chore(release): complete the 3.2.4 changelog and move the engine pin to 6cde4af

.github/workflows/ci.yml

@@ -38,7 +38,7 @@ jobs:
         run: |
           git clone https://github.com/Guard-Core/guard-core-jvm.git guard-core-jvm
           cd guard-core-jvm
-          git checkout 2415a77b35f99dbaa96ad821b7ef4571992e18f4
+          git checkout 6cde4afd08a0172c5f6a41eb8e29ec754288782e
 
       # W7 lands the Redis-backed persistence tests; both need Redis (the
       # same service shape the guard-core-jvm CI runs).

.github/workflows/code-ql.yml

@@ -23,11 +23,11 @@ jobs:
 
       # The engine dependency: the composite includeBuild needs the pinned
       # guard-core-jvm checkout next to the repository (same as ci.yml).
-      - name: Checkout engine (guard-core-jvm @ 2415a77)
+      - name: Checkout engine (guard-core-jvm @ 6cde4af)
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: Guard-Core/guard-core-jvm
-          ref: 2415a77b35f99dbaa96ad821b7ef4571992e18f4
+          ref: 6cde4afd08a0172c5f6a41eb8e29ec754288782e
           path: guard-core-jvm
           persist-credentials: false
 

.github/workflows/release.yml

@@ -83,7 +83,7 @@ jobs:
         run: |
           git clone https://github.com/Guard-Core/guard-core-jvm.git guard-core-jvm
           cd guard-core-jvm
-          git checkout 2415a77b35f99dbaa96ad821b7ef4571992e18f4
+          git checkout 6cde4afd08a0172c5f6a41eb8e29ec754288782e
 
       # The Redis-backed persistence tests need a live Redis (the same
       # service shape the guard-core-jvm CI runs).

CHANGELOG.md

@@ -7,9 +7,14 @@ All notable changes to guard-agent-jvm are documented here. The version line mir
 ### Fixed
 
 - The Redis persist no longer runs on the caller's thread or under the buffer lock, so a slow or failing Redis no longer delays event-emitting requests. The key is minted under the lock and the write is submitted to a bounded persist pool (4 threads, queue of 1024) that `stop` drains for up to 10 seconds. A full or closed pool skips persistence and counts a persist failure, and a record flushed or evicted before its write lands has its key deleted instead of left to TTL. The startup encryption error now reports its cause.
+- The agent matches the Python reference on responses, wire shape, persistence and stats (#26). An encrypted 413 halves the batch and re-encrypts each half like the plaintext path, so no encrypted batch is dropped whole. A 200 is a partial failure only on an explicit `success: false` or a truthy `errors`, and an unparseable or empty-object 200 and any unlisted status (202, 204, 3xx, 405, 408) are retried at once without opening the breaker. The rules GET no longer counts 400, 404, 413 or 422 as breaker failures, an empty rules object returns no rules, and a cancelled context is never a breaker failure. The rules loop starts only with a project id, `stop` flushes under the backoff gates, and a permanently rejected or oversized status push is a failed push.
+- The wire always carries `ip_address`, `action_taken`, `reason`, `metadata`, `tags`, `events`, `metrics` and `errors`. Optional string fields the reference sends as null are still omitted, which the API treats the same.
+- Redis persistence: writes in flight are capped at `bufferSize` (the fixed 4 thread pool and 1024 queue are gone), one warning is logged per backlog episode, a write is skipped when the item already left the buffer, and keys carry the wall-clock epoch nanoseconds stamp (strictly increasing within the process) instead of `System.nanoTime()`.
+- `agentStats` gains `loop_failures`, `last_status_push_ok`, `buffer_stats.last_flush_time`, `buffer_stats.auto_flush_running`, `transport_stats.bytes_sent`, `transport_stats.failure_count` and `transport_stats.session_closed`. `rules_last_update` is a float epoch (0.0 when none) and the breaker state is `CLOSED`, `OPEN` or `HALF_OPEN`, which changes the strings `status().circuitState` and `stats().circuitState` return.
 
