[pmoust]

Bump the chart to 0.9.0 and the default Edge image to v3.9.0.

Edge v3.9.0 long-polls brain for refresh requests and publishes its full snapshot on demand (NOFireAI/edge#165). The poll is on by default and its URL derives from publisher.graph.url, so no new values are needed. Against a brain without the endpoint the agent logs once and polls rarely.

The release also ships the admission webhook RBAC from #23. The agent does not watch those kinds until a later Edge release (NOFireAI/edge#166).

Merge only after the Edge v3.9.0 release workflow has published nofireai/edge:v3.9.0.

Refs NOFireAI/brain-go#5355

[pmoust]

@claude-fleet review

[claude-fleet]

Review task queued.

Task: b330d556-14ae-4d40-b06f-2c9e30b9903a
Commit: b2769e5
Model: claude-opus-5 (effort medium)
Executor: ravel-clickbench-ubuntu-2
Status: done. Review posted.

[claude-fleet]

No findings.

Approve: release bump only, no finding.

Verified:

• Every version string moves together and nothing stale is left behind: Chart.yaml:5-6 (0.9.0 / v3.9.0), values.yaml:10-12, examples/production-values.yaml:5, manifests.yaml:22. grep -rn "3\.8\.0" over the tree returns nothing.
• The image tag in manifests.yaml equals the chart appVersion, which is what tests/manifests/check.sh:58-60 asserts.
• The admission webhook RBAC from #23 is in this release and present in both places: templates/rbac.yaml:39-41 and manifests.yaml:112-114, get, list, watch on mutatingwebhookconfigurations and validatingwebhookconfigurations — matching the assertion at tests/manifests/check.sh:49-52.
• No test or golden file pins the image tag, so none needed updating: grep -rln "v3\.8\|v3\.9" tests/ is empty, and tests/render/cases/defaults holds only values.yaml and expect.jq.
• publisher.graph.url exists as a value and reaches config.json, so a poll URL derived from it needs no new values on the chart side: values.yaml:321-323, templates/configmap.yaml:82-85.

Checks run:

• grep -rn "3\.8\.0\|3\.9\.0\|0\.8\.0\|0\.9\.0" excluding node_modules → only the six expected lines.
• bash tests/manifests/check.sh → could not run, yq: command not found in this environment. Helm is also absent, so the render and unittest suites did not run here; CI covers them. The two things that script checks about this diff (tag equals appVersion, admission webhook rule shape) I confirmed by reading the files.

Smaller things:

• config.publisher.timeout defaults to 30s (values.yaml:317) and is passed through to the publisher block (templates/configmap.yaml:78). If Edge v3.9.0's refresh long-poll shares that HTTP client timeout, the default would cut every poll at 30s rather than letting it hang. Worth confirming the poll uses its own timeout; if it does not, the chart default may need raising alongside this bump.
• The merge gate in the description names only nofireai/edge:v3.9.0. edgeProxy.image.tag defaults to .Values.image.tag (values.yaml:398-401, templates/edge-proxy-deployment.yaml:29), so anyone with edgeProxy.enabled: true also needs nofireai/edge-proxy:v3.9.0 published. Same coupling as 0.8.0 and the proxy is off by default, so this is only a note about the gate's wording.
• values.yaml:223-229 says "The ClusterRole already grants get, list and watch on them" about the commented opt-in kinds. The ClusterRole now also grants the admission webhook kinds, which appear nowhere in that list. Correct as of this release since the agent does not watch them yet, but the follow-up Edge release will want a line there.

Not checked:

• Edge v3.9.0 behavior itself (NOFireAI/edge#165, #166): that the refresh poll derives its URL from publisher.graph.url, that it is on by default, that it polls rarely against a brain without the endpoint, and whether it honors config.publisher.timeout — the edge repo is not reachable from this workspace
• Whether nofireai/edge:v3.9.0 and nofireai/edge-proxy:v3.9.0 are published in the registry
• tests/manifests/check.sh, tests/render/run.sh and the helm unittest suites were not executed (yq and helm absent)

Task b330d556-14ae-4d40-b06f-2c9e30b9903a on ravel-clickbench-ubuntu-2, model claude-opus-5, effort medium.