Record completed operator modernization release

docs/modernization-plan.md

@@ -48,8 +48,27 @@ shipped operator default and validated rather than assumed to match either.
 | 12 | Bump the candidate chart to `0.6.0`. Add an operator-admin-only Relay API endpoint override (environment/Helm configuration, never a CR field) and a stateful fake Relay API used by isolated K3s. Replace the deliberately failing isolated reconcile with deterministic create, update, idempotency, error, and cleanup assertions. | Unit tests validate the production default, absolute HTTP(S) URL and no-userinfo rules, proxy composition, and absence of credentials from logs/status. Isolated K3s proves remote-style convergence without production credentials; production delivery remains separate. | Merged ([#43](https://github.com/webhookrelay/webhookrelay-operator/pull/43)); [CI](https://github.com/webhookrelay/webhookrelay-operator/actions/runs/34352337807) passed unit/lint, Helm, and isolated K3s create/update/output-prune/input-retention/idempotency/failure/recovery coverage |
 | 13 | Add Kubernetes-standard `RoutingReady`, `AgentReady`, and aggregate `Ready` conditions, top-level and per-condition `observedGeneration`, and actual Deployment rollout readiness while retaining existing status fields as compatibility mirrors. Watch owned Deployment changes, handle missing/unobserved/partial/available/`ProgressDeadlineExceeded` states, retry status conflicts, and return Deployment reconcile failures. | Focused tests cover condition reasons, stable transition times/no write loop, generation changes, status conflicts, deletion, routing failures, and legacy mirrors. Generated CRDs agree; isolated K3s proves false-to-true readiness and update transitions; protected production delivery passes. | Merged ([#44](https://github.com/webhookrelay/webhookrelay-operator/pull/44)); [CI](https://github.com/webhookrelay/webhookrelay-operator/actions/runs/34355001359) and [protected production delivery](https://github.com/webhookrelay/webhookrelay-operator/actions/runs/34355358893) passed |
 | 14 | Remove/deprecate the duplicate Helm-managed CRD template and define `crds/` as the supported retained CRD path. Add a packaged-chart lifecycle suite: clean install, CR deletion and owned Deployment garbage collection, Helm uninstall with CRD retention, and separately guarded CRD removal only in disposable K3s. Upgrade from the checksum-pinned published chart `0.4.1`, explicitly apply the candidate CRD, and test application-only safe rollback after scaling the operator to zero. | CI verifies checksum `7de5d0afa11405d603c41b81bab1b33f93e0cf6f9ddb3fc7ae5e9a1fd85a4907`, Helm revision transitions, CR UID and legacy `function_id`, Lease/probes/RBAC/schema, zero old/new pod overlap, old-controller-compatible rollback fixtures, no remote duplication, namespaced cleanup, CRD retention, and guarded test teardown. Documentation states CRD upgrade, rollback limitations, and uninstall behavior. | Merged ([#45](https://github.com/webhookrelay/webhookrelay-operator/pull/45)); [CI](https://github.com/webhookrelay/webhookrelay-operator/actions/runs/34358692419) passed the packaged install, real legacy-CRD upgrade, alias mapping, isolated rollback, uninstall, retention, and guarded cleanup lifecycle |
-| 15 | Replace legacy chart scripts with deterministic GitHub Actions packaging/publication. Pin tooling, validate the explicit operator `0.8.0` / chart `0.7.0` mapping, refuse overwriting an existing version, produce chart SHA256/checksum metadata, and expose reusable publish steps without creating a GitHub release. | The exact packaged chart passes lint and lifecycle tests; authenticated retries accept only an already-published artifact with identical bytes; generation-bound index updates retain every old entry; the public index URL/digest and artifact converge. Manual dispatch is validation-only. Configure a protected `release` environment with required reviewers and a scoped charts storage identity before enabling writes; image credentials remain part of phase 16. | Merged ([#46](https://github.com/webhookrelay/webhookrelay-operator/pull/46)); [CI](https://github.com/webhookrelay/webhookrelay-operator/actions/runs/34365477398) passed deterministic packaging, authenticated retry fixtures, and exact packaged-chart lifecycle. Legacy Cloud Build is disabled; the protected environment, bucket-scoped keyless identity, mutable-index revalidation policy, and one-time cache migration are active. |