 ### Changed
 
+- The pinned guard-core-jvm engine ref used by CI, CodeQL and the release build moves from 2415a77 to 6cde4af (guard-core-jvm master, the 4.4.0 line). The declared engine dependency stays `com.guard-core:guard-core:4.3.3` until 4.4.0 is on Maven Central.
 - Dependencies: netty is pinned to 4.1.139.Final through `platform(io.netty:netty-bom)`. lettuce-core 6.8.2 declares netty 4.1.125, which carries twelve advisories fixed by 4.1.137 at the latest. The pin is declared here as well as in the guard-core-jvm facade, so this lockfile stays the same whichever engine revision the build resolves. All twelve netty osv-scanner suppressions are removed.
 - The agent now fills `AgentConfig.guardCoreVersion` at construction from the guard-core-jvm engine found on the runtime classpath (read reflectively, so the engine stays an optional dependency) when the config leaves it empty, so Java projects report their engine version like the Go and PHP agents. A user-set value always wins.
 

README.md

@@ -53,7 +53,7 @@ dependencies {
 To build from source instead:
 
 ```sh
-git clone https://github.com/Guard-Core/guard-core-jvm.git ../guard-core-jvm   # engine, pinned ref 2415a77
+git clone https://github.com/Guard-Core/guard-core-jvm.git ../guard-core-jvm   # engine, pinned ref 6cde4af
 git clone https://github.com/Guard-Core/guard-agent-jvm.git
 cd guard-agent-jvm && ./gradlew build
 ```

docs/index.md

@@ -10,7 +10,7 @@ acknowledged is lost, nothing unacknowledged is forgotten.
   (behavior 1:1 with byte-exact observable surfaces: wire payloads, header
   names, event/metric model shapes, config keys, AES-GCM and HMAC parameters
   pinned against the Go test vectors). The 3.2.4 line mirrors the
-  guard-agent 3.2.4 release (lockstep with the engines at 4.3.3)
+  guard-agent 3.2.4 release (lockstep with the engines at 4.4.0)
 - **Coordinates**: `com.guard-core:guard-agent-jvm:3.2.4` at release
 - **Runtime**: engine-free (compile-only facade contract over
   `com.guardcore.protocols`)

docs/installation.md

@@ -19,7 +19,7 @@ dependencies {
 To build from source instead:
 
 ```bash
-git clone https://github.com/Guard-Core/guard-core-jvm.git ../guard-core-jvm   # engine, pinned ref 2415a77
+git clone https://github.com/Guard-Core/guard-core-jvm.git ../guard-core-jvm   # engine, pinned ref 6cde4af
 git clone https://github.com/Guard-Core/guard-agent-jvm.git
 cd guard-agent-jvm && ./gradlew build
 ```

settings.gradle.kts

@@ -13,7 +13,7 @@ pluginManagement {
 // GUARD_CORE_USE_COMPOSITE (environment variable):
 //   unset / "1" / "true"  -> composite ON (default). The engine is built from
 //     source via includeBuild + dependency substitution: CI (and local builds)
-//     check out Guard-Core/guard-core-jvm at the PINNED REF 2415a77 as the
+//     check out Guard-Core/guard-core-jvm at the PINNED REF 6cde4af as the
 //     sibling directory ./guard-core-jvm, and the block below substitutes the
 //     declared coordinates com.guard-core:guard-core with the included
 //     build's project.
@@ -68,7 +68,7 @@ if (useComposite) {
     roots.firstOrNull { it.resolve("settings.gradle.kts").isFile }
         ?: throw GradleException(
             "The guard-core-jvm engine checkout was not found. Clone Guard-Core/guard-core-jvm " +
-                "at the pinned ref 2415a77 next to this repository (or point -PguardCoreJvmDir / " +
+                "at the pinned ref 6cde4af next to this repository (or point -PguardCoreJvmDir / " +
                 "GUARD_CORE_JVM_DIR at an existing checkout). Searched: " +
                 roots.joinToString(", ") { it.path },
         )

src/main/kotlin/com/guardcore/agent/Version.kt

@@ -3,7 +3,7 @@ package com.guardcore.agent
 /**
  * Port of guard-agent-go `version.go`: the agent module version, reported to the ingestion API as
  * `agent_version` and in the User-Agent header. The 3.2.4 line mirrors guard-agent 3.2.4 (the
- * family versioning law, lockstep with the engines at 4.3.3); releases ship as v-prefixed git tags.
+ * family versioning law, lockstep with the engines at 4.4.0); releases ship as v-prefixed git tags.
  */
 public const val AGENT_VERSION: String = "3.2.4"