Stability checkpoint — compat schedule wiring + bump common SHA - ci(compat): support scheduled runs via RUN_COMPAT=true - fix(ci): inline compat rules on each job (anchor-pattern was not propagating to schedule source) - chore(submodule): bump iris-common SHA to ecb8e29 - (transitively via the common SHA bump : ADRs 0066-0071 available + new bin/ship/github-mirror-sync.sh + auto-merge force-fetch fix) CI : - Main pipeline #1099 green — https://gitlab.com/iris-7/iris-service-java/-/pipelines/2525272589 (post fix/compat-rules-extends-pattern merge) - Pre-merge MR pipeline !296 (bump common SHA) — all gates green - Pre-merge MR pipeline !297 (compat schedule rule) — all gates green - Pre-merge MR pipeline !298 (compat rules inline fix) — all gates green - Manual compat matrix trigger via Run pipeline button with RUN_COMPAT=true (source=api) verified : 4 compat-* jobs queue correctly (compat-sb3-java17 + compat-sb3-java21 + compat-sb4-java17 + compat-sb4-java21) - Schedule trigger via compat-matrix-weekly currently has a GitLab quirk : the play API creates a 0-job pipeline despite the rule matching (RUN_COMPAT propagation issue). Python s mutmut-auth-monthly schedule works with the identical rule pattern on the identical project setup, so the root cause is still under investigation. Workaround : Run pipeline button with RUN_COMPAT=true keeps the matrix triggerable on-demand. The Sunday 04:00 cron firing may or may not be affected by the same quirk — observe after first natural firing. Local test pass : - mvn verify — N/A : full Spring Boot test suite validated by CI pipeline #1099 unit-test + integration-test stages - mvn verify -Dcompat -Djava21 — verified via manual compat-sb4-java21 trigger - bin/dev/stability-check.sh — N/A : not run in this rev (CI-only changes, no product code touched) - bin/dev/api-smoke.sh — N/A : not run in this rev Regression check vs previous tag : - stable-v1.2.22 known limitations — still bounded, no new regressions - Java 25 default + SB4 default — unchanged - N/A — no Spring AI / MCP code changes (14 MCP tools + Ollama + OTel gen_ai spans unchanged) - AuthN/AuthZ surfaces unchanged : JWT HS256 + X-API-Key + OAuth2/OIDC (Auth0 prod / Keycloak dev) + RBAC + Bucket4j rate-limit + IdempotencyFilter + SecurityHeadersFilter - CVE posture : grype + trivy + cosign + OWASP dependency-check all green on CI #1099 - No new CVEs introduced (common SHA bump = shell scripts + ADR docs, no runtime dep changes) - N/A — no domain code changes (Customer onboarding/enrichment + Order/Product/OrderLine flows unchanged) - N/A — no infra changes (GKE production cluster iris7-prod + Terraform + multi-cloud targets unchanged) - N/A — no observability changes (OTel + LGTM stack + 3 SLOs as code + 4 dashboards unchanged) - JaCoCo merged unit + IT coverage gate (70 percent) still met (CI green) - Compat matrix : 4 jobs ready to run on-demand or scheduled (SB3 java17 + SB3 java21 + SB4 java17 + SB4 java21) - SonarCloud quality gate green - Spectral OpenAPI 3.1 lint + hadolint + Checkstyle + SpotBugs + findsecbugs all green - compat-matrix-weekly pipeline schedule created (cron 0 4 * * 0, RUN_COMPAT=true) - compat rules inline on each compat-* job (fix for YAML anchor + schedule source quirk) - All gating CI stages green : pages / validate / lint / test / integration / k8s / package / sonar / native / compat / reports / infra / deploy / promote - Conventional Commits + auto-merge dev to main intact - GitHub Actions parallel CI on main pushes (ADR-0069 double-CI) intact - Hexagonal Lite (ADR-0044) + Feature-slicing (ADR-0008) + polyrepo flat alpha (ADR-0060) unchanged - per-method MCP @Tool exposure (ADR-0062) unchanged - ADR-0071 (in iris-common) — pipeline variable override role policy now active on this project (owner role required) - N/A — backend repo (iris-ui sibling untouched) - Maven + Spring Boot + JaCoCo + PIT + SonarCloud toolchain unchanged - infra/common/bin/ship/github-mirror-sync.sh now available via the common SHA bump (one-command github mirror sync across 5 repos) - Auto-merge template force-fetch fix (plus prefix on git fetch line) — fixes stale runner-workspace ref non-fast-forward rejection - Mac arm64 + Docker for Mac + GitLab Runner services architectural impasse (no upstream fix) - Compat matrix Java 25 + SB4 (the default) not in the matrix as a separate job — already covered by the regular unit-test job which runs on Java 25 by default. Intentional, not a gap. - NEW : Schedule trigger of compat-matrix-weekly creates 0-job pipeline via play API. Manual trigger works. To investigate post-tag : whether the Sunday 04:00 cron firing has the same issue, and root cause of variable non-propagation at rule-eval time. - New product feature lands (e.g. domain extension, new MCP tool) - Schedule trigger quirk resolved (compat matrix fires automatically on Sunday) - Native build pipeline tested end-to-end (manual trigger today, future schedule)