procoduck · Sep 29, 2026 · Sep 29, 2026
diff --git a/AGENTS.md b/AGENTS.md
@@ -80,7 +80,7 @@ Images in Dockerfiles, compose files, kind manifests, Go pod specs and testconta
 | Upstream image | Pin lives in |
 |---|---|
 | `gcr.io/distroless/base-nossl-debian12:nonroot` | `deploy/versions.env` (DISTROLESS_BASE_IMAGE) — app and simulator images (`make check-docker` guards `deploy/Dockerfile.*`; the init image's runtime base is GO_IMAGE); `e2e/mockmsft/Dockerfile:6` hardcodes `static-debian12:nonroot` — not in `check-docker`, but Renovate refreshes its digest |
-| `grafana/alloy:v1.19.2` | `deploy/versions.env` (ALLOY_IMAGE); compose files restate it as a `${ALLOY_IMAGE:-…}` fallback, `dev/kind/alloy.yaml` takes it via `__ALLOY_IMAGE__` |
+| `grafana/alloy:v1.20.1` | `deploy/versions.env` (ALLOY_IMAGE); compose files restate it as a `${ALLOY_IMAGE:-…}` fallback, `dev/kind/alloy.yaml` takes it via `__ALLOY_IMAGE__` |
 | `golang:1.26-alpine` | `deploy/versions.env` (GO_IMAGE); also the init image's runtime base; `e2e/mockmsft/Dockerfile:1` hardcodes it — not in `check-docker`, Renovate-refreshed |
 | `node:24-slim` | `deploy/versions.env` (NODE_IMAGE) |
 | `postgres:16-alpine` | compose files, `Makefile` (smoke), `internal/testutil/postgres.go`, `e2e/k8s/fixtures_test.go` — NOT versions.env |

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -13,6 +13,15 @@ Categories used here:
 
 ## Unreleased
 
+### Changed
+
+- **Alloy v1.20.1.** The bundled Alloy (Stage 2 validation, the receiver tier, the sandbox) and the
+  component schema the editor and visual builder use move from v1.19.2 to v1.20.1. New components:
+  `otelcol.encoding.jsonlog` and `otelcol.encoding.text` (experimental). **Behaviour change in
+  your pipelines:** in `otelcol.receiver.filelog`, `top_n = 0` now means "track all files" instead
+  of "use the default" — leave it unset for the default. Collectors keep running whatever Alloy
+  version you deploy them with; this changes what Shepherd validates against. (#183)
+
 ## v0.12.0
 
 Chart 0.16.0. The **receiver tier** ships (off by default; review gate R3 signed): an OTLP/HTTP

diff --git a/README.md b/README.md
@@ -48,7 +48,7 @@ traces; it configures the collectors that ship them.
 | To | You need |
 |---|---|
 | Run Shepherd | A Kubernetes cluster, Helm 3, and a **PostgreSQL 16** it can reach — the only major every test, testcontainers run, and the compose stacks pin (`postgres:16-alpine`); older majors are untested. The chart needs no CRDs by default. |
-| Run collectors | [Grafana Alloy](https://grafana.com/docs/alloy/) **v1.19.2** — the version whose component schema this build validates against, pinned in `deploy/versions.env`. |
+| Run collectors | [Grafana Alloy](https://grafana.com/docs/alloy/) **v1.20.1** — the version whose component schema this build validates against, pinned in `deploy/versions.env`. |
 | Build from source | Go (see `go.mod`), Node 24 with pnpm, Docker (tests start real PostgreSQL via testcontainers), and Helm. |
 
