release-2026-10-16

Highlights

Core now carries identity as well as source control. A new auth.wxops.cloud group — oidc-connection, oidc-connector, oidc-client and oidc-static-password —
writes the records the W'xOps dexidp chart turns into a Dex configuration, with the per-org team allow-list generated from labelled XScmTeams, and scm-team joins the
scm family to feed it. Every package now also reports synced and syncMessage, and ready is false while a composed resource's last apply failed — a failed
update used to hide behind a Ready=True left over from the last success. scm-connection summarises the org it points at in its status, and scm-oauth-app gains a
required vendor so a GitHub connection no longer fails on the Gitea provider.

Compatibility

API group platform.wxops.cloud. Change tiers are measured against release-2026-10-09 by tests/api_compat.py.

Package	Kind	API	Change	In this release
platform-database-clusters	XPlatformDatabaseCluster	v1alpha1	safe	rebuilt — ghcr.io/wxops-idp/wxops-core/platform-database-clusters:release-2026-10-16
tenant-database	XTenantDatabase	v1alpha1	safe	rebuilt — ghcr.io/wxops-idp/wxops-core/tenant-database:release-2026-10-16
tenant-app	XTenantApp	v1alpha1	safe	rebuilt — ghcr.io/wxops-idp/wxops-core/tenant-app:release-2026-10-16
scm-connection	XScmConnection	v1alpha1	safe	rebuilt — ghcr.io/wxops-idp/wxops-core/scm-connection:release-2026-10-16
scm-repository	XScmRepository	v1alpha1	safe	rebuilt — ghcr.io/wxops-idp/wxops-core/scm-repository:release-2026-10-16
scm-oauth-app	XScmOAuthApp	v1alpha1	breaking	rebuilt — ghcr.io/wxops-idp/wxops-core/scm-oauth-app:release-2026-10-16
scm-team	XScmTeam	v1alpha1	safe — new package	ghcr.io/wxops-idp/wxops-core/scm-team:release-2026-10-16
oidc-connection	XOIDCConnection	v1alpha1	safe — new package	ghcr.io/wxops-idp/wxops-core/oidc-connection:release-2026-10-16
oidc-static-password	XOIDCStaticPassword	v1alpha1	safe — new package	ghcr.io/wxops-idp/wxops-core/oidc-static-password:release-2026-10-16
oidc-client	XOIDCClient	v1alpha1	safe — new package	ghcr.io/wxops-idp/wxops-core/oidc-client:release-2026-10-16
oidc-connector	XOIDCConnector	v1alpha1	safe — new package	ghcr.io/wxops-idp/wxops-core/oidc-connector:release-2026-10-16

Changes that are not additive:

• scm-oauth-app · breaking (allowed) · required-added · v1alpha1.spec.parameters.vendor — existing XRs do not set it and fail validation
• scm-oauth-app · breaking (allowed) · replay-invalid · tests/cases/scm-oauth-app/gitea-managed/xr.yaml — parameters: 'vendor' is a required property
• scm-oauth-app · breaking (allowed) · replay-invalid · tests/cases/scm-oauth-app/gitea-tenant-path/xr.yaml — parameters: 'vendor' is a required property
• scm-oauth-app · breaking (allowed) · replay-invalid · tests/cases/scm-oauth-app/github-observed/xr.yaml — parameters: 'vendor' is a required property
• scm-oauth-app · breaking (allowed) · replay-invalid · examples/scm-oauth-app/github-observed.yaml — parameters: 'vendor' is a required property
• scm-oauth-app · breaking (allowed) · replay-invalid · examples/scm-oauth-app/xr.yaml — parameters: 'vendor' is a required property

scm-oauth-app now requires spec.parameters.vendor (gitea or github). The module is chosen by it, as on scm-repository and scm-team: the Gitea provider
calls its base URL the moment it is configured, so one module that declared it failed on a GitHub connection. An existing XScmOAuthApp that does not set vendor fails
validation once this release's XRD installs, and its Workspace keeps running whatever module it last rendered until the field is added. A first version defaulted vendor
to gitea; on a real cluster Crossplane rendered an existing XR without the defaulted value and left the Workspace on a placeholder module, so it is required instead.

