0.31–0.33 — Entity Runtime lowering, sidecars a binding must name, and a Secret that is only present
Three releases. One carries a specification into a runtime, and two tighten what an observed cluster is allowed to say — about the containers a workload runs, and about the Secrets it reads.
A service contract becomes Entity Runtime definitions
0.31.0 adds ess-entity-runtime, which projects an admitted service contract into validated
Entity Runtime definitions and the typed host binding obligations they leave. Conditional outcome
selection, exact values and event order are preserved. What cannot be lowered faithfully is
refused by name — a cleared field, a silent preserve with no response — rather than approximated.
0.33.0 moves the target to Entity Runtime 0.24.1.
A bound workload runs nothing it does not declare
0.32.0 imports OpenAPI 3.0 by rewriting each schema to its 3.1 form, and reports a null it cannot
carry as a gap at its own pointer. ess verify bindings gains OBS-BIND-008: a container or native
sidecar in a bound workload that no binding names is a violation, so binding a workload now claims
it runs nothing else.
0.33.0 adds the honest exception. ess-observed-bindings/2 lets a binding acknowledge a mesh proxy
or vendor agent by name and reason, and the report lists it as acknowledged, not bound.
A Secret is only present
A full Kubernetes scan used to write each Secret value's unsalted SHA-256 and byte length, which
confirm a guessed low-entropy secret to anyone holding the file. 0.33.0 writes
infra-observation/3 and infra-ir/3, where each Secret key is {"present": true} and nothing
more. Drift, in infra-drift/3, therefore reports added and removed keys and never a rotated value.
The new versions are described in the version history.