Skip to content

November release preparation record

Rejected and unpublished — 29 October 2026. v2026.11.0 is an immutable recovery marker, not an installable approved release. Inspection of the exact staged image found MPL-labelled embedded SD-WAN JSON missing from its copied source and attribution bundle, failing the release licensing gate. Never publish this draft, move/delete its tag or replace its staged artifacts. The proposed corrected candidate is v2026.11.1; the previous published baseline remains v2026.10.0. The original preparation record below is preserved as history, not current publication guidance.

Prepared 29 October 2026 for v2026.11.0, planned 1 November 2026. Previous published baseline: v2026.10.0. Preparation base on main: 4482ce1b3fa4324b5da00c1e6f761d10060405a0.

This is a preparation snapshot, not a declaration that the release is published or that the final candidate is qualified. The protected preparation PR and the release operator's record hold the current approval, final merged SHA and verification links. Record later evidence there; do not change frozen source merely to fill this page and create another review cycle.

Prepared scope

  • Canonical November release notes, compared with October: bounded topology extensions, SD-WAN and Nexus Dashboard Alpha adapters, runtime/dependency updates, and the documentation redesign.
  • Source chart appVersion and release-facing examples target v2026.11.0. Source chart version: 0.1.0 remains the development default; tag automation stamps packaged chart 2026.11.0.
  • Existing CRD and runtime migration instructions use the complete signed chart directory, matching admission/manager/worker versions and retained ownership.
  • The website keeps the approved foundation-focused wording and diagrams; MkDocs has audience entry points, task guides and technical reference. Historical October notes, rejected September candidates and dated evidence retain their original meaning.
  • The release runbook uses the November version and October baseline. It retains draft-before-tag, immutable artifacts, signed distribution and publication-only documentation.

Open or unmerged feature work is not part of this scope. Adding source or changing canonical notes after review requires a new qualifying review.

Preparation checks

The documentation PR records local build, link, license, dependency-audit, release-contract and chart-render results. Those checks establish that the preparation is reviewable; they do not replace protected CI, real-API and hardware qualification or signed-artifact verification on the final candidate.

Prior physical records remain linked from the topology scope, SD-WAN backlog and Nexus Dashboard guide. They apply only to the revisions and conditions named there. In particular, do not promote the optional drain/TAS lanes or controller adapters beyond their documented preview, experimental or Alpha scope based on old green checks.

Publication gates still required

Gate Required evidence
Protected preparation PR A current normal approval from an eligible maintainer other than the release operator; all branch rules and required checks satisfied.
Required checks build-and-smoke, ygot-validate, terraform-provider, govulncheck, helm4-compat, lab-ci-next / cat8kv, and lab-ci-next / cat9k, on the qualifying candidate. Re-read protection in case required checks change.
Runtime and migration Pinned-toolchain Go/race/vet, generated CRD/RBAC parity, Kubernetes 1.35 real-API/admission/scheduler checks, install/October-upgrade/rollback evidence, and applicable device qualification.
Scope and recovery Resolve failing gates or qualification blockers; retain the documented Alpha/preview limits, retained receipts/claims and fail-closed recovery behavior.
Security and licensing Root and Terraform vulnerability checks, both release-image fixed HIGH/CRITICAL scans, locked website/Python audits, generated license/NOTICE bundles and SBOM review.
Frozen source and authorization record Preparation PR, review link, approved head, resulting merge SHA, approved signing identity, and final evidence links. A protected merge's different SHA alone does not require another approval.
Draft and staging Curated notes rendered from the approved source; exactly one unpublished draft before the signed tag; successful staging of all 16 allowlisted assets.
Artifact verification Independently verified image/chart/plugin signatures, provenance, checksums, platform execution, package contents and correct image aliases.
Publication and distribution Manual draft publication after verification, immutable release, tag-based docs deployment, public artifact checks and the normal Krew index update.

No separate exact-phrase approval, draft-ID authorization comment, or second reviewer task is added by this record. The operator records the draft ID and verification evidence under the existing normal PR approval.

Operator sequence

  1. Review and merge the preparation PR after the current required checks pass.
  2. Freeze that PR's exact merge commit on main. Do not include later unrelated commits without a new reviewed preparation.
  3. On the planned release date, follow the runbook: verify the candidate and signing tools, render the committed notes, create the draft, then push the signed immutable tag. Merging the PR does not schedule or execute these steps.
  4. Inspect all staging results and verify artifacts independently. Publish only when every required gate passes; then verify documentation and distribution.
  5. If source or artifacts need correction after tagging, keep the failed draft unpublished and prepare v2026.11.1. Never move the original tag or replace a published asset.