chore(deps): update ghcr.io/doublewordai/control-layer docker tag to v8

[renovate]

This PR contains the following updates:

Package	Update	Change
ghcr.io/doublewordai/control-layer	major	0.25.0 → 8.65.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[doubleword-code]

Summary

This PR is an automated dependency update from Renovate that bumps the appVersion in Chart.yaml from 0.25.0 to 8.46.0. This is a major version upgrade (0.x → 8.x) for the underlying ghcr.io/doublewordai/control-layer application image. The change affects the default image tag used in deployments since the template references .Chart.AppVersion when no explicit tag is provided.

Findings

• Non-blocking Chart.yaml:6: Major version upgrade (0.25.0 → 8.46.0) without accompanying documentation about breaking changes or migration requirements. Consider adding a note in the PR description or updating CHANGELOG.md with a link to the upstream application's release notes.

• Non-blocking CHANGELOG.md: The changelog tracks chart version history but does not document application version updates. Consider adding an entry noting the appVersion bump to help users track what application version each chart release deploys.

• Nit tests/control_layer_deployment_test.yaml:7-23: The test "should create control-layer deployment with default appVersion" only validates the image format regex but doesn't assert the specific version. Adding a version assertion would catch unintended appVersion changes during review.

• Nit values.yaml:52: The image.tag is set to "" (empty string), which relies on the default .Chart.AppVersion behavior in the template. This is correct but could be clearer with a comment noting this intentional defaulting behavior.

Suggested next steps

This is a straightforward automated dependency update. Before merging:

1. Verify the upstream control-layer v8 release notes for any breaking changes that might affect deployments (e.g., configuration schema changes, required environment variables, or database migration requirements).
2. Optionally update CHANGELOG.md to document this appVersion update for user visibility.
3. Ensure any downstream environments are prepared for the major version upgrade if they rely on the default image tag.

[doubleword-code]

Summary

This PR updates the appVersion in Chart.yaml from 0.25.0 to 8.46.1, which controls the default Docker image tag for the control-layer deployment. This is an automated Renovate dependency update.

Verdict: The chart change itself is correct and follows the established pattern. However, this is a major version jump (0.x → 8.x) in the application version, which warrants verification that the new image version is compatible with the existing chart templates and default values before merging.

Research Notes

• Fetched renovate.json configuration confirming the appVersion is automatically updated from the Docker registry (datasourceTemplate: docker)
• Verified in templates/deployment.yaml:42 that Chart.AppVersion is used as the default image tag when image.tag is not explicitly set
• Checked existing tests in tests/control_layer_deployment_test.yaml - they validate image format but not specific version compatibility
• Reviewed CHANGELOG.md showing historical appVersion updates have been routine
• Attempted to fetch available Docker tags from GHCR but authentication was required

Suggested Next Steps

1. Review control-layer application changelog (if available) for breaking changes between v0.25.0 and v8.46.1 - particularly around:

   • Configuration file format changes
   • Environment variable changes
   • Health check endpoint changes (/healthz)
   • Database schema migrations

2. Test the new image in a non-production environment to verify:

   • Pod starts successfully with current default values
   • Health probes pass
   • Secret mounting works correctly
   • ConfigMap configuration is compatible

3. Consider pinning image.tag in production values files rather than relying on appVersion defaults if you need more control over rollout timing.

General Findings

No issues found with the actual code change. The single-line modification to Chart.yaml is the correct approach for updating the default container image version in a Helm chart.

[doubleword-code]

Summary

This PR updates the appVersion in Chart.yaml from 0.25.0 to 8.46.3, representing a major version jump (v0 → v8) of the control-layer Docker image. The change is automatically generated by Renovate.

Verdict: Needs changes - While the dependency update itself is straightforward, there are several concerns with this major version bump that should be addressed before merging.

