From d7c0ca8eb7c72813000f49ad4ffedaca8a65dc85 Mon Sep 17 00:00:00 2001 From: Renn F Date: Thu, 15 Oct 2026 21:07:44 +0200 Subject: [PATCH] chore(release): complete the 3.2.4 changelog and move the engine pin to 6cde4af The 3.2.4 section now covers the Python reference parity work (#26), and CI, CodeQL and the release build check out guard-core-jvm at the 4.4.0 line. --- .github/workflows/ci.yml | 2 +- .github/workflows/code-ql.yml | 4 ++-- .github/workflows/release.yml | 2 +- CHANGELOG.md | 5 +++++ README.md | 2 +- docs/index.md | 2 +- docs/installation.md | 2 +- settings.gradle.kts | 4 ++-- src/main/kotlin/com/guardcore/agent/Version.kt | 2 +- 9 files changed, 15 insertions(+), 10 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 844b208..e86fb86 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -38,7 +38,7 @@ jobs: run: | git clone https://github.com/Guard-Core/guard-core-jvm.git guard-core-jvm cd guard-core-jvm - git checkout 2415a77b35f99dbaa96ad821b7ef4571992e18f4 + git checkout 6cde4afd08a0172c5f6a41eb8e29ec754288782e # W7 lands the Redis-backed persistence tests; both need Redis (the # same service shape the guard-core-jvm CI runs). diff --git a/.github/workflows/code-ql.yml b/.github/workflows/code-ql.yml index 4aba816..c4b1bf4 100644 --- a/.github/workflows/code-ql.yml +++ b/.github/workflows/code-ql.yml @@ -23,11 +23,11 @@ jobs: # The engine dependency: the composite includeBuild needs the pinned # guard-core-jvm checkout next to the repository (same as ci.yml). - - name: Checkout engine (guard-core-jvm @ 2415a77) + - name: Checkout engine (guard-core-jvm @ 6cde4af) uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: Guard-Core/guard-core-jvm - ref: 2415a77b35f99dbaa96ad821b7ef4571992e18f4 + ref: 6cde4afd08a0172c5f6a41eb8e29ec754288782e path: guard-core-jvm persist-credentials: false diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 261169a..57ae188 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -83,7 +83,7 @@ jobs: run: | git clone https://github.com/Guard-Core/guard-core-jvm.git guard-core-jvm cd guard-core-jvm - git checkout 2415a77b35f99dbaa96ad821b7ef4571992e18f4 + git checkout 6cde4afd08a0172c5f6a41eb8e29ec754288782e # The Redis-backed persistence tests need a live Redis (the same # service shape the guard-core-jvm CI runs). diff --git a/CHANGELOG.md b/CHANGELOG.md index b3f6aa7..92f2279 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,9 +7,14 @@ All notable changes to guard-agent-jvm are documented here. The version line mir ### Fixed - The Redis persist no longer runs on the caller's thread or under the buffer lock, so a slow or failing Redis no longer delays event-emitting requests. The key is minted under the lock and the write is submitted to a bounded persist pool (4 threads, queue of 1024) that `stop` drains for up to 10 seconds. A full or closed pool skips persistence and counts a persist failure, and a record flushed or evicted before its write lands has its key deleted instead of left to TTL. The startup encryption error now reports its cause. +- The agent matches the Python reference on responses, wire shape, persistence and stats (#26). An encrypted 413 halves the batch and re-encrypts each half like the plaintext path, so no encrypted batch is dropped whole. A 200 is a partial failure only on an explicit `success: false` or a truthy `errors`, and an unparseable or empty-object 200 and any unlisted status (202, 204, 3xx, 405, 408) are retried at once without opening the breaker. The rules GET no longer counts 400, 404, 413 or 422 as breaker failures, an empty rules object returns no rules, and a cancelled context is never a breaker failure. The rules loop starts only with a project id, `stop` flushes under the backoff gates, and a permanently rejected or oversized status push is a failed push. +- The wire always carries `ip_address`, `action_taken`, `reason`, `metadata`, `tags`, `events`, `metrics` and `errors`. Optional string fields the reference sends as null are still omitted, which the API treats the same. +- Redis persistence: writes in flight are capped at `bufferSize` (the fixed 4 thread pool and 1024 queue are gone), one warning is logged per backlog episode, a write is skipped when the item already left the buffer, and keys carry the wall-clock epoch nanoseconds stamp (strictly increasing within the process) instead of `System.nanoTime()`. +- `agentStats` gains `loop_failures`, `last_status_push_ok`, `buffer_stats.last_flush_time`, `buffer_stats.auto_flush_running`, `transport_stats.bytes_sent`, `transport_stats.failure_count` and `transport_stats.session_closed`. `rules_last_update` is a float epoch (0.0 when none) and the breaker state is `CLOSED`, `OPEN` or `HALF_OPEN`, which changes the strings `status().circuitState` and `stats().circuitState` return. ### Changed +- The pinned guard-core-jvm engine ref used by CI, CodeQL and the release build moves from 2415a77 to 6cde4af (guard-core-jvm master, the 4.4.0 line). The declared engine dependency stays `com.guard-core:guard-core:4.3.3` until 4.4.0 is on Maven Central. - Dependencies: netty is pinned to 4.1.139.Final through `platform(io.netty:netty-bom)`. lettuce-core 6.8.2 declares netty 4.1.125, which carries twelve advisories fixed by 4.1.137 at the latest. The pin is declared here as well as in the guard-core-jvm facade, so this lockfile stays the same whichever engine revision the build resolves. All twelve netty osv-scanner suppressions are removed. - The agent now fills `AgentConfig.guardCoreVersion` at construction from the guard-core-jvm engine found on the runtime classpath (read reflectively, so the engine stays an optional dependency) when the config leaves it empty, so Java projects report their engine version like the Go and PHP agents. A user-set value always wins. diff --git a/README.md b/README.md index 74c278b..ab626ba 100644 --- a/README.md +++ b/README.md @@ -53,7 +53,7 @@ dependencies { To build from source instead: ```sh -git clone https://github.com/Guard-Core/guard-core-jvm.git ../guard-core-jvm # engine, pinned ref 2415a77 +git clone https://github.com/Guard-Core/guard-core-jvm.git ../guard-core-jvm # engine, pinned ref 6cde4af git clone https://github.com/Guard-Core/guard-agent-jvm.git cd guard-agent-jvm && ./gradlew build ``` diff --git a/docs/index.md b/docs/index.md index 943fd41..ef75151 100644 --- a/docs/index.md +++ b/docs/index.md @@ -10,7 +10,7 @@ acknowledged is lost, nothing unacknowledged is forgotten. (behavior 1:1 with byte-exact observable surfaces: wire payloads, header names, event/metric model shapes, config keys, AES-GCM and HMAC parameters pinned against the Go test vectors). The 3.2.4 line mirrors the - guard-agent 3.2.4 release (lockstep with the engines at 4.3.3) + guard-agent 3.2.4 release (lockstep with the engines at 4.4.0) - **Coordinates**: `com.guard-core:guard-agent-jvm:3.2.4` at release - **Runtime**: engine-free (compile-only facade contract over `com.guardcore.protocols`) diff --git a/docs/installation.md b/docs/installation.md index f59690d..5cb62a9 100644 --- a/docs/installation.md +++ b/docs/installation.md @@ -19,7 +19,7 @@ dependencies { To build from source instead: ```bash -git clone https://github.com/Guard-Core/guard-core-jvm.git ../guard-core-jvm # engine, pinned ref 2415a77 +git clone https://github.com/Guard-Core/guard-core-jvm.git ../guard-core-jvm # engine, pinned ref 6cde4af git clone https://github.com/Guard-Core/guard-agent-jvm.git cd guard-agent-jvm && ./gradlew build ``` diff --git a/settings.gradle.kts b/settings.gradle.kts index 90a1222..481f041 100644 --- a/settings.gradle.kts +++ b/settings.gradle.kts @@ -13,7 +13,7 @@ pluginManagement { // GUARD_CORE_USE_COMPOSITE (environment variable): // unset / "1" / "true" -> composite ON (default). The engine is built from // source via includeBuild + dependency substitution: CI (and local builds) -// check out Guard-Core/guard-core-jvm at the PINNED REF 2415a77 as the +// check out Guard-Core/guard-core-jvm at the PINNED REF 6cde4af as the // sibling directory ./guard-core-jvm, and the block below substitutes the // declared coordinates com.guard-core:guard-core with the included // build's project. @@ -68,7 +68,7 @@ if (useComposite) { roots.firstOrNull { it.resolve("settings.gradle.kts").isFile } ?: throw GradleException( "The guard-core-jvm engine checkout was not found. Clone Guard-Core/guard-core-jvm " + - "at the pinned ref 2415a77 next to this repository (or point -PguardCoreJvmDir / " + + "at the pinned ref 6cde4af next to this repository (or point -PguardCoreJvmDir / " + "GUARD_CORE_JVM_DIR at an existing checkout). Searched: " + roots.joinToString(", ") { it.path }, ) diff --git a/src/main/kotlin/com/guardcore/agent/Version.kt b/src/main/kotlin/com/guardcore/agent/Version.kt index c5d3f60..63d967e 100644 --- a/src/main/kotlin/com/guardcore/agent/Version.kt +++ b/src/main/kotlin/com/guardcore/agent/Version.kt @@ -3,7 +3,7 @@ package com.guardcore.agent /** * Port of guard-agent-go `version.go`: the agent module version, reported to the ingestion API as * `agent_version` and in the User-Agent header. The 3.2.4 line mirrors guard-agent 3.2.4 (the - * family versioning law, lockstep with the engines at 4.3.3); releases ship as v-prefixed git tags. + * family versioning law, lockstep with the engines at 4.4.0); releases ship as v-prefixed git tags. */ public const val AGENT_VERSION: String = "3.2.4"