Release v0.18.1

Release Notes

The full promoted 0.18.1 changelog block is authoritative. At 455,272 bytes it exceeds the GitHub PR-body limit, so this PR links it rather than truncating it.

Highlights:

• Removes the unpatched ecdsa runtime dependency by replacing python-jose with PyJWT for the existing HS256-only token flow.
• Makes channel-profile fan-in conflicts explicit and operator-resolved instead of order-dependent.
• Adds persistent process-safe rotating logs, debug-bundle diagnostics, permanent SPDX 2.3 release SBOMs, and expanded backup/sync coverage.
• Fixes bulk channel stream-assignment safety, MCP credential lifecycle readiness, and the release SBOM conformance defects stabilized in PR #937.

Cut Provenance

• PO-authorized dev cut point: 1eab5ec4f92db89c0544a75a8d26b6cbd40dde6e.
• Release stabilization PR #937: merge bff6299be862e45906e1211405f61202a03a1a84.
• Mechanical release commit: af366a2495712a0cdf59fbd8ce282c03c7de4f82 (exactly CHANGELOG.md, three version touchpoints, and three permanent sbom/v0.18.1/ artifacts).
• Release-gate fail-closed fix PR #939: topic 39efdeed585865267304c627d4e9e6bcf1c8d779, merged as f1fbaa880c1ac74dfc5d2808fd80101a8ca7f1f0.
• UTC changelog rollover PR #940: topic a45e2a164f0c87463d116123ac337cfde179d890, merged as current exact release head 6360eb72361397b3c9e91425cd9db883c1f42e6d.

Pre-Cut Gate Checklist

All eight gates have current exact-head evidence.

• G1a: Release Cut Gate run 33290846979, job 99202332140, read authoritative board commit 2fa59fa5 and reported zero unresolved P0/P1 beads.
• G1b: The same exact-head gate aggregated every paginated CodeQL API page and reported zero open HIGH/CRITICAL alerts without shell diagnostics. Fresh backend, MCP, and frontend dependency audits passed. No waiver is claimed. GitHub's aggregate advisory check reports Medium and quality findings from the large main delta; ADR-005 and G1b gate HIGH/CRITICAL.
• G2: Exact-head Backend Tests passed in Tests run 33290847057, job 99202100979. The original mechanical candidate also passed locally with 12,012 tests, 3 documented skips, 2 documented deselections, and 80.01% coverage.
• G3: Exact-head Frontend Tests passed in run 33290847057, job 99202101005, including lint, typecheck, and unit coverage. The original mechanical candidate also passed locally with 255 files / 3,610 tests and a production build.
• G4: Both required exact-head matrix checks passed: CodeQL Analysis (python) job 99202099646 and CodeQL Analysis (javascript-typescript) job 99202099615 in run 33290846994. Both enforced zero open HIGH/CRITICAL findings.
• G5: CHANGELOG.md has a fresh empty [Unreleased] above [0.18.1] — 2026-08-30; the exact-head mechanical gate passed.
• G6: frontend/package.json, backend/main.py, and backend/routers/backup.py identify 0.18.1, matching release/v0.18.1; the exact-head mechanical gate passed.
• G7: The exact-head gate found no competing release-cut or hotfix PR against main; there are no open PRs against release/v0.18.1.
• G8: sbom/v0.18.1/ is committed and exact-head regeneration is byte-identical. Release Cut Gate reported SBOM PASS; fresh audit and deterministic-regeneration checks also passed locally.

Verification

• Exact release head 6360eb72 is clean and synchronized with origin/release/v0.18.1.
• All five required main contexts are green at that head: Backend Tests, Frontend Tests, both CodeQL matrix checks, and Release Cut Gate.
• Exact-head build, ECM/MCP multi-architecture candidate builds, dependency scans, and all four Trivy scans passed.
• Independent review approved the original mechanical candidate with no findings.
• Independent code and security reviews approved PR #939's fail-closed gate fix; its 27 release-policy tests and 17 MCP supply-chain policy tests passed.
• Independent review approved PR #940's one-line UTC date rollover.
• Final independent review of af366a24..6360eb72 found no code, security, integration, unintended-file, or blocking test-quality findings. Its PR-audit finding is addressed by this updated exact-head description.
• Main protection enforces required checks, administrators, force-push/deletion restrictions, and conversation resolution.

G1a Justifications

None.

G1b Waivers

None.

Residual Non-Blocking Scope

• P2 enhancedchannelmanager-5oa58: broaden Dockerfile parsing to BuildKit logical continuations and Unicode-leading instruction whitespace. Those forms are absent from current Dockerfiles and do not affect the current inventory.
• P2 enhancedchannelmanager-6ognp: validate each individual CodeQL alert object's schema before filtering; current aggregation, page shape, filter/count operations, and API failures already fail closed.
• Source-derived SBOMs inventory language dependencies and digest-pinned base/build images, not OS-layer packages or a not-yet-built release image digest. Native image and Trivy publication gates remain authoritative for those layers.
• The changelog date gate is UTC-day-sensitive. If the PR remains open across another UTC rollover, update the heading and rerun the mechanical gate before merge.

Post-Merge Tasks

These are reminders, not authorization to execute them from this PR update.

• Merge this PR with a merge commit only after explicit merge authorization.
• Tag v0.18.1 and create the GitHub Release only after explicit publication authorization.
• Back-sync release-only stabilization and reopen the dev build counter through the documented PR flow.
• Verify published ECM and MCP multi-architecture images and attestations.
• Delete the release branch only after back-sync and publication verification.

References

• Shipping procedure
• ADR-004 release-cut discipline
• ADR-005 CodeQL gating policy
• PR #937 SBOM stabilization
• PR #939 release-gate pagination fix
• PR #940 UTC date rollover