Research notes

• Fetched https://github.com/doublewordai/control-layer - confirms v8.46.3 was released today (May 7, 2026)
• Fetched https://docs.doubleword.ai/control-layer/ - Control Layer is an AI model gateway written in Rust
• The repository uses Renovate with Docker versioning for appVersion tracking (renovate.json lines 9-14)
• Image tag resolution in deployment templates uses .Values.image.tag | default .Chart.AppVersion

Suggested next steps

1. Blocking: Increment the chart version in Chart.yaml alongside this major appVersion change (Helm best practice)
2. Non-blocking: Review control-layer v8 release notes for breaking changes that might affect deployments
3. Non-blocking: Consider testing the rendered Helm templates with the new version before deploying to production

General findings

Major version jump without changelog review

The jump from 0.25.0 to 8.46.3 crosses multiple major versions. Per semantic versioning, major version increments can include breaking changes. The PR description doesn't include any migration notes or changelog references. Teams deploying this should verify compatibility with their existing configurations, especially:

• Database schema migrations (control-layer uses PostgreSQL)
• Configuration file format changes
• API endpoint compatibility
• Authentication/session handling changes

Chart version should be incremented

Per Helm chart best practices, when updating appVersion (especially across major versions), the chart version should also be incremented. This allows users to distinguish between chart releases and ensures proper version tracking in Helm repositories.

[doubleword-code]

Summary

This PR updates the appVersion in Chart.yaml from 0.25.0 to 8.49.0, which controls the default Docker image tag for the control-layer service. This is a major version jump (0.x → 8.x) managed by Renovate bot.

The change is mechanically correct - only the single version field is modified, and the Helm templates will correctly use this new version as the default image tag. No code changes required; ready to merge pending operational validation.

Research notes

• Fetched the GitHub repository page to confirm this is a Helm chart for deploying the Doubleword control layer service
• Verified templates/deployment.yaml:42 uses .Chart.AppVersion as the default image tag when image.tag is not explicitly set
• Confirmed renovate.json is configured with regexManager to track Docker image versions via the appVersion field
• Test suite (tests/control_layer_deployment_test.yaml) validates image format but not specific version compatibility

Suggested next steps

1. Verify upstream changelog: Review release notes for control-layer versions 0.25.0 → 8.49.0 to identify any breaking changes that might require configuration updates (environment variables, config schema, database migrations, etc.)
2. Test deployment in non-production environment: Deploy with the new image version and verify:
   • Application starts successfully
   • Health checks pass (/healthz endpoint)
   • Database migrations run correctly (if applicable)
   • Existing configuration remains compatible
3. Check resource requirements: Major version jumps may change CPU/memory requirements - verify current resource limits are still appropriate

General findings

Non-blocking consideration: The test at tests/control_layer_deployment_test.yaml:7 is named "should create control-layer deployment with default appVersion" but only validates that the image matches the pattern ^ghcr\.io/doublewordai/control-layer:.*$ - it doesn't assert the specific version. This is acceptable for a generic test, but teams relying on tests to catch version mismatches may want to add a test that explicitly validates the Chart.yaml appVersion field propagates correctly to the deployment image.

[doubleword-code]

Summary

This PR updates the appVersion in Chart.yaml from 0.25.0 to 8.51.0, which corresponds to updating the container image tag for ghcr.io/doublewordai/control-layer from v0.25.0 to v8.51.0. The change is automated by Renovate based on the regex manager configuration in renovate.json.

Verdict: Approved - this is a routine dependency update with no changes to the Helm chart templates or logic.

Research notes

• Fetched the diff between origin/main and HEAD: only Chart.yaml line 6 changed (appVersion: 0.25.0 → appVersion: 8.51.0)
• Verified templates/deployment.yaml line 42 uses .Chart.AppVersion as the default image tag when image.tag is not explicitly set
• Verified templates/fusillade/deployment.yaml line 42 also correctly defaults to .Chart.AppVersion
• Checked renovate.json: the regex manager correctly extracts appVersion and maps it to the Docker datasource for ghcr.io/doublewordai/control-layer
• Reviewed existing tests in tests/control_layer_deployment_test.yaml: tests verify that deployments use the appVersion and allow custom image tag overrides

Suggested next steps

1. Verify upstream changelog: This is a major version jump (0.x → 8.x). Before merging, check the control-layer release notes to confirm there are no breaking changes that would affect the current chart configuration (e.g., changed environment variables, config file schema changes, removed endpoints).