 Two optional integrations need their operators installed first:

diff --git a/deploy/Dockerfile.goreleaser b/deploy/Dockerfile.goreleaser
@@ -1,4 +1,4 @@
-ARG ALLOY_IMAGE=grafana/alloy:v1.19.2@sha256:b8ec653c44235fbe910879145dac3597d66b0aaecf60bcbbe82580767771a839
+ARG ALLOY_IMAGE=grafana/alloy:v1.20.1@sha256:2aa2099af76c0098d4af7a4d6e48f86cb66dc1a000222ad927a1c67c6542d13f
 ARG DISTROLESS_BASE_IMAGE=gcr.io/distroless/base-nossl-debian12:nonroot@sha256:be40c00dfabd86576d92666e87e406714d5618342de1a0c213ad232de255172e
 
 # Stage 1: Get alloy binary from the pinned fleet version

diff --git a/deploy/Dockerfile.goreleaser-simulator b/deploy/Dockerfile.goreleaser-simulator
@@ -1,4 +1,4 @@
-ARG ALLOY_IMAGE=grafana/alloy:v1.19.2@sha256:b8ec653c44235fbe910879145dac3597d66b0aaecf60bcbbe82580767771a839
+ARG ALLOY_IMAGE=grafana/alloy:v1.20.1@sha256:2aa2099af76c0098d4af7a4d6e48f86cb66dc1a000222ad927a1c67c6542d13f
 ARG DISTROLESS_BASE_IMAGE=gcr.io/distroless/base-nossl-debian12:nonroot@sha256:be40c00dfabd86576d92666e87e406714d5618342de1a0c213ad232de255172e
 
 # Stage 1: the pinned Alloy the sandbox runs as a child process

diff --git a/deploy/Dockerfile.local b/deploy/Dockerfile.local
@@ -1,6 +1,6 @@
 ARG GO_IMAGE=golang:1.26-alpine@sha256:ce864e7223ac17b1775e6fd0b4c0db580c2eb50e7953a427916379e4b92a1628
 ARG NODE_IMAGE=node:24-slim@sha256:2fe369e969550cde8e867afc3fe370b260140cab4a23d467074295b42163d553
-ARG ALLOY_IMAGE=grafana/alloy:v1.19.2@sha256:b8ec653c44235fbe910879145dac3597d66b0aaecf60bcbbe82580767771a839
+ARG ALLOY_IMAGE=grafana/alloy:v1.20.1@sha256:2aa2099af76c0098d4af7a4d6e48f86cb66dc1a000222ad927a1c67c6542d13f
 ARG DISTROLESS_BASE_IMAGE=gcr.io/distroless/base-nossl-debian12:nonroot@sha256:be40c00dfabd86576d92666e87e406714d5618342de1a0c213ad232de255172e
 ARG PNPM_VERSION=11.22.0
 

diff --git a/deploy/Dockerfile.simulator b/deploy/Dockerfile.simulator
@@ -8,7 +8,7 @@
 # credentials and links no Microsoft Graph client. Everything the container can
 # reach is everything a user's graph can reach.
 ARG GO_IMAGE=golang:1.26-alpine@sha256:ce864e7223ac17b1775e6fd0b4c0db580c2eb50e7953a427916379e4b92a1628
-ARG ALLOY_IMAGE=grafana/alloy:v1.19.2@sha256:b8ec653c44235fbe910879145dac3597d66b0aaecf60bcbbe82580767771a839
+ARG ALLOY_IMAGE=grafana/alloy:v1.20.1@sha256:2aa2099af76c0098d4af7a4d6e48f86cb66dc1a000222ad927a1c67c6542d13f
 ARG DISTROLESS_BASE_IMAGE=gcr.io/distroless/base-nossl-debian12:nonroot@sha256:be40c00dfabd86576d92666e87e406714d5618342de1a0c213ad232de255172e
 
