumi SDK (@excavador)

Bug Fixes

• 4d3c5ed: fix(config): keys.archive is deprecated and ignored, not long-term storage (@excavador)
• 54a3283: fix(deploy): NewBackup no longer creates the idle resume schedule (@excavador)
• 5834dc6: fix(deploy): spec.CheckVerifyKey delegates to the issuer's own key parser (@excavador)

Other

• 5ae31be: docs(chart): describe the backup example in format 2 terms (@excavador)
• 5afbabc: docs(sluis): reword the console-function and one-process wording for one function per module (@excavador)
• 18b38d6: docs(changelog): v1.76.5 entries (@excavador)
• 640f7d2: perf(lambda): flush metrics at most once a minute per instance (@excavador)
• 4dd7a4d: perf(config): remember the outcome of loading the same documents (@excavador)
• 372e688: style(memo): do not shadow the built-in max (@excavador)
• b7f73cd: docs(config): a future env layer merges above Load, so the memo key stays the document set (@excavador)
• 0ce77f4: docs(audit): name the real paths in the deploy/spec comments (@excavador)