[JUM-821][Release] Promote dev to main — public OSS rebind, frontend X-CRUD, service-management monitoring

.agents/COMPONENT-OWNERSHIP.md

@@ -21,3 +21,4 @@ because nobody owned the contract that a re-homing broke.
 | Component | Owner agent | Contract requirement | Registered |
 |---|---|---|---|
 | `apps/service-management` | `kimi-code-primary-001` | `126` | 2026-08-05 |
+| `apps/service-management-api` | `kimi-code-primary-001` | `126` | 2026-09-07 |

.agents/NFR-REGISTRY.md

@@ -38,6 +38,8 @@ This file consolidates non-functional requirements already requested and stored
   so component drift and re-homing breaks fail checks instead of serving silent
   defaults.
 - `127` Mandatory `rtk` and Caveman usage in every agent session
+- Soft-delete tombstones (`deletedAt`) are the default delete path for User/Organization; uniqueness is released on tombstone; ids stay reserved. Physical purge is opt-in (JUM-822): 90-day floor, dev PM2 dry-run by default, `--commit` required to drop PII, id ledger never reused.
+- Entity metrics (`GET /{entities}/metrics`) are bounded by `x-metrics-capabilities` and exclude tombstones (JUM-793).
 - `128` Requirement changes take precedence in the release process (sequence only, no gate exemption)
 - `129` Mandatory Firebase RTDB agent progress bus (`agent-bus:publish|watch|status`)
 - `130` Measured claims and bounded work: no unmeasured numbers, no proxy stated as cause
@@ -46,6 +48,7 @@ This file consolidates non-functional requirements already requested and stored
 - `133` Declared indexes for ordered queries: `.indexOn` in versioned rules, or order by key
 - `134` No flaky tests: a suite establishes what it depends on, never sleeps to synchronise
 - `135` No fake tests: assert the effect, declare the assertions, never target a percentage
+- `136` Frontend knows the backend only through its OAS: spec document or generated SDKs, never backend source
 
 ## Documentation and Governance NFRs
 

.agents/README.md

@@ -102,6 +102,7 @@ See also:
 - [133-declared-indexes-for-ordered-queries](requirements/software/133-declared-indexes-for-ordered-queries.md)
 - [134-no-flaky-tests](requirements/software/134-no-flaky-tests.md)
 - [135-no-fake-tests](requirements/software/135-no-fake-tests.md)
+- [136-frontend-knows-backend-only-through-oas](requirements/software/136-frontend-knows-backend-only-through-oas.md)
 
 ## Software and Product Requirements
 

.agents/requirements/project/113-private-free-repository-owned-ci.md

@@ -1,25 +1,31 @@
-# 113 - Private Free Repository-Owned CI and Coverage Evidence
+# 113 - Public Open Source CI and Coverage Evidence
 
 - Status: Active
 - Nature: NFR (CI/CD, security, coverage, governance)
-- Source: Project owner decision, 2026-08-01; amended 2026-08-03 after GitHub Actions billing stopped hosted execution; amended 2026-08-09 to keep task delivery to `dev` under a cheap layer-aware gate; amended 2026-08-09 to restore GitHub Actions and disable CircleCI.
+- Source: Project owner decision, 2026-08-01; amended 2026-08-03 after GitHub Actions billing stopped hosted execution; amended 2026-08-09 to keep task delivery to `dev` under a cheap layer-aware gate; amended 2026-08-09 to restore GitHub Actions and disable CircleCI; amended 2026-09-13 after transfer to the public `web2solutions/Jumentix` repository to re-enable free open-source GitHub Actions, CircleCI, Codecov and SonarQube Cloud integrations.
 - Amends: `107` CircleCI redundancy.
-- Replaces: `014` external Codecov dependency with GitHub Actions-hosted Codecov publishing.
+- Replaces: `014` external Codecov dependency with repository-owned coverage gates plus public Codecov publishing.
 
 ## Requirement
 
-1. `XpertMinds/Jumentix` remains private and canonical.
-2. Required delivery evidence must have a zero-cost, repository-owned path. Paid-only provider checks must not be required.
-3. GitHub Actions is the canonical orchestrator. Hosted billing failures are handled by
-   repository-owned self-hosted runners; CircleCI disabled means `.circleci/config.yml`
-   must not be present or required.
+1. `web2solutions/Jumentix` is public and canonical.
+2. Required delivery evidence must have a free open-source path. Paid-only provider checks must not be required.
+3. GitHub Actions is the canonical orchestrator on GitHub-hosted `ubuntu-latest`
+   runners. CircleCI is enabled as the secondary public CI mirror and must use
+   the same context classifier and destination-aware gate policy.
 4. Coverage is produced by Jest, checked fail-closed by `ci-cd/check-coverage-thresholds.js`, and checked at patch level by `ci-cd/check-patch-coverage.js`. Missing reports fail.
-5. Coverage evidence is uploaded as a GitHub Actions artifact and published to Codecov from GitHub Actions when `CODECOV_TOKEN` is configured. Codecov publishing is required for visibility, but Codecov is not the coverage authority and cannot weaken repository-owned thresholds.
-6. CircleCI workflows are disabled in this repository. A configured duplicate pipeline is not redundancy and must not be represented as a passing provider.
-7. GitHub Actions jobs must use the repository-owned self-hosted runner label `jumentix`
-   until hosted runner billing is explicitly restored through a governed requirement change.
+5. Coverage evidence is retained as CI artifacts and published to Codecov when
+   `CODECOV_TOKEN` is configured. Codecov publishing is required for
+   visibility, but Codecov is not the coverage authority and cannot weaken
+   repository-owned thresholds.
+6. CircleCI workflows are enabled for the public repository and must halt
+   non-selected heavy jobs before starting costly work.
+7. GitHub Actions jobs must use GitHub-hosted `ubuntu-latest` runners and Node
+   22 compatibility setup.
 7. The full coverage gate runs in GitHub Actions for `dev -> main` release promotions, `main` pushes, and scheduled/manual full runs so task delivery to `dev` remains fast. Local commands may run coverage diagnostically, but local `ci:gate` and task PR gates must not be the production coverage authority.
-8. SonarQube Cloud may remain as defense-in-depth while operational, but repository-owned coverage and security gates remain authoritative if it becomes unavailable.
+8. SonarQube Cloud remains active on the public `web2solutions_Jumentix`
+   project while configured, but repository-owned coverage and security gates
+   remain authoritative if it becomes unavailable.
 9. GitHub Actions jobs use frozen dependencies, deterministic pinned tools/actions where available, explicit failure on missing evidence, and retained evidence artifacts.
 10. Pending, skipped, missing, timed-out, cancelled, quota-blocked, or provider-inaccessible checks are never passing.
 11. No `--no-verify`, admin bypass, force merge, swallowed failure, or synthetic green is allowed.
@@ -37,5 +43,5 @@
 
 - `bun run ci:check-provider`
 - `bun run integrations:check`
-- GitHub Actions `coverage` job during full-suite contexts: `bun run test:coverage && bun run coverage:check && bun run coverage:patch`, followed by Codecov upload.
+- Full-suite `coverage` job during release/main contexts: `bun run test:coverage && bun run coverage:check && bun run coverage:patch`, followed by Codecov upload and SonarQube Cloud scan.
 - Required task PR checks use GitHub Actions job names `branch-gate` and `third-party-review`; required release/main checks use `branch-gate`, `workspace-builds`, `workspace-tests`, `integration`, `coverage`, `website`, `third-party-review`, and `database-matrix`.