 # Stage 1: build the simulator binary

diff --git a/deploy/versions.env b/deploy/versions.env
@@ -4,8 +4,8 @@
 # Replace with your organisation's registry mirror prefix if applicable.
 GO_IMAGE=golang:1.26-alpine@sha256:ce864e7223ac17b1775e6fd0b4c0db580c2eb50e7953a427916379e4b92a1628
 NODE_IMAGE=node:24-slim@sha256:2fe369e969550cde8e867afc3fe370b260140cab4a23d467074295b42163d553
-ALLOY_IMAGE=grafana/alloy:v1.19.2@sha256:b8ec653c44235fbe910879145dac3597d66b0aaecf60bcbbe82580767771a839
-ALLOY_VERSION=v1.19.2
+ALLOY_IMAGE=grafana/alloy:v1.20.1@sha256:2aa2099af76c0098d4af7a4d6e48f86cb66dc1a000222ad927a1c67c6542d13f
+ALLOY_VERSION=v1.20.1
 # The simulator image must RUN the Alloy binary, not just ship it. Alloy v1.18.1
 # is dynamically linked (libc, libpthread, libdl, ld-linux), so distroless/static
 # cannot exec it — the process dies with "no such file or directory", which is the

diff --git a/dev/docker-compose.dev.yaml b/dev/docker-compose.dev.yaml
@@ -235,7 +235,7 @@ services:
 
   # cluster=prod-eu-1 / role=metrics
   alloy-metrics:
-    image: ${ALLOY_IMAGE:-grafana/alloy:v1.19.2@sha256:b8ec653c44235fbe910879145dac3597d66b0aaecf60bcbbe82580767771a839}
+    image: ${ALLOY_IMAGE:-grafana/alloy:v1.20.1@sha256:2aa2099af76c0098d4af7a4d6e48f86cb66dc1a000222ad927a1c67c6542d13f}
     depends_on:
       shepherd:
         condition: service_healthy
@@ -252,7 +252,7 @@ services:
 
   # cluster=prod-eu-1 / role=logs
   alloy-logs:
-    image: ${ALLOY_IMAGE:-grafana/alloy:v1.19.2@sha256:b8ec653c44235fbe910879145dac3597d66b0aaecf60bcbbe82580767771a839}
+    image: ${ALLOY_IMAGE:-grafana/alloy:v1.20.1@sha256:2aa2099af76c0098d4af7a4d6e48f86cb66dc1a000222ad927a1c67c6542d13f}
     depends_on:
       shepherd:
         condition: service_healthy
@@ -269,7 +269,7 @@ services:
 
   # cluster=staging-eu-1 / role=metrics
   alloy-staging:
-    image: ${ALLOY_IMAGE:-grafana/alloy:v1.19.2@sha256:b8ec653c44235fbe910879145dac3597d66b0aaecf60bcbbe82580767771a839}
+    image: ${ALLOY_IMAGE:-grafana/alloy:v1.20.1@sha256:2aa2099af76c0098d4af7a4d6e48f86cb66dc1a000222ad927a1c67c6542d13f}
     depends_on:
       shepherd:
         condition: service_healthy

diff --git a/docs/project-status.md b/docs/project-status.md
@@ -56,7 +56,7 @@ last exercised the surface, so the claim is checkable by run id rather than by t
 
 Verified on the running stack and in the browser, not inferred:
 
-- **Agent protocol** — real Alloy v1.19.2 agents register, poll and apply served config; status,
+- **Agent protocol** — real Alloy v1.20.1 agents register, poll and apply served config; status,
   hash and not-modified round-trip. Collector-token auth is a Connect request gate (v0.5.0): a
   bad credential is refused before the body is read.
 - **Merge engine + validation gate** — served config carries both seeded pipelines, declare-wrapped,
@@ -242,7 +242,7 @@ In rough priority order; closed items stay in place, marked with the release tha
       successfully."** `ClearStaleFailedStatus` promotes NULL/FAILED to `APPLIED` on a status-less
       poll carrying the served hash, and nothing Shepherd reads today (`effective_config` is
       unread; beacon rows are not keyed by collector instance) can tell a fresh load from a
-      rejected one served from cache. Needs a reproduction against a live Alloy v1.19.2 agent
+      rejected one served from cache. Needs a reproduction against a live Alloy v1.20.1 agent
       before picking one of three options — see `docs/archive/plans/2026-09-14-walkthrough-fixes.md` §3
       (B1). GitHub issue #115.
 - [x] **Wizards have no channel to say when they silently drop or add something** (B2) — a

