release: prepare v0.3.0

Promotes the validated 0.3.0-rc.1 candidate unchanged. Every release
artifact verified from a clean directory (checksums, Sigstore blob and
image signatures, SPDX SBOMs, manifest, and matching OCI chart digest),
and the digest-pinned image ran from the published chart in a
disposable homelab namespace on both nodes: full-rate scoped Redis and
HTTP capture, zero loss across all counters through a ten-minute soak,
generated trace identity on every span, complete server-side
Kubernetes attribution, zero restarts, and a bounded 19 to 20
millicore, 59 MiB footprint. The environment was fully removed and the
standing deployment verified untouched. Release contract check and the
full quality gate pass with no skipped stages on this tree.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: vicotrbb

CHANGELOG.md

@@ -6,6 +6,22 @@ All notable changes to E-Navigator are documented here. The format follows
 
 ## [Unreleased]
 
+## [0.3.0] - 2026-07-24
+
+### Validation
+
+- Promote `0.3.0-rc.1` unchanged after candidate validation: every release
+  artifact verified from a clean directory (checksums, Sigstore blob and
+  image signatures, SPDX SBOMs, and the release manifest, with the pulled
+  OCI chart digest matching the manifest), and the digest-pinned image ran
+  from the published OCI chart in a disposable homelab namespace on both
+  nodes. Scoped Redis and HTTP workloads were captured at full offered rate
+  with zero transport, queue, or export loss, generated trace identity on
+  every span, complete server-side Kubernetes attribution, and in-kernel
+  denial of all out-of-scope cgroups. Short-lived one-shot client processes
+  remain attributed as missing context with structured warnings, per the
+  attribution contract.
+
 ## [0.3.0-rc.1] - 2026-07-23
 
 ### Security

Cargo.lock

@@ -33,7 +33,7 @@ exclude = ["fuzz"]
 [workspace.package]
 edition = "2024"
 license = "Apache-2.0"
-version = "0.3.0-rc.1"
+version = "0.3.0"
 rust-version = "1.96"
 repository = "https://github.com/guaracloud/e-navigator"
 homepage = "https://github.com/guaracloud/e-navigator"

Cargo.toml

@@ -5,7 +5,7 @@ observability. It captures node-local activity, attaches evidence-backed
 workload context, derives bounded native telemetry, and exports through JSON,
 Prometheus, OTLP HTTP, and local pprof surfaces.
 
-**Status:** active development after public preview `0.3.0-rc.1`. E-Navigator is a
+**Status:** active development after public preview `0.3.0`. E-Navigator is a
 collector, not a storage backend, query engine, or UI. Capabilities are promoted
 only when their matching evidence exists.
 
@@ -143,7 +143,7 @@ Install the published OCI chart only after release verification:
 
 ```bash
 helm upgrade --install e-navigator oci://ghcr.io/guaracloud/charts/e-navigator \
-  --version 0.3.0-rc.1 \
+  --version 0.3.0 \
   --namespace e-navigator-system \
   --create-namespace
 ```

README.md

@@ -2,8 +2,8 @@ apiVersion: v2
 name: e-navigator
 description: Rust and eBPF signal plane for Linux and Kubernetes observability
 type: application
-version: 0.3.0-rc.1
-appVersion: "0.3.0-rc.1"
+version: 0.3.0
+appVersion: "0.3.0"
 home: https://github.com/guaracloud/e-navigator
 icon: https://guaracloud.github.io/e-navigator/logos/logo-square-transparent.png
 sources:

charts/e-navigator/Chart.yaml

@@ -33,7 +33,7 @@ spec:
       affinity: {}
       containers:
         - name: e-navigator
-          image: ghcr.io/guaracloud/e-navigator:0.3.0-rc.1
+          image: ghcr.io/guaracloud/e-navigator:0.3.0
           imagePullPolicy: IfNotPresent
           args:
             - "--source"

deploy/kubernetes/daemonset.yaml

@@ -9,7 +9,7 @@ and attribution model.
 
 ```bash
 helm upgrade --install e-navigator oci://ghcr.io/guaracloud/charts/e-navigator \
-  --version 0.3.0-rc.1 \
+  --version 0.3.0 \
   --namespace e-navigator-system \
   --create-namespace
 ```

documentation/helm.md

@@ -6,7 +6,7 @@ keyless Cosign through GitHub OIDC.
 Set the release tag once:
 
 ```bash
-export VERSION=v0.3.0-rc.1
+export VERSION=v0.3.0
 export REPO=guaracloud/e-navigator
 ```
 

documentation/release-verification.md

@@ -76,7 +76,7 @@ <h1>Evidence-first signals for Linux and Kubernetes.</h1>
             <li>Static Rust pipeline</li>
             <li>eBPF sources</li>
             <li>Versioned signals</li>
-            <li>Public preview 0.3.0-rc.1</li>
+            <li>Public preview 0.3.0</li>
           </ul>
         </div>
 
@@ -249,7 +249,7 @@ <h3>Helm OCI chart</h3>
             <div class="command-code">
               <button class="copy-button" type="button">Copy</button>
               <pre><code>helm upgrade --install e-navigator oci://ghcr.io/guaracloud/charts/e-navigator \
-  --version 0.3.0-rc.1 \
+  --version 0.3.0 \
   --namespace e-navigator-system \
   --create-namespace</code></pre>
             </div>
@@ -261,7 +261,7 @@ <h3>Verify release artifacts</h3>
             </div>
             <div class="command-code">
               <button class="copy-button" type="button">Copy</button>
-              <pre><code>gh release download v0.3.0-rc.1 --repo guaracloud/e-navigator --dir e-navigator-release
+              <pre><code>gh release download v0.3.0 --repo guaracloud/e-navigator --dir e-navigator-release
 jq -r '.images[0].reference' e-navigator-release/release-manifest.json</code></pre>
             </div>
           </article>