Veritas Kanban 6.1.2 completes the repository-wide reliability, security, storage, provider-runtime, CI, container, and supportability audit. It is a backward-compatible patch release for 6.1.1 with no public API or SQLite schema-version change.
What changed
- One runtime data root. Paths, migration, backup, integrity, health, and Docker mounts use the canonical
DATA_DIRcontract. - Storage boundary restored. File and SQLite repositories own containment, locking, atomicity, and compatibility behavior.
- Explicit provider adapters. Launch, probes, events, completion, mutation, and stop behavior fail closed without implicit fallback.
- One authenticated API client. JSON, blob, stream, and download operations preserve credentials, base paths, and error envelopes.
- Milestone-scoped tests. Ordinary pull requests stay fast; complete test and artifact gates run at declared integration and release milestones.
- Continuous supply-chain controls. CodeQL, dependency alerts, secret scanning, immutable actions, and policy guards remain active.
- Resolved CodeQL baseline. Reviewed all 195 initial alerts: fixed 67, dispositioned 128, and left zero open on the default branch.
- Measured production container. The non-root runtime closure verifies health, auth, SQLite, static web, data paths, and size ceilings.
- Lower maintenance debt. Four unused dependencies were removed and the server warning budget fell from 600 to 458.
- Coordinated security hardening. The private remediation is integrated; disclosure remains gated on supported artifacts and approval.
- Release-gate corrections. Runtime boundary behavior now matches its checked-in contracts.
Issue and pull request traceability
| Audit issue | Outcome | Pull requests |
|---|---|---|
| #1162 | Canonical runtime data paths and legacy compatibility | #1184 |
| #1163 | Service/storage boundary restored across persisted domains | #1190-#1220 |
| #1164 | Provider and attempt lifecycle decomposition | #1223-#1230 |
| #1165 | Credential-aware frontend API migration | #1218 |
| #1166 | Production Docker size and runtime contract | #1222 |
| #1167 | Immutable GitHub Actions | #1179 |
| #1168 | Continuous security scanning | #1180 |
| #1169 | Critical-path coverage baselines and ratchets | #1183 |
| #1170 | Unused dependency removal | #1217 |
| #1171 | Native-loader-compatible Vite and Vitest configuration | #1178 |
| #1172 | Deterministic, milestone-scoped test gates | #1175, #1177, #1181, #1228 |
| #1173 | Server type-safety lint-debt ratchet | #1221 |
| #1231 | Initial CodeQL alert baseline resolved | #1232-#1235 |
| #1238 | Recovery-key alphabet and WebSocket header forwarding | #1239 |
| #1240 | Same-task lifecycle invocation ordering | #1241 |
| #1242 | Sanitized URI prefix validation | #1243 |
Install or upgrade
Back up the complete stopped-writer workspace before upgrading and retain the backup until the new runtime is accepted.
brew update
brew upgrade --cask bradgroux/tap/veritas-kanbanFor a first installation:
brew install --cask bradgroux/tap/veritas-kanbanThe Assets section provides signed and notarized macOS arm64 DMG and ZIP packages after the release workflow completes. Linux and Windows packages remain unsigned verification previews.
Compatibility, migration, and rollback
The public REST API remains v1, and SQLite schema migrations remain at 30 through 33. Upgrading from 6.1.1 does not run a new schema migration. Runtime path normalization can migrate legacy files into the configured canonical data directory; operators should verify the data root, health, backup, and integrity evidence before resuming automation.
Rollback is restore-first. Stop every writer, reinstall 6.1.1 only when its data contracts remain compatible, and otherwise restore the complete stopped-writer pre-upgrade workspace. Never copy an older database over a running instance.
See the full release notes, upgrade guide, compatibility policy, and changelog.