Purpose
Central execution tracker for Kafdeck v0.4 — Consumers, Schemas & Ecosystem Read Views.
Status
RELEASED — v0.4 publication complete.
All W25-W31 workstreams are complete.
Canonical release chain
Superseded checkpoints: #114, #115, #117. Issue #107 is completed.
Final technical evidence
The exact candidate a94b3baa... passed quality-gate, dependency-review, CodeQL C#/JavaScript, kafka-smoke, release-quality, Kafka 4.3.1/4.2.1/4.1.2/3.9.2, release-supply-chain, v0.3 regression benchmark, v0.4 benchmark, SPDX SBOM, High/Critical scan, resolved review threads and exact-head CODEOWNER approval.
The final benchmark correction made schema_diff_128_lines an actual 128-line fixture. Final bounded measurements were:
- consumer lag / 64 partitions: 20,000 ops / 99.904 ms / 200,192.99 ops/s
- schema diff / 128 lines: 20,000 ops / 368.719 ms / 54,241.77 ops/s
- fail-closed Connect projection / 67 fields: 20,000 ops / 379.693 ms / 52,674.06 ops/s
Publication evidence
The v0.4 release decision was explicitly owner-approved on 2026-09-21 after confirming that no v0.4 tag or GitHub Release already existed.
Protected-main publication:
- quality-gate run
35607746838 — SUCCESS
- kafka-smoke run
35607746884 — SUCCESS
- publish-release run
35607746950, attempt 2 — SUCCESS
- release-quality — SUCCESS
- Kafka 4.3.1 / 4.2.1 / 4.1.2 / 3.9.2 — SUCCESS
- release-evidence — SUCCESS
- SPDX SBOM / High-Critical scan — SUCCESS
- keyless cosign signing — SUCCESS
- final OCI promotion — SUCCESS
- GitHub Release publication — SUCCESS
The first protected-main Kafka 4.1.2 attempt had one transient Kafka is temporarily unavailable integration-test failure. The same exact source passed on the failed-job rerun without code or test weakening.
Published identity
- tag
v0.4 → e22426026d4f03f675df703773ca072ed7ea0f03
- GitHub Release: v0.4
- OCI:
ghcr.io/araditc/kafdeck@sha256:8183ced585bd6eb73bf280f4ded5751e2ffc9370b1e170e0b9074a3acc9e2ed1
Preserved invariants
No Kafka mutation/produce/replay; no consumer-offset mutation/commit; no Schema Registry or Connect mutation; no ksqlDB statement/query execution; no payload persistence by default; no unbounded scan/polling; no generic upstream proxy; no arbitrary server-side JavaScript/general SQL engine; no masking bypass; metadata/ecosystem permissions never imply record.read; record.export remains separate; v0.3 masking remains server-side/fail-closed.
v0.4 RELEASED — tracker complete.
Purpose
Central execution tracker for Kafdeck v0.4 — Consumers, Schemas & Ecosystem Read Views.
Status
RELEASED — v0.4 publication complete.
All W25-W31 workstreams are complete.
Canonical release chain
dd8acdeac726756788c7bb679aa1feb25856e337a94b3baa415f32b7b8420c4bc398f405fa674709b05b61f1835effcee78a7aef4d6eb481faba8915fcfafe1a6658b4473ea9a963da2675463a709425e22426026d4f03f675df703773ca072ed7ea0f03Superseded checkpoints: #114, #115, #117. Issue #107 is completed.
Final technical evidence
The exact candidate
a94b3baa...passed quality-gate, dependency-review, CodeQL C#/JavaScript, kafka-smoke, release-quality, Kafka 4.3.1/4.2.1/4.1.2/3.9.2, release-supply-chain, v0.3 regression benchmark, v0.4 benchmark, SPDX SBOM, High/Critical scan, resolved review threads and exact-head CODEOWNER approval.The final benchmark correction made
schema_diff_128_linesan actual 128-line fixture. Final bounded measurements were:Publication evidence
The v0.4 release decision was explicitly owner-approved on 2026-09-21 after confirming that no v0.4 tag or GitHub Release already existed.
Protected-main publication:
35607746838— SUCCESS35607746884— SUCCESS35607746950, attempt 2 — SUCCESSThe first protected-main Kafka 4.1.2 attempt had one transient
Kafka is temporarily unavailableintegration-test failure. The same exact source passed on the failed-job rerun without code or test weakening.Published identity
v0.4→e22426026d4f03f675df703773ca072ed7ea0f03ghcr.io/araditc/kafdeck@sha256:8183ced585bd6eb73bf280f4ded5751e2ffc9370b1e170e0b9074a3acc9e2ed1Preserved invariants
No Kafka mutation/produce/replay; no consumer-offset mutation/commit; no Schema Registry or Connect mutation; no ksqlDB statement/query execution; no payload persistence by default; no unbounded scan/polling; no generic upstream proxy; no arbitrary server-side JavaScript/general SQL engine; no masking bypass; metadata/ecosystem permissions never imply
record.read;record.exportremains separate; v0.3 masking remains server-side/fail-closed.v0.4 RELEASED — tracker complete.