2. Test in staging: Deploy this updated chart to a staging environment to verify the new container image starts correctly with the current values.yaml defaults.

General findings

No issues found. The change is minimal, correct, and follows the established pattern for dependency updates in this repository. The Helm chart templates correctly reference .Chart.AppVersion, and the Renovate configuration properly extracts and updates this value.

[doubleword-code]

Summary

This PR updates the appVersion in Chart.yaml from 0.25.0 to 8.52.0, tracking the latest release of the control-layer Docker image. The change is minimal (single line in Chart.yaml) and follows the established Renovate automation pattern for this repository.

Verdict: Ready to approve pending CI verification.

Research notes

• Fetched control-layer releases page - confirmed v8.52.0 was released on May 20, 2026 with features like "usage: scope /usage to active organization and accept user_id filter"
• Reviewed renovate.json configuration - the regex manager correctly tracks appVersion in Chart.yaml against the ghcr.io/doublewordai/control-layer Docker image
• Checked CHANGELOG.md - the chart version history shows previous appVersion bumps following the same pattern (e.g., commit 1734c49 updating to 0.8.0, commit 999ba96 bumping to 0.8.1)

Suggested next steps

1. Wait for CI - The GitHub Actions workflow will run helm lint and helm unittest to verify the chart remains valid with the new version
2. Verify Docker image availability - Ensure ghcr.io/doublewordai/control-layer:8.52.0 is published and accessible before merging

General findings

No issues found. The change is:

• ✅ Correctly formatted YAML
• ✅ Using the proper Helm chart convention (.Chart.AppVersion is referenced correctly in all templates)
• ✅ Consistent with repository automation patterns (Renovate-managed dependency)
• ✅ Not introducing any breaking changes to the chart schema or templates
• ✅ Test-compatible (tests use regex patterns, not hardcoded versions)

[doubleword-code]

Summary

This PR updates the appVersion field in Chart.yaml from 0.25.0 to 8.52.1, tracking a major version jump of the ghcr.io/doublewordai/control-layer Docker image. The change is minimal (1 line) and follows the existing Renovate automation pattern configured in renovate.json.

Verdict: Ready to approve, pending validation that the v8.52.1 image works correctly with the current chart templates.

Research notes

• Helm documentation (helm.sh/docs/topics/charts): The appVersion field is informational only and "has no impact on chart version calculations". It specifies the version of the application that the chart deploys.

• Image tag resolution: Per templates/deployment.yaml:42, the container image uses .Values.image.tag | default .Chart.AppVersion. Since values.yaml:52 sets tag: "" (empty), deployments will use appVersion as the Docker tag, pulling ghcr.io/doublewordai/control-layer:8.52.1.

• Breaking change context: Git history shows commit ddb06d4 introduced a breaking change (removed scouter sub-chart) at chart version 1.0.0. The old appVersion: 0.25.0 predates this change.

Suggested next steps

1. Verify image compatibility: Ensure the control-layer v8.52.1 image doesn't require configuration changes not captured in the current values.yaml schema (e.g., new required env vars, changed config file format).

2. Run helm tests: Execute helm template and helm lint to confirm the chart renders correctly with the new appVersion.

3. Deploy to non-production first: Given the major version jump (0.x → 8.x), test in a staging environment before production rollout.

General findings

No code-level issues identified. This is a routine dependency update handled by Renovate. The significant version jump is the only notable aspect, but the mechanism for tracking Docker tags via appVersion is correctly implemented.

[doubleword-code]

Summary

This PR updates the control-layer Docker image version from 0.25.0 to 8.52.2 (a major version jump from 0.x to 8.x). The change is minimal—only updating appVersion in Chart.yaml—and follows the expected pattern for Renovate-generated dependency updates.

Verdict: Requires validation before approval due to major version implications.