Rolling back is lossy for any XScmOAuthApp that already sets vendor: reinstalling the previous XRD prunes the field, and a GitHub application goes back to the
single Gitea module that cannot serve it. A Gitea application is unaffected either way.

Everything else is safe and additive: synced and syncMessage on every kind, and for scm-connection the org, repositories and teams status plus one extra
read-only Workspace per connection that has an org.

Upgrade notes

• Add vendor to every existing XScmOAuthApp (gitea or github, matching its scmRef connection), then re-apply. For the one Gitea application most clusters
  have, that is vendor: gitea. Do it before upgrading the XRD, or immediately after.
• ready can now go false on a resource that used to read true. A kind whose last apply failed reports ready: false, synced: false and the provider's message in
  syncMessage; that is the intended change, not a regression. The native XR Ready condition follows. A failing credential push, a scheduled backup, or the connection's
  org inspection is shown in syncMessage but does not flip ready.
• scm-connection adds a read-only inspect Workspace when org is set. It needs a token that can read the org; on Gitea, listing teams also needs the token's user to be
  a member of the org. If it cannot run, status.org stays absent and the reason is in syncMessage — the connection itself is unaffected.
• New in scm-team: on GitHub, members[] must already belong to the org or the apply is refused naming them; on Gitea, adding a member is how they join. On Gitea,
  permission is read or write (admin is rejected) and unitPermissions lays per-unit overrides over units.
• The auth group needs the dexidp chart (or another consumer of the OpenBao records). Core writes records only: it renders no config and restarts nothing.
  Clients are platform-defined; tenants are not meant to create them. Rotation is by rotation.generation only — there is no scheduled rotation.
• Release tooling: make release clears the scm-oauth-app allowance in tests/api-compat-allow.yaml for this release.

Known issues

• High availability and scale are untested: how a bad config behaves across Dex replicas under the chart's maxUnavailable, what happens with a non-valid bcrypt hash in a
  static-password record, and the scm.wxops.cloud/oidc-login selector at a large team count. Tracked as RFC-004 open question 8.
• A GitHub connection's org inspection lists members as a side effect of listing repositories, which costs extra API calls for a large org.
• XOIDCConnector does not de-duplicate a team that is both hand-listed and generated; the entry appears twice.

---

Packages

API group platform.wxops.cloud. Change tiers are measured against release-2026-10-09 by tests/api_compat.py.

Package	Kind	API	Change	In this release
platform-database-clusters	XPlatformDatabaseCluster	v1alpha1	safe	rebuilt — ghcr.io/wxops-idp/wxops-core/platform-database-clusters:release-2026-10-16
tenant-database	XTenantDatabase	v1alpha1	safe	rebuilt — ghcr.io/wxops-idp/wxops-core/tenant-database:release-2026-10-16
tenant-app	XTenantApp	v1alpha1	safe	rebuilt — ghcr.io/wxops-idp/wxops-core/tenant-app:release-2026-10-16
scm-connection	XScmConnection	v1alpha1	safe	rebuilt — ghcr.io/wxops-idp/wxops-core/scm-connection:release-2026-10-16
scm-repository	XScmRepository	v1alpha1	safe	rebuilt — ghcr.io/wxops-idp/wxops-core/scm-repository:release-2026-10-16
scm-oauth-app	XScmOAuthApp	v1alpha1	breaking	rebuilt — ghcr.io/wxops-idp/wxops-core/scm-oauth-app:release-2026-10-16
scm-team	XScmTeam	v1alpha1	safe	rebuilt — ghcr.io/wxops-idp/wxops-core/scm-team:release-2026-10-16
oidc-connection	XOIDCConnection	v1alpha1	safe	rebuilt — ghcr.io/wxops-idp/wxops-core/oidc-connection:release-2026-10-16
oidc-static-password	XOIDCStaticPassword	v1alpha1	safe	rebuilt — ghcr.io/wxops-idp/wxops-core/oidc-static-password:release-2026-10-16
oidc-client	XOIDCClient	v1alpha1	safe	rebuilt — ghcr.io/wxops-idp/wxops-core/oidc-client:release-2026-10-16
oidc-connector	XOIDCConnector	v1alpha1	safe	rebuilt — ghcr.io/wxops-idp/wxops-core/oidc-connector:release-2026-10-16