diff --git a/docs/spec.md b/docs/spec.md
@@ -914,7 +914,7 @@ The e2e suite proves the full loop **locally with no cloud dependencies**: a gen
 | `mockmsft` | Built from `e2e/mockmsft/` — one small Go server with two route groups: **Graph**: `GET /v1.0/me/transitiveMemberOf/microsoft.graph.group` (returns groups based on a header/token the suite controls; include one paginated response with `@odata.nextLink` to exercise paging) and `GET /v1.0/groups?$filter=...`; **token exchange**: a mock Entra token endpoint (SP client-credentials) and a GitHub-App installation-token endpoint; `/__fixture` parks a Gitea PAT for the suite. There is no ADO repository fake — real git comes from the `gitea` + `gitea-init` compose services, alongside `shepherd-token`, `simulator` (profile `sim`) and the `egress-canary` probe helper. |
 | `shepherd-init` | The shepherd image, one-shot: waits for postgres, runs `migrate up`, then `token create --name e2e --secret <fixed>` with the dev env var set. |
 | `shepherd` | The locally built image (`make docker-build` first), `depends_on: shepherd-init: service_completed_successfully`. Config via env: mock issuer, mock graph/ado base URLs, `auth.app_admin_group_ids: ["11111111-...-appadmins"]`, encryption key, `gitsync.tick: 2s`. |
-| `alloy` | `grafana/alloy:v1.19.2` (`ALLOY_IMAGE`/`ALLOY_VERSION` in `deploy/versions.env` — the single pin every Dockerfile and compose file consumes; needed for `remote_config_status` reporting, never `latest` per §D.6). Command `run /etc/alloy/config.alloy --storage.path=/tmp/alloy --server.http.listen-addr=0.0.0.0:12345 --disable-reporting`. `e2e/alloy/config.alloy` contains ONLY a `remotecfg` block: url `http://shepherd:8080`, basic_auth with the fixed token, `poll_frequency = "10s"` (the enforced minimum), attributes `cluster = "e2e-cluster"`, `role = "metrics"`. |
+| `alloy` | `grafana/alloy:v1.20.1` (`ALLOY_IMAGE`/`ALLOY_VERSION` in `deploy/versions.env` — the single pin every Dockerfile and compose file consumes; needed for `remote_config_status` reporting, never `latest` per §D.6). Command `run /etc/alloy/config.alloy --storage.path=/tmp/alloy --server.http.listen-addr=0.0.0.0:12345 --disable-reporting`. `e2e/alloy/config.alloy` contains ONLY a `remotecfg` block: url `http://shepherd:8080`, basic_auth with the fixed token, `poll_frequency = "10s"` (the enforced minimum), attributes `cluster = "e2e-cluster"`, `role = "metrics"`. |
 
 ### 18.3 Suite mechanics
 

diff --git a/e2e/docker-compose.e2e.yaml b/e2e/docker-compose.e2e.yaml
@@ -247,7 +247,7 @@ services:
     # version must be >= v1.12 for remote_config_status reporting; bump deliberately.
     # Default tracks ALLOY_IMAGE in deploy/versions.env — override via env var to
     # test a different Alloy build without editing this file.
-    image: ${ALLOY_IMAGE:-grafana/alloy:v1.19.2@sha256:b8ec653c44235fbe910879145dac3597d66b0aaecf60bcbbe82580767771a839}
+    image: ${ALLOY_IMAGE:-grafana/alloy:v1.20.1@sha256:2aa2099af76c0098d4af7a4d6e48f86cb66dc1a000222ad927a1c67c6542d13f}
     depends_on:
       shepherd:
         condition: service_healthy