Research notes

• Fetched GitHub releases page for doublewordai/control-layer-chart: Confirmed v1.0.0 introduced a breaking change - "the scouter.* values keys are no longer rendered. Consumers relying on the embedded scouter must deploy scouter separately"
• Semantic Versioning spec (semver.org): Major version increments (X.y.z where X > 0) indicate backward-incompatible API changes
• The deployment template (templates/deployment.yaml:42) correctly uses .Chart.AppVersion as the default image tag

Suggested next steps

1. Verify no scouter dependency: Confirm this chart deployment does not rely on the removed scouter sub-chart functionality (scouter was removed in v1.0.0)
2. Consider chart version bump: While not strictly required, consider incrementing the chart version from 1.0.0 to 1.0.1 or 2.0.0 to signal this significant appVersion change to users
3. Test with actual v8.52.2 image: Validate the deployment works correctly with the new image version, especially health probes (/healthz endpoint) and configuration format

General findings

• The existing test suite (tests/control_layer_deployment_test.yaml) adequately covers the image tag behavior and would catch regressions if the appVersion mechanism broke
• The chart's values.yaml allows explicit image.tag override, providing an escape hatch if the new version causes issues
• No migration guide or CHANGELOG is referenced in the PR description—for production deployments, documenting breaking changes between 0.25.0 and 8.52.2 would be valuable

[doubleword-code]

Summary

This PR updates the appVersion in Chart.yaml from 0.25.0 to 8.53.0, which controls the default Docker image tag for the control-layer service (ghcr.io/doublewordai/control-layer). This is a Renovate-managed dependency update.

Verdict: Ready to approve — the change is correct and follows the repository's established patterns for dependency updates.

Research notes

• Fetched upstream control-layer CHANGELOG: The application has a breaking change at v1.0.0 (January 2026) related to "fusillade 1.0.0 and model escalations". The jump from 0.25.0 → 8.53.0 crosses this boundary.
• Reviewed renovate.json: Correctly configured with regex manager for appVersion using Docker datasource and versioning.
• Checked deployment.yaml: Image tag correctly defaults to .Chart.AppVersion when image.tag is not specified.
• Verified Helm best practices: appVersion is informational and used to track the version of the deployed application — this usage is correct.

Suggested next steps

1. Merge as-is — This is a standard Renovate dependency update. Chart consumers should review the upstream control-layer changelog for application-level breaking changes between v0.25.0 and v8.53.0, particularly the v1.0.0 fusillade migration.

2. Optional enhancement: Consider adding a note to the PR description or release notes highlighting the major version jump and linking to the upstream changelog for visibility.

General findings

No blocking issues identified. The single-line change is:

• Syntactically correct YAML
• Follows Helm chart conventions
• Consistent with previous Renovate updates in this repository (e.g., commit 2abce3d)
• Test coverage exists for default appVersion behavior in tests/control_layer_deployment_test.yaml

[doubleword-code]

Summary

This PR updates the appVersion in Chart.yaml from 0.25.0 to 8.54.1, which controls the default Docker image tag for the control-layer container (ghcr.io/doublewordai/control-layer). This is a major version jump spanning 7+ major versions.

Verdict: Needs changes / blocked on verification

While the Helm chart change itself is syntactically correct, deploying a container image that has jumped from v0.25.0 to v8.54.1 without reviewing intermediate release notes poses significant risks:

1. Breaking API/configuration changes - Major versions typically indicate breaking changes
2. Database schema migrations - The control-layer uses PostgreSQL with multiple schemas (fusillade, outlet); major version upgrades may require migrations
3. Configuration format changes - The default config structure in values.yaml may no longer be compatible
4. Missing intermediate changelog review - No evidence that breaking changes between v0.x and v8.x were reviewed

Research notes

• Fetched control-layer releases page - shows only recent v8.x releases with features like "Remove virtual batches", "proxy provider-display-config icons", etc.
• Fetched control-layer README - shows current config structure includes auth.native, auth.proxy_header, batches.daemon, database pool settings, and component databases (fusillade/outlet schemas)
• Previous appVersion (0.25.0) was set in commit 2abce3d (Jan 2026); current PR jumps to 8.54.1 (May 2026) - ~4 months of development across many major versions
• The Helm chart's default configuration in values.yaml line 134-168 may not reflect required settings for v8.x

Suggested next steps

1. Review release notes for all major versions between v0.25.0 and v8.54.1, specifically looking for:

   • Breaking changes in configuration format
   • Database migration requirements
   • Environment variable changes
   • Deprecated/removed features