Changes that are not additive:

• scm-oauth-app · breaking · required-added · v1alpha1.spec.parameters.vendor — existing XRs do not set it and fail validation
• scm-oauth-app · breaking · replay-invalid · tests/cases/scm-oauth-app/gitea-managed/xr.yaml — parameters: 'vendor' is a required property
• scm-oauth-app · breaking · replay-invalid · tests/cases/scm-oauth-app/gitea-tenant-path/xr.yaml — parameters: 'vendor' is a required property
• scm-oauth-app · breaking · replay-invalid · tests/cases/scm-oauth-app/github-observed/xr.yaml — parameters: 'vendor' is a required property
• scm-oauth-app · breaking · replay-invalid · examples/scm-oauth-app/github-observed.yaml — parameters: 'vendor' is a required property
• scm-oauth-app · breaking · replay-invalid · examples/scm-oauth-app/xr.yaml — parameters: 'vendor' is a required property

---

[release-2026-10-16] — 2026-10-16

CI/CD

• ci: Update gen readme script and move scripts out gitea to github [skip ci] (a86c6c3)

Documentation

• Record sync state, platform-defined OIDC clients, dropped scheduled rotation and masked finished rollout ...

release-2026-10-09

Highlights

The SCM family ships: scm-connection, scm-repository and scm-oauth-app replace Core's
Gitea-only coverage with one API that works against Gitea and GitHub, built entirely on OpenTofu.
gitea-user/-org/-team/-repository and the random-password utility are retired in the same
release — archived, not deleted, since no cluster ever ran them. Packages are now grouped by API
group (package/<group>/<name>/), the OCI registry moved to ghcr.io/wxops-idp, and
development-docs/ now holds everything about building and deciding Core, separate from the
user-facing docs in docs/.

Compatibility

API group platform.wxops.cloud. Change tiers are measured against release-2026-09-16 by tests/api_compat.py.

Package	Kind	API	Change	In this release
platform-database-clusters	XPlatformDatabaseCluster	v1alpha1	safe	rebuilt — ghcr.io/wxops-idp/wxops-core/platform-database-clusters:release-2026-10-09
tenant-database	XTenantDatabase	v1alpha1	safe	rebuilt — ghcr.io/wxops-idp/wxops-core/tenant-database:release-2026-10-09
tenant-app	XTenantApp	v1alpha1	safe	rebuilt — ghcr.io/wxops-idp/wxops-core/tenant-app:release-2026-10-09
scm-connection	XScmConnection	v1alpha1	safe — new package	ghcr.io/wxops-idp/wxops-core/scm-connection:release-2026-10-09
scm-repository	XScmRepository	v1alpha1	safe — new package	ghcr.io/wxops-idp/wxops-core/scm-repository:release-2026-10-09
scm-oauth-app	XScmOAuthApp	v1alpha1	safe — new package	ghcr.io/wxops-idp/wxops-core/scm-oauth-app:release-2026-10-09
gitea-user	XGiteaUser	v1alpha1	breaking — removed	archived, no longer served
gitea-org	XGiteaOrg	v1alpha1	breaking — removed	archived, no longer served
gitea-team	XGiteaTeam	v1alpha1	breaking — removed	archived, no longer served
gitea-repository	XGiteaRepository	v1alpha1	breaking — removed	archived, no longer served

