Stability checkpoint v0.5.4 — bake sidecar configs (close v0.5.3 allow_failure) - feat(security): bake sidecar configs into images, drop smoke:full-stack allow_failure (ADR-0035) (4aaf069) v0.5.3 shipped allow_failure:true on smoke:full-stack with a dated TODO (remove by 2026-05-15). v0.5.4 closes that TODO 15 days early. Root cause was a Docker-in-Docker bind-mount limitation : sidecars bind-mounted docker/dnsmasq.conf + tinyproxy.conf from the repo, which broke under DinD because /builds/... CI workspace paths aren't visible to the host daemon. Fix : COPY the configs into the sidecar images at build time. Drop the bind-mounts. Drop the allow_failure. smoke:full-stack now gates the release pipeline as designed. Bonus security : cosign signing covers the policy bytes, not just the binary. An operator verifying registry.gitlab.com/.../dns-filter:v0.5.4 is verifying the dnsmasq allowlist rules at the same time. CI : - ✅ Main pipeline green - ✅ MR #21 merged - ✅ Tag pipeline expected 32/32 hard-gate (no allow_failure) Local test pass : - ✅ 152 tests pass - ✅ bash bin/test-full-stack.sh → 2/2 PASS without bind-mounts - ✅ ruff / mypy / shellcheck clean - Sidecar policy bytes are now part of the cosign-signed image, not external bind-mount files - No more allow_failure shields in CI - All pipeline jobs hard-gate releases (no allow_failure escape hatches) - 35 ADRs (was 34 in v0.5.3) - ADR-0035 NEW : DinD bind-mount → COPY-into-image solution - JWT validation in /check - OIDC discovery - TTL cache for HTTPPrincipalProvider - Bearer/mTLS auth on the IdP URL - v0.6.0 — full OIDC integration on top of the v0.5 PrincipalProvider abstraction