2. Test the upgrade in a non-production environment with:

   • Fresh install using v8.54.1 image
   • Migration path from existing v0.25.0 deployment (if applicable)

3. Update Helm chart defaults if needed - If v8.x requires new configuration options or has changed defaults, update values.yaml accordingly

4. Consider pinning to a specific minor version rather than allowing Renovate to auto-update across major version boundaries in renovate.json

General findings

• The change mechanism is correct (updating appVersion in Chart.yaml is the standard Helm pattern)
• Templates correctly use .Chart.AppVersion as the default image tag (deployment.yaml:42, fusillade/deployment.yaml:42)
• Existing tests validate image tag behavior but don't test for version-specific compatibility
• No CHANGELOG.md entry documenting what changed between chart deployments using 0.25.0 vs 8.54.1

[doubleword-code]

Blocking: Major version upgrade without migration review.

Why it matters: Jumping from appVersion: 0.25.0 to 8.54.1 crosses 7+ major versions. According to semantic versioning, major version increments indicate breaking changes. The control-layer application uses PostgreSQL with multiple schemas (fusillade, outlet) and has complex configuration (auth providers, batch daemon, database pools). Without reviewing intermediate release notes, there's high risk of:

1. Database schema incompatibility requiring migrations
2. Configuration format changes that break existing deployments
3. Removed/changed environment variables
4. API incompatibilities with dependent services

Per OWASP guidance on dependency management, major version upgrades should include review of security advisories and breaking change documentation before deployment.

Suggested fix: Before merging:

1. Review release notes for v0.26.0 through v8.54.1 in the control-layer repository
2. Document any required migrations or configuration changes in the PR description
3. Test upgrade path in staging environment
4. Consider adding a note to CHANGELOG.md about the appVersion upgrade and any associated migration steps

[doubleword-code]

Summary

This PR updates the Helm chart's appVersion from 0.25.0 to 8.54.2, which controls the default Docker image tag for the control-layer container. This is a significant major version jump (0.x → 8.x) in the upstream application.

The change is technically correct: the appVersion field in Chart.yaml is properly referenced by the deployment template (templates/deployment.yaml:42) via {{ .Values.image.tag | default .Chart.AppVersion }}.

Verdict: Approved, but operators should be aware of potential breaking changes in the upstream application between versions.

Research notes

• Fetched control-layer releases: confirmed v8.54.2 is the latest release (May 28, 2026)
• Fetched v1.0.0 release notes: noted breaking change for "fusillade 1.0.0 and model escalations"
• Chart versioning follows Helm conventions: chart version: 1.0.0 remains unchanged while appVersion tracks the container image version
• Existing tests in tests/control_layer_deployment_test.yaml use regex matching (pattern: ^ghcr\.io/doublewordai/control-layer:.*$) and will not break with this change

Suggested next steps

1. Before deploying to production: Review the upstream control-layer changelog for breaking changes between v0.25.0 and v8.54.2, particularly:

   • v1.0.0: Breaking changes for fusillade 1.0.0 and model escalations
   • Any database schema migrations that may need to run
   • Configuration format changes

2. Consider adding upgrade documentation: Add a section to README.md or create UPGRADE.md noting significant version jumps and any required migration steps for future reference.

3. Test in staging environment: Deploy this version to a non-production environment first to verify compatibility with existing configurations and data.

General findings

No blocking issues found. The change is a single-line version bump that follows Helm best practices. The main risk is not in the chart change itself, but in potential incompatibilities when upgrading the upstream application across multiple major versions.

[doubleword-code]

Summary

This PR updates the appVersion in Chart.yaml from 0.25.0 to 8.55.0, which controls the default Docker image tag for the control-layer deployment. The change is minimal (single line) and follows the established Renovate-managed dependency update pattern configured in renovate.json.

Verdict: Approved - the change is correct and follows project conventions.

