Munitor/docs/SESSION-STATE.md

## Release 0.3.11 (2026-10-19)

PR52 passed all eight hosted checks on 18ea857 and merged as d76a46c.
This release forwards configured Java migration images and smoke paths to develop
and staging. Source and packed generator regressions, make all and 20 BATS pass.
Release metadata is the only change from the verified implementation; stable
publication and backend adoption follow. Production 0.1.138 remains healthy.

## Java deployment health parameter correction (2026-10-19)

Backend develop job 6405 exposed missing migration/smoke configuration in the
shared Java deployment partial: startup failed because slack_template was absent.
The partial now forwards health_migrations and health_smoke_paths just like the
production and release workflows. No application or scan policy changes.

tests/test_java_deploy_health.sh checks configured values and empty defaults in
develop, staging, production and release-candidate using both source and packed
generators. Full make all, 20 BATS tests, focused regression rerun and shell lint
passed through WSL. Packed scripts are synchronized. Publication and consumer
verification are pending.

## Verified agile CI rollout (2026-10-19)

Munitor 0.3.10 is published from main 19192d07 (PR48 implementation, PR49 release,
PR50 back-merge). Backend PR333 adopted it and passed the complete workflow:
777 identical test identities, zero failures/errors, five skips, 15m33 elapsed.
Its actual ci/circleci: ci-ready result now protects main/develop; Munitor uses
ci/circleci: lint-pack/ci-ready. Only the required-check lists changed; other
branch rules are unchanged. Published source and actual consumer compilation passed.

Backend docs PR335 selected exactly secrets-scan plus ci-ready, without build,
image or deployment jobs. Native auto-cancel canceled the first docs run after
44 seconds when the final documentation commit arrived. No cancellation script
or manual cancellation was used. The final docs run passed in 5m23 and merged as 8dda8339; main also selected only those two jobs.

Native Insights supplies ongoing P50/P95 and flaky-test reporting. Historical
windows lag current work; compare matching samples and keep docs-checks separate.
Backend auto-cancel is enabled; Munitor remains off because its default develop
would not exempt main release workflows. No new orchestration or reporting service.

## Release 0.3.10 (2026-10-19)

PR48 merged as f9ef625 after all hosted checks passed on a56ef1d. Local make all,
20 BATS, 31 classifier cases and eight source/packed generator cases passed.
Munitor main/develop now require the verified native ci/circleci: lint-pack/ci-ready
result; all other rules are unchanged. This release changes metadata only from
that verified implementation. Stable publication and backend adoption follow.

## Agile CI (2026-10-19)

Fast Java CI shipped as Munitor 0.3.9 and Website-Backend PR330. The warm
consumer PR workflow fell from 37m04 to 20m45; cache restore fell from 5m32 to
4.76s (48GiB to 565MiB). Backend PR332 then preserved all 777 test identities
while reducing its verified PR workflow to 14m49 and tests to 8m10. Timing-sensitive
performance tests run serially after the parallel suite; thresholds are unchanged.

Current feature/agile-ci adds conservative opt-in documentation-only validation
and one aggregate merge result. Backend native auto-cancel is enabled; Munitor
remains off because its default branch is develop. Native Insights provides
runtime/flaky-test reporting without another service. Local classifier and
workflow-graph regressions pass; publication and consumer adoption are pending.
See docs/PLAN-agile-ci.md for migration order and measurement limits.

## Fast Java CI (2026-10-19)

Active user priority: fast, agile, lightweight CI/CD; backend ticket goal paused.
Measured48GiB Maven cache restored four times and saved once per backend PR.
Work on feature/lean-java-ci: stable exact dependency cache keys with new namespace,
conditional OWASP setup, single test-result upload, and one orb pack per pipeline.
The first patch passed make all and15BATS. Further simplification combines quality
and coverage with the build, renders fixtures once, and carries installed reactor
artifacts in a small workspace archive. A real multi-module experiment proved this
artifact handoff necessary, including snapshot/classifier coverage. Expanded make
all and20BATS pass, including all277template assertions. Real consumer timing and
stable publication/adoption remain pending. No deployed speedup claimed.
See docs/PLAN-lean-java-ci.md.

## Supplemental runtime freshness (2026-10-19)

Backend PR311 image scan6307 failed because db-backup reused a cached apk-upgrade layer (libexpat2.8.5-r0, fixed2.9.0-r0). Supplemental builds now use --pull --no-cache in both PR scan-only and release publishing paths. Trivy and immutable-tag guards remain unchanged. Targeted tests cover both Dockerfile forms, fresh-build flags, scan-before-push ordering and scan failure propagation. Validation pending; no release or consumer adoption yet.

# Munitor session state

## JVM runtime package freshness (2026-10-19)

Website-Backend release6258 and PR scans6266/6277 reused a cached apk upgrade
layer containing vulnerable libexpat. The shared docker_build command now pulls
the base and bypasses layer caching for generated Java/Gradle runtimes, while
Node caching and all Trivy gates remain intact. Narrow behavioral tests cover
both pipeline types, alternate/missing manifests, tags, provenance, and both
PR/release job routes. All eight focused shell cases passed via the coordinating
agent; ShellCheck and git diff --check passed. Full make/BATS/orb validation and
real-image scanning remain pending. Stable release and consumer adoption remain
pending; no unchanged vulnerable image should be retried.

## PR container scanning (2026-10-13)

Uncommitted work on `feature/pr-image-scan` adds `docker_scan` after
`build-and-test` in the four application PR templates. It restores the existing
feature/hotfix version metadata, builds locally, and applies the release Trivy
HIGH/CRITICAL policy from the repository root. Supplemental images use
`push: false`; the command defaults to publishing for existing callers. Main
and supplemental JSON reports are artifacts. Release candidates already scan
through `docker_build_push`, so no duplicate job was added.