The four gitea-* removals are the one breaking change in this release, allowlisted in
tests/api-compat-allow.yaml. An operator with an existing
XGiteaUser/XGiteaOrg/XGiteaTeam/XGiteaRepository XR will see it fail validation once this
release's XRDs install — there is no gitea-* XRD in this release to validate against, and no
migration path, because retiring these packages was a direct decision, not a phased deprecation:
real testing found no cluster had ever run them. If one somehow exists, read it off before
upgrading; its Terraform state and the Gitea objects it manages are untouched by the removal
itself, but Core stops being able to reconcile or delete them. Source, tests, examples and docs for
all four packages are kept, not deleted — package/platform/archives/<name>/ and the sibling
_archives/ folders — see RFC-003 §Removing the old kinds.

The random-password utility composition is retired the same way (package/platform/archives/random-password/).
It was never published as its own OCI package, so it carries no formal compatibility tier, but any
cluster with a live XRandomPassword XR loses the ability to reconcile it the same way.

Every other change in this release is additive: scm-connection, scm-repository and
scm-oauth-app are new packages (safe by definition — nothing existing depends on them yet), and
platform-database-clusters/tenant-database/tenant-app carry no schema change, only a rebuild
under the new package layout and registry.

Upgrade notes

• OCI registry moved. Package images are now ghcr.io/wxops-idp/wxops-core/<package>, not
  ghcr.io/wxops/wxops-core/<package>. Update any pinned spec.package reference and re-run
  make install (or your GitOps equivalent) — package/install/ in this release already points at
  the new org.
• make providers no longer installs provider-terraform. It's archived in
  providers/archive/, not auto-applied. If a cluster still runs a gitea-* XR on it (see
  Compatibility above), apply providers/archive/provider-terraform.yaml and its ProviderConfig
  by hand before upgrading — don't let the retired provider disappear out from under a resource
  Core can no longer manage.
• Package layout changed on disk. package/<name>/ is now package/<group>/<name>/
  (platform, scm). This only matters if something outside this repo reads source paths
  directly (e.g. a fork, a vendored copy) — the served API and OCI image names are unaffected.

Known issues

None.

---

Packages

API group platform.wxops.cloud. Change tiers are measured against release-2026-09-16 by tests/api_compat.py.

Package	Kind	API	Change	In this release
platform-database-clusters	XPlatformDatabaseCluster	v1alpha1	safe	rebuilt — ghcr.io/wxops-idp/wxops-core/platform-database-clusters:release-2026-10-09
tenant-database	XTenantDatabase	v1alpha1	safe	rebuilt — ghcr.io/wxops-idp/wxops-core/tenant-database:release-2026-10-09
tenant-app	XTenantApp	v1alpha1	safe	rebuilt — ghcr.io/wxops-idp/wxops-core/tenant-app:release-2026-10-09
scm-connection	XScmConnection	v1alpha1	safe	rebuilt — ghcr.io/wxops-idp/wxops-core/scm-connection:release-2026-10-09
scm-repository	XScmRepository	v1alpha1	safe	rebuilt — ghcr.io/wxops-idp/wxops-core/scm-repository:release-2026-10-09
scm-oauth-app	XScmOAuthApp	v1alpha1	safe	rebuilt — ghcr.io/wxops-idp/wxops-core/scm-oauth-app:release-2026-10-09

---

[release-2026-10-09] — 2026-10-09

CI/CD

• ci: Patch installling Python deps before kcl-sync-check (42127f1)
• ci: Rename OCI org to wxops-idp, simplify publish-packages, and refresh architecture diagram (08a34bc)

Chores

• Complete example with composite align with compositionrevision (b0b8e89)
• Change ci for release-name and add rfc as docs for capture and brainstorm new idea (bc66861)

Documentation

• Reformat the documentation style and update outdated one (eb10594)
• Add pull-request template for branch merging, and correct archiving packge for bug_report (3d628ce)
• Update RFC/ADR records, archive ROADMAP.md, and refresh learn docs (b94738b)
• Add rfc 006 for storageObject consideration [skip ci] (74ae231)