Research notes

• Fetched the control-layer releases page - v8.55.0 is the latest release (2026-05-29)
• Reviewed the chart's CHANGELOG.md - the chart itself went through breaking changes in v1.0.0 (scouter sub-chart removal), but this PR only updates the application version, not the chart version
• Verified the Helm template in templates/deployment.yaml:42 correctly uses .Chart.AppVersion as the default when image.tag is empty
• No other files reference the old version 0.25.0

Suggested next steps

1. For maintainers: Consider adding a note in the PR description or commit message about any significant breaking changes in the control-layer application between 0.25.0 and 8.55.0 that users should be aware of when upgrading.

2. For users: If you're using this chart, verify that your custom values.yaml configuration is compatible with control-layer v8.55.0, especially if you've overridden any application-specific settings.

General findings

No issues found. The change is:

• Syntactically correct YAML
• Follows Helm chart best practices for appVersion
• Properly integrated with Renovate's regex manager
• Does not affect any template logic or break backward compatibility at the chart level

[doubleword-code]

Summary

This PR is an automated Renovate dependency update that bumps the appVersion in Chart.yaml from 0.25.0 to 8.57.0, updating the container image tag for ghcr.io/doublewordai/control-layer. The change is minimal and follows the same pattern as previous Renovate updates (e.g., commit 2abce3d).

Verdict: Approved - This is a straightforward version bump with no structural changes to the chart.

Research notes

• Examined the git history: This follows the established Renovate pattern for docker tag updates
• Checked templates: deployment.yaml:42 uses .Chart.AppVersion as the default image tag when no explicit image.tag is provided
• Reviewed CHANGELOG.md: The chart itself has no breaking changes at version 1.0.0, though the application jumping from 0.x to 8.x may have its own migration requirements (documented in the application repo, not this chart)
• Verified tests exist in tests/control_layer_deployment_test.yaml that validate the deployment renders correctly with the appVersion

Suggested next steps

1. Verify application compatibility: Before deploying to production, review the control-layer application's changelog/release notes for versions 0.25.0 → 8.57.0 to identify any:

   • Breaking API changes
   • Required configuration migrations
   • Database schema changes requiring manual migration
   • New required environment variables

2. Test deployment: Run helm template or deploy to a staging environment to confirm the new image works with your current values configuration.

General findings

No issues found. The single-line change is correct and consistent with Helm chart versioning conventions where appVersion tracks the application version being deployed.

[doubleword-code]

Summary

This PR, automated by Renovate, updates the appVersion in Chart.yaml from 0.25.0 to 8.58.0, which controls the default Docker image tag for the control-layer service (ghcr.io/doublewordai/control-layer). This is a major version upgrade (v0.x → v8.x) that could introduce breaking changes in the application behavior.

Verdict: Needs verification of upstream breaking changes before approval.

Research notes

• The appVersion field in Chart.yaml is used as the default image tag in templates/deployment.yaml:42: image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
• Renovate is configured via renovate.json to scan Chart.yaml and update appVersion based on Docker image tags from ghcr.io/doublewordai/control-layer
• The previous version was 0.25.0; the new version is 8.58.0 — a significant major version jump
• The chart's own CHANGELOG.md documents chart version changes but does not track control-layer application version changes
• No upstream release notes or migration guide for the control-layer application (versions 0.25.0 → 8.58.0) is available in this repository

Suggested next steps

1. Verify upstream compatibility: Check the control-layer application's release notes/changelog for breaking changes between v0.25.0 and v8.58.0. Look for:

   • Configuration schema changes (the config value in values.yaml)
   • Environment variable changes
   • API endpoint changes (health checks at /healthz)
   • Database migration requirements

2. Consider pinning major versions: If the control-layer application follows semantic versioning, consider whether Renovate should be configured to only allow minor/patch updates for production stability, requiring manual review for major version bumps.

3. Test deployment: Deploy this updated chart in a staging environment to verify the v8.58.0 image starts correctly and passes health checks with the current configuration.

General findings

• No test validates appVersion semantics: The existing helm-unittest tests (tests/control_layer_deployment_test.yaml) only verify that an image tag exists and matches a regex pattern. They do not validate that a specific appVersion is compatible with the chart templates or values structure.
• Documentation gap: The README.md describes image.tag defaults to "Chart appVersion" but does not document how to evaluate whether a new appVersion is safe to adopt.