Verified: native CircleCI orb pack/validate, ShellCheck on all source scripts
and the changed tests, template structure/filters/parameter wiring, packed
template synchronization, and `git diff --check`. Requested make and BATS runs
were attempted but Git Bash cannot start in this sandbox (CreateFileMapping,
Win32 error 5); yamllint is not installed. New behavioral tests therefore need
a Linux/CI run, including real Docker/Trivy integration. No commit or publish.
The Second Brain vault is outside writable roots; continuity is recorded here.

## Release 0.3.3 (2026-10-11)

PR22 (00f349c) fixes release version collisions. Website-Backend #65/#66 (0.1.24)
and #80/#79 (0.1.32) built concurrently, computed the same GitVersion version,
overwrote the GHCR tag, and github-release tagged the moving main head, so prod
ran an image missing the later merge. Build jobs now reserve vX.Y.Z atomically
(POST git/refs; next patch on conflict; tags never move), docker_build_push guards
immutable version tags via the org.opencontainers.image.revision label,
update_cd_repo verifies tag ownership, and github_release targets CIRCLE_SHA1.
The generator renders cd_path only when cd.path is set (older-orb manifests on
website develop branches, Concilium, and makers4 failed with "Unexpected
argument(s): cd_path"). Consumer pin bumps are coordinated per repo because a
main merge deploys.

Local Windows runs: 4 test_generate_config health_path assertions fail on clean
develop too (Git-for-Windows rewrites /api/health); CI on Linux is authoritative.

## Release candidate 0.3.2 (2026-10-10)

Munitor PR19 merged to develop at c8bbf2e. Release branch `release/0.3.2`
promotes the bounded publishing CI fixes to main. Full make all and the feature
CircleCI lint/pack/review/snapshot publication passed. Stable publication still
requires the v0.3.2 tag on main and successful production orb publication.

EX-0008 is registered by standards PR27 (5c21fc7); Website-Frontend may select the
new stable orb after publication. Default audit policy, Trivy and GitOps contracts
are preserved. Website-Backend's Java installation now avoids interactive Ubuntu
service-restart dialogs. Website consumers and production remain pending.

## Current status

The `develop` branch contains the complete `0.3.0` feature set. PR #6 added
first-class pnpm support and the Obsidian pipeline, PR #8 added opt-in
repository Dockerfile preservation for `node-webapp`, and PR #10 added
consolidated Kustomize GitOps write-back with production-only controls and
bounded push-race retries. Investing in Chester and QRun marketing both proved
the release path through CircleCI, GHCR, `KofTwentyTwo/cluster-gitops`, and
ArgoCD.

## Release state

- Latest stable target: `kof22/munitor@0.3.0`
- Stable consumer pin: `kof22/munitor@0.3`
- Development aliases: `dev:<commit>` and `dev:snapshot`
- Default branch: `develop`; `main` is release-only
- Release tag: `v0.3.0`

## Verification

Run `make all` before release. The stable tag must publish successfully through
CircleCI before consumer repositories move from immutable development pins to
`0.3`.

## Publishing release CI fixes (2026-10-10)

Feature branch `feature/scoped-audit-exceptions` prepares development-only npm
exceptions with expiry, exact advisory/package/version checks, an independent
production audit and reassessment on a new upstream release. Website-Frontend's
proposed EX-0008 covers braces 3.0.3 through 2026-11-10. Regression tests exercise
acceptance and rejection paths. The default audit and Trivy remain unchanged.

Website-Backend CI job 1135 timed out in Ubuntu's interactive needrestart prompt
after Java installation. APT now receives noninteractive debconf and automatic
needrestart settings; a stubbed integration test verifies both APT invocations.
These fixes require normal feature-to-develop review and stable tag publication
from main before website consumers can select the new version. Nothing deployed.

Runtime freshness validation: coordinating agent completed make all (lint, pack, orb validation, scripts,277template assertions) and all7BATS tests in Ubuntu. Real consumer image scan remains required after release.

## Release 0.3.7 preparation (2026-10-19)
Includes merged PR38 (filesystem Trivy findings fail CI; current Semgrep image and zero-scan/configuration failures) and PR39 (pull fresh runtime bases and bypass cached JVM package-upgrade layers). Both feature PRs passed all CircleCI gates; PR39 also passed full local make all and seven BATS tests. Publish the stable orb only from a signed v0.3.7 tag on the reviewed main merge. Website-Backend must update both orb pins and pass real image/SAST scans before rollout. No vulnerability waiver or immutable-tag overwrite is part of this release.

Validation completed: focused scan tests12/12, full make all (lint, packed orb validation, script/template tests), and7BATS passed under WSL/Nix on2026-10-19. Real backend supplemental image scans remain required after stable release adoption.

## Release candidate 0.3.8 (2026-10-19)

Promotes PR42 supplemental build freshness fix (develop11d5704) to main. Full local make all and seven BATS passed; all PR42 CI checks passed. Release metadata changes only; source/tests match the verified feature. Stable publication still requires the approved main merge and signed v0.3.8 tag. Backend adoption and real supplemental scans remain pending.

## Release candidate 0.3.9 (2026-10-19)

Promotes PR45 (develop64831e8): consolidated Java quality/coverage, bounded dependency caches with current artifact/SNAPSHOT handoff, conditional OWASP setup, and deduplicated orb/test work. Source and tests are identical to verified77cdf93: make all and20BATS passed; actual CircleCI compiler preserves required build-and-test name. Cold backend canary PR330 passed every test/scan: combined build19m02s vs old build/test30m15s, Maven cache565MiB vs old48GiB. Stable publication and backend warm-cache adoption remain pending. Production build retains its prior operations under a distinct name to avoid PR check suffixes.