0021. Publication gates and scope of the first release (v0.1.0)

Context

Making the repository public is irreversible. Some work must be complete before the first push, other work can follow in the open. A foundation’s minimum-age clock starts with public development, so publishing early has value.

The Helm chart in the repository currently does not render with default values: it requires explicit ingress and trusted-proxy settings. A first release whose chart behaves like this, or that offers no login without an enterprise identity provider, pushes evaluators into development mode (see ADR-0025).

Decision

Part 1: gates before the first public push (all mandatory)

  • Content review: confidential, environment-specific or organization-specific data (hostnames, accounts, registries, credentials, internal names) is removed from code, docs, tests, examples and history. The public repository starts with a reviewed snapshot.
  • Vendor-neutral content and examples (ADR-0022).
  • LICENSE files and SPDX headers (ADR-0018).
  • DCO in place (ADR-0019).
  • Rename completed (ADR-0015).
  • A control audit (defensive security review) of the published code, with findings fixed or tracked.
  • Community baseline: README, CONTRIBUTING, CODE_OF_CONDUCT, SECURITY (private vulnerability reporting), MAINTAINERS and GOVERNANCE.

May follow publicly after the soft launch: English core documentation (required before the announcement, ADR-0020) and runtime branding (ADR-0022).

Part 2: contents of v0.1.0 (alpha)

  • CI and signed multi-arch images (ADR-0023, ADR-0024).
  • English README and quickstart.
  • A Helm chart from the repository that installs with default values.
  • Login without an enterprise IdP via a bootstrap admin (ADR-0025).
  • Clearly stated support levels: container mode and Linux hosts are beta, Windows is experimental, the Helm chart is experimental.

Explicitly not in v0.1.0:

  • Signed OCI chart publication, a kind quickstart and a collector chart (planned for v0.2.0, “Kubernetes-ready”).
  • The gitops-pr executor (ADR-0026).
  • The MCP server (ADR-0027).

Consequences

Positive

  • Public development starts early with minimal irreversible risk.
  • Evaluators get a usable default installation.

Negative

  • Soft launch with partially English documentation.
  • Alpha support levels may deter production users.
  • The gate list must be verified explicitly (checklist).

Alternatives considered

  • Complete all hardening, docs and branding first: rejected, it delays public development without reducing risk.
  • Content review only: rejected, it publishes without licenses and without an audit.
  • Minimal release without chart and login: rejected, it leads into the development-mode trap.
  • Full release including gitops-pr and MCP: rejected, it delays the announcement.
  • Kubernetes-ready scope as v0.1.0: deferred to v0.2.0; it delays the announcement without helping the minimum-age clock.