[doubleword-code]

Summary

This PR is an automated Renovate dependency update that bumps the appVersion in Chart.yaml from 0.25.0 to 8.58.1. This is a major version jump (v0.x → v8.x) for the control-layer application being packaged by this Helm chart.

Verdict: Needs additional verification before merge.

The change itself is syntactically correct and follows the expected pattern for Helm chart version updates. However, the magnitude of the version jump (skipping from 0.25.0 directly to 8.58.1) raises concerns about potential breaking changes in the upstream application that may affect deployment compatibility.

Research notes

• Fetched GitHub releases page for doublewordai/control-layer-chart: Shows chart release history but doesn't document upstream control-layer application changes between v0.25.0 and v8.58.1
• Reviewed local CHANGELOG.md: Last recorded appVersion mention was "bump 0.12.0" in chart version 0.3.0 (Nov 2025). No documentation of versions beyond 0.25.0.
• Checked Helm template usage: appVersion is used as the default image tag when image.tag is empty (values.yaml line 52 has tag: ""), meaning deployments will pull the new version by default

Suggested next steps

1. Verify upstream release notes: Obtain release notes or changelog from the control-layer application repository documenting changes between v0.25.0 and v8.58.1
2. Check for breaking changes: Confirm whether the v8.x release introduces breaking API changes, configuration schema changes, or database migrations that require chart template updates
3. Test deployment: Validate the new image version deploys correctly with existing chart templates in a test environment
4. Consider pinning intermediate versions: If this skips many intermediate releases, consider whether a staged rollout through intermediate versions would reduce risk

General findings

Missing migration documentation: There is no accompanying documentation in this PR or the repository CHANGELOG explaining what changed in the control-layer application between v0.25.0 and v8.58.1. For a major version jump of this magnitude, users of this chart should be informed of:

• Any breaking changes in the application's configuration format
• Database migration requirements
• Changes to health check endpoints (/healthz is referenced in deployment.yaml and probes)
• Environment variable changes
• API compatibility changes

Recommendation: Add a note to the PR description or commit message linking to upstream release notes, or include a brief summary of notable changes that prompted this version bump.

[doubleword-code]

Non-blocking: Major version jump without documented migration path.

Why it matters: This changes the default container image tag from 0.25.0 to 8.58.1 (used when image.tag is empty in values.yaml). A jump from v0.x to v8.x typically indicates breaking changes per semantic versioning conventions. Without upstream release notes or migration guidance, deployers cannot assess compatibility risks or required configuration changes.

Suggested fix: Add a link to upstream control-layer release notes in the PR description, or include a comment in Chart.yaml referencing the release/tag that documents changes between v0.25.0 and v8.58.1. Consider verifying the new image works with current chart templates before merging.

[doubleword-code]

Summary

This PR updates the appVersion in Chart.yaml from 0.25.0 to 8.59.0, which controls the default Docker image tag for the control-layer container (ghcr.io/doublewordai/control-layer). This is a Renovate-generated dependency update.

Verdict: Approve - The change is minimal, correct, and follows Helm best practices for versioning.

Research notes

Reviewed how appVersion is consumed:

• Chart.yaml line 6: defines appVersion: 8.59.0
• templates/deployment.yaml line 42: image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
• values.yaml line 52: tag: "" (empty, so defaults to AppVersion)

The templating logic correctly uses .Chart.AppVersion as the default when no explicit tag override is provided.

Suggested next steps

1. Verify upstream compatibility (non-blocking): Given the major version jump from 0.x to 8.x, confirm that no breaking changes in the control-layer application require corresponding updates to:

   • Environment variables expected by the container
   • Health check endpoints (/healthz on port 3001)
   • Configuration file format at /app/config.yaml
   • Secret structure

   This verification is typically done via the upstream release notes for control-layer v8.

2. Consider adding a version assertion test (optional): The existing test in tests/control_layer_deployment_test.yaml only validates the image matches a regex pattern. Adding a test that asserts the default image tag equals the expected AppVersion would catch accidental mismatches.

General findings

No blocking issues identified. The change is a standard Helm chart version bump with correct template integration.