Features

• scm: Add scm-connection, scm-repository and scm-oauth-app (b24f947)

Refactor

• Reorganize repo layout, archive gitea-*/random-password, and migrate from terraform to opentofu in core (f520c85)

📖 API reference · VERSIONS.yaml
🔍 Diff vs release-2026-09-16

release-2026-09-16

Highlights

release-2026-09-16 is the first date-named release, and the OSS-readiness release. Every
package is rebuilt and published under a new home, ghcr.io/wxops/wxops-core/<pkg>, replacing the
semver tags (v0.1.0 … v0.4.0) this project used through v0.4.0. Compatibility now lives in the
XRD API version, not the release name — see release-notes/README.md.

Alongside the release mechanics, this is the release that gets the repository ready for outside
contributors: a licence, a code of conduct, a private security-disclosure channel, a README written
for someone with no platform context, and documentation reorganised into sections a newcomer can
actually navigate.

---

Registry and package naming

Packages moved twice in this release, settling on the final shape:

1. platform-wxops-<pkg> → wxops-core-<pkg>, matching the repo name.
2. ghcr.io/wxops/wxops-core-<pkg> → ghcr.io/wxops/wxops-core/<pkg> — the project identity moved
   from a name prefix into the registry path itself, so every package name is now just its own name
   (gitea-user, tenant-app, and so on).

Neither name was ever published before this release, so there is nothing for an existing consumer to
migrate — this is the name every package ships under from here on.

Package channels — a label, not a pipeline

Every package/<pkg>/composition.yaml now carries metadata.labels.channel: stable, committed in
Git; make install-dev overrides it to channel: nightly via a Kustomize labels: transformer, no
build step involved. An XR opts into a channel with two native Crossplane fields —
compositionRevisionSelector.matchLabels + compositionUpdatePolicy: Automatic to auto-track a
channel, or compositionUpdatePolicy: Manual with an explicit compositionRevisionRef to never
auto-move at all (recommended for production XRs). See
docs/development/releasing.md#channels.

This replaces an earlier, considerably heavier design — Kyverno admission policies, a make promote
soak-check pipeline, a phased kind-rehearsal build-out — that was designed and then deliberately
rejected as too complex for a single-maintainer project to operate or explain. See
ADR-001, the
first entry in a new docs/adr/ decision-record convention this release also introduces.

Project infrastructure

• LICENSE (Apache-2.0) and NOTICE, CODE_OF_CONDUCT.md (Contributor Covenant v2.1),
  and SECURITY.md — private disclosure via GitHub Security Advisories.
• README.md rewritten for a reader with no platform context: what problem this solves, ahead of
  the packages table, plus a structural diagram of how a Configuration package becomes a running
  composite resource.
• GitHub is now primary; the Gitea instance is archived (frozen, read-only, kept for internal
  reference and on-request demos).

Documentation reorganised

docs/ moved from a flat file list into six sections behind one hub,
docs/README.md, which also carries
a development matrix (every package, core idea and delivery mechanism, its state and what's next):

• docs/learn/ (new) — four short pages that teach Crossplane, the inline-HCL Terraform pattern,
  and this repo's KCL idioms against real files in the repo, ending with a guided first change.
  Prerequisite reading for docs/development/, not part of it.
• docs/adr/ (new) — architecture decision records, introduced by this release's own channel
  decision (see above).
• docs/api-reference/ — the reconcile loop from a user's side, one page per Kind, the status
  contract.
• docs/core-ideas/ — gained knowledge-architecture.md, multi-cluster-connectivity.md,
  multi-cluster-proposal.md, and multi-cluster-scale.md, plus a substantially expanded
  observability.md and new portal-integration.md.
• docs/user-guide/ and docs/development/ — setup, app onboarding, the development guide,
  and releasing, each now a standalone page instead of a section of a longer file.

