Skip to content

Corrected November release preparation record

Prepared 29 October 2026 for proposed v2026.11.1. The original November release target date was 1 November 2026. Previous published baseline: v2026.10.0. Correction base: PR #210 merge 089c5c4a2f13e09c2b1ef462da230841184a30f5.

This is a reviewable correction, not a declaration of publication, approval or final qualification. The new protected preparation PR must record its current approval, final merged SHA and verification evidence. Do not reuse the old candidate's approval or artifact results as approval of changed source/version.

Why the previous candidate was rejected

v2026.11.0 was tagged and staged, but exact inspection of its linux/arm64 controller image found the MPL-labelled scalar-parcels.json and classic-templates.json embedded in the executable without corresponding copied source or attribution in /licenses. The inspected image digest was sha256:3426c740728aaa4b34ace434b9f4e62f1a5ccca2c838032a2146a3b8a83c94d2.

That failed the existing Licensing is a hard gate requirement. The original notes and preparation record remain historical. Never publish that draft, move/delete the tag, or replace its staged artifacts. October remains the published baseline. This was an artifact packaging finding; it does not change the recorded platform qualification.

Proposed correction and retained scope

  • Canonical v2026.11.1 notes retain the November scope compared with October: bounded topology extensions, SD-WAN and Nexus Dashboard Alpha adapters, runtime/dependency updates and the documentation redesign.
  • The minimal functional change is image packaging: explicitly include linked embedded source, license text, attribution and provenance in /licenses/embedded-source/, with a manifest and byte-comparison checks. SD-WAN definitions and the applicable IOS-XE model/schema source retain their repository-relative paths under source/. Existing Go license checks remain.
  • Current selectors and source chart appVersion target v2026.11.1. Source chart version: 0.1.0 remains the development default; tag automation stamps packaged chart 2026.11.1. Historical candidates are not renumbered.
  • The approved website wording/design and the November feature maturity, runtime gates, qualification limits and migration boundaries are retained. No new runtime behavior or deferred feature is included by this correction.
  • The release runbook targets the corrected candidate and October baseline. It preserves normal current-head approval, draft-before-tag, immutable artifacts and publication-only documentation deployment.

Verification and publication gates

Record the new candidate's local checks and remote results in its preparation PR. Checks on PR #210 and the rejected staged image do not qualify new artifacts. Do not change frozen source solely to record final bookkeeping here.

Gate Required evidence for v2026.11.1
Protected correction PR Normal current-head approval from an eligible maintainer other than the release operator; all current branch rules and required checks pass. Changed version/source/notes require the new review.
Required checks build-and-smoke, ygot-validate, terraform-provider, govulncheck, helm4-compat, lab-ci-next / cat8kv, and lab-ci-next / cat9k on the qualifying candidate; re-read protection for changes.
Packaging regression Embedded-source helper tests; target-specific linked-input inventory; byte-identical source, LICENSE/README, provenance and generator copies in both image bundles.
Candidate verification Applicable Go/race/vet, generated CRD/RBAC parity, real-API/admission/scheduler, chart/install/October-upgrade/rollback and device checks under the existing runbook. Prior records apply only to their named revision and scope.
Security and licensing Required vulnerability scans, dependency audits, existing Go/website/MkDocs license checks, and exact staged-image inspection of /licenses/embedded-source/ against frozen source. SBOMs supplement redistribution verification.
Draft and staging Approved frozen merge SHA, signing identity and rendered canonical notes; exactly one unpublished draft before a new signed tag; all 16 allowlisted assets staged successfully.
Independent artifact verification Image/chart/plugin signatures, provenance, checksums, platform execution, package contents and image aliases from the exact corrected candidate.
Publication and distribution Publish only after the corrected release is authorized and all gates pass; then verify immutable release, tag-based docs and the normal Krew update.

The correction does not waive or narrow release gates. No prescribed review comment, separate draft-ID approval or extra reviewer task is introduced.

Operator sequence

  1. Review and merge the correction PR after its current required checks pass.
  2. Freeze that exact merged source and record the new normal review and authorization for v2026.11.1. Preparing this PR does not tag or publish it.
  3. Follow the runbook to verify the candidate, render these committed notes, create its new draft, then push its new signed tag. Do not reuse the rejected candidate's draft, tag, assets or success record.
  4. Inspect all staging outputs and independently compare the embedded source bundle with the frozen candidate. Publish only after all required gates pass.
  5. If further source or artifact changes are needed after tagging, leave the failed candidate unpublished and prepare v2026.11.2. Never move an existing tag or replace its artifacts.