-| 16 | Orchestrate publication from an operator tag reachable from `master`: validate explicit operator/chart/agent mapping; build immutable image and chart artifacts; assert exact amd64/arm64 platform sets; smoke-run both platforms for the operator and both pinned agent variants; run packaged-chart K3s and protected production live delivery against immutable tags; publish the chart; promote `latest`; and create the GitHub release last with chart/checksum assets and image digests. | A dry-run fixture proves job ordering. Build, validation, or chart-publication failures cannot create a public release or move `latest`. If the final release API call fails after promotion, recovery must resume from the digest-verified immutable artifacts without rebuilding or changing `latest`. The production gate includes function behavior and exact cleanup. Release notes record operator, chart, and agent versions plus artifact digests. | In progress ([#47](https://github.com/webhookrelay/webhookrelay-operator/pull/47)); commit-scoped staging, digest deployments, multi-platform manifests/smoke tests, protected live delivery, collision-safe promotion, draft-to-public finalization, and administrator-only `0.*` tag rules are implemented for review |
+| 15 | Replace legacy chart scripts with deterministic GitHub Actions packaging/publication. Pin tooling, validate the explicit operator `0.8.0` / chart `0.7.0` mapping, refuse overwriting an existing version, produce chart SHA256/checksum metadata, and expose reusable publish steps without creating a GitHub release. | The exact packaged chart passes lint and lifecycle tests; authenticated retries accept only an already-published artifact with identical bytes; generation-bound index updates retain every old entry; the public index URL/digest and artifact converge. Manual dispatch is validation-only. Configure a protected `release` environment with restricted deployment branch/tag policies and a scoped charts storage identity before enabling writes; image credentials remain part of phase 16. | Merged ([#46](https://github.com/webhookrelay/webhookrelay-operator/pull/46)); [CI](https://github.com/webhookrelay/webhookrelay-operator/actions/runs/34365477398) passed deterministic packaging, authenticated retry fixtures, and exact packaged-chart lifecycle. Legacy Cloud Build is disabled; the protected environment, bucket-scoped keyless identity, mutable-index revalidation policy, and one-time cache migration are active. |
+| 16 | Orchestrate publication from an operator tag reachable from `master`: validate explicit operator/chart/agent mapping; build immutable image and chart artifacts; assert exact amd64/arm64 platform sets; smoke-run both platforms for the operator and both pinned agent variants; run packaged-chart K3s and protected production live delivery against immutable tags; publish the chart; promote `latest`; and create the GitHub release last with chart/checksum assets and image digests. | A dry-run fixture proves job ordering. Build, validation, or chart-publication failures cannot create a public release or move `latest`. If the final release API call fails after promotion, recovery must resume from the digest-verified immutable artifacts without rebuilding or changing `latest`. The production gate includes function behavior and exact cleanup. Release notes record operator, chart, and agent versions plus artifact digests. | Complete ([#47](https://github.com/webhookrelay/webhookrelay-operator/pull/47), [#48](https://github.com/webhookrelay/webhookrelay-operator/pull/48), [#49](https://github.com/webhookrelay/webhookrelay-operator/pull/49), [#50](https://github.com/webhookrelay/webhookrelay-operator/pull/50)); the final [release run](https://github.com/webhookrelay/webhookrelay-operator/actions/runs/34395160033) passed every source, multi-architecture, production delivery, cleanup, chart lifecycle, publication, and release gate. |
+
+### Release 0.8.0 outcome
+
+- [Operator `0.8.0`](https://github.com/webhookrelay/webhookrelay-operator/releases/tag/0.8.0)
+  and `latest` resolve to the same amd64/arm64 OCI index,
+  `sha256:afffa826f068d4f251ee63b50e0d8ebf28f49212a24a2d0802ca2b566d53313b`.
+- Helm chart `0.7.0` is published with application version `0.8.0`; its public
+  archive, repository index, checksum asset, and GitHub release asset agree on
+  SHA-256 `055577f690cfd1bd62bb1215408f85bd5882c9f15fad4a70546d2f805f116a38`.
+- Relay-agent `1.37.0` standard and UBI images both expose exactly linux/amd64
+  and linux/arm64. Their OCI index digests are recorded in the release assets.
+- The release production gate passed real Webhook Relay delivery, function
+  transformation behavior, immutable image rollout, and exact owned-resource
+  cleanup. The packaged chart also passed install, upgrade, rollback, uninstall,
+  CRD-retention, and guarded teardown checks before publication.
+- Artifact Hub indexes chart `0.7.0`, and the repository has no open issues.
+- The inactive `war-bunny` required reviewer was removed from the `release`
+  environment. Custom deployment policies still admit only `master` and `0.*`
+  tags, and the administrator-only `0.*` tag ruleset remains active.
 
 Known follow-ups outside this sequence are per-object API clients for safe
 concurrent reconciliation and Secret watches/cache invalidation for credential