Testing

tests/lib/releases.py and a set of _api_compat fixture pairs (content-changed,
default-changed, enum-narrowed, optional-added, property-removed, required-added,
required-in-new-object, resource-renamed, selector-changed, status-field-removed,
type-changed) self-test the safe/careful/breaking classifier itself — each fixture pins the
tier test-api-compat must produce, so the classifier's own correctness is a golden test, not an
assumption.

Compatibility

API group platform.wxops.cloud. Change tiers are measured against v0.4.0 by tests/api_compat.py.

Package	Kind	API	Change	In this release
gitea-user	XGiteaUser	v1alpha1	safe	rebuilt — ghcr.io/wxops/wxops-core/gitea-user:release-2026-09-16
gitea-org	XGiteaOrg	v1alpha1	safe	rebuilt — ghcr.io/wxops/wxops-core/gitea-org:release-2026-09-16
gitea-team	XGiteaTeam	v1alpha1	safe	rebuilt — ghcr.io/wxops/wxops-core/gitea-team:release-2026-09-16
gitea-repository	XGiteaRepository	v1alpha1	safe	rebuilt — ghcr.io/wxops/wxops-core/gitea-repository:release-2026-09-16
platform-database-clusters	XPlatformDatabaseCluster	v1alpha1	safe	rebuilt — ghcr.io/wxops/wxops-core/platform-database-clusters:release-2026-09-16
tenant-database	XTenantDatabase	v1alpha1	safe	rebuilt — ghcr.io/wxops/wxops-core/tenant-database:release-2026-09-16
tenant-app	XTenantApp	v1alpha1	safe	rebuilt — ghcr.io/wxops/wxops-core/tenant-app:release-2026-09-16

Every package is safe-tier against v0.4.0 — no breaking changes, nothing to allowlist. The
schema changes are additive (or, for most packages here, unchanged); what moved is where the
package is published and how it's labelled, not its API.

Upgrade notes

No action required. Nothing was published under either of this release's two intermediate naming
schemes (platform-wxops-<pkg> or ghcr.io/wxops/wxops-core-<pkg>) before this release, so there is
no prior consumer to migrate.

Known issues

None.

---

Packages

API group platform.wxops.cloud. Change tiers are measured against v0.4.0 by tests/api_compat.py.

Package	Kind	API	Change	In this release
gitea-user	XGiteaUser	v1alpha1	safe	rebuilt — ghcr.io/wxops/wxops-core/gitea-user:release-2026-09-16
gitea-org	XGiteaOrg	v1alpha1	safe	rebuilt — ghcr.io/wxops/wxops-core/gitea-org:release-2026-09-16
gitea-team	XGiteaTeam	v1alpha1	safe	rebuilt — ghcr.io/wxops/wxops-core/gitea-team:release-2026-09-16
gitea-repository	XGiteaRepository	v1alpha1	safe	rebuilt — ghcr.io/wxops/wxops-core/gitea-repository:release-2026-09-16
platform-database-clusters	XPlatformDatabaseCluster	v1alpha1	safe	rebuilt — ghcr.io/wxops/wxops-core/platform-database-clusters:release-2026-09-16
tenant-database	XTenantDatabase	v1alpha1	safe	rebuilt — ghcr.io/wxops/wxops-core/tenant-database:release-2026-09-16
tenant-app	XTenantApp	v1alpha1	safe	rebuilt — ghcr.io/wxops/wxops-core/tenant-app:release-2026-09-16

---

[release-2026-09-16] — 2026-09-16

CI/CD

• ci: Change the package OCI location from org to project (b7571fa)

Chores

• Update claude for format the generated documentation [skip ci] (129809c)
• Update pre-commit strategies for release to add changing of documentation [skip ci] (da6b105)

Documentation

• Add new and enhance research about multi-cluster and observability [skip ci] (7e81039)

Features

• Update release machanism with new format and go oss version (5480944)

📖 API reference · VERSIONS.yaml
🔍 Diff vs 0.4.0