Skip to content

v1.9.0 — Batch scoring, GitOps ADR, DORA metrics, devcontainer, secret rotation

Choose a tag to compare

View all tags
@DuqueOM DuqueOM released this 08 Aug 15:13
· 264 commits to main since this release
archive/v1.9.0
334126a

Note

Historical audit snapshot. This release belongs to the v1.0–v1.12 line that
shipped during the post-audit remediation sprint (2026-04-15 → 2026-04-29).
Per docs/RELEASING.md
these tags are immutable historical snapshots; the active public release line
is now v0.x
hardening, with v1.0.0 reserved for the first verified GKE+EKS cloud E2E rollout.
See CHANGELOG.md for the reclassification rationale.

Release date: 2026-04-24

Minor release adding scaffolding for scheduled batch inference,
architectural guidance for future GitOps migration, DORA measurement,
a reproducible dev environment, and a scheduled-rotation runbook.

Highlights

Batch inference scaffolding (D1)

New .windsurf/skills/batch-inference/SKILL.md provides the 6-step
workflow for CronJob-based batch scoring that shares the exact same
predict() code as the live API. Prevents training/serving and
training/batch skew — the two classic silent ML failure modes.

Architecture: batch.py uses the same predictor.predict_batch(),
the same Pandera schema from training, and the same log_prediction()
for closed-loop tracking. The CronJob uses PSS restricted + Forbid
concurrency policy + a hard activeDeadlineSeconds cap.

ADR-013 — GitOps strategy (D3)

Codifies the posture: stay on kubectl apply via GitHub Actions
until one of four revisit triggers fires:

  • 5 services in the template

  • multi-cluster prod (GKE + EKS + on-prem)
  • ≥2 drift incidents from out-of-band kubectl apply
  • organizational GitOps mandate

When triggered, migrate to ArgoCD (not Flux) — ApplicationSet
matches our dev/staging/prod × services fan-out; shared mental model
with Argo Rollouts already in use.

DORA metrics exporter (D4)

templates/scripts/dora_metrics.py aggregates from GitHub REST API
and ops/audit.jsonl:

  • Deployment frequency — successful prod deploys per week
  • Lead time for changes — PR merge → next prod deploy (median, p95)
  • Change failure rate — rollback-tagged issues / total prod deploys
  • MTTR — rollback → incident_close (median)

Graceful degradation: without GITHUB_TOKEN, runs in audit-only mode.
Output: ops/dora/{YYYY-MM}-metrics.json for dashboards. 9 unit
tests.

Devcontainer (D7)

.devcontainer/devcontainer.json + post-create.sh give new
contributors a reproducible environment matching the CI runner:

  • Python 3.11 bookworm base
  • Features: docker-in-docker, kubectl/helm/minikube, terraform, gh, cosign
  • Post-create: conftest, syft, gitleaks
  • Extensions: Python stack + Terraform + K8s + YAML + GH + mermaid

One code . in Codespaces or VS Code Remote Containers gets a
working env without host setup.

Secret rotation runbook (D9)

docs/runbooks/secret-rotation.md — SCHEDULED rotation (complement
to .windsurf/skills/secret-breach-response/SKILL.md which handles
EMERGENCY rotation):

  • Scope table with cadences per credential class
  • STOP per credential per environment (even in dev)
  • Canary in dev → soak 15min → staging → soak 1h → prod
  • 7-day soak on OLD version before retirement (rollback insurance)
  • Default Q1/Q2/Q3/Q4 calendar

Scope adjustment

v1.9.0 was planned as a 10-item roadmap. This release delivers 5
high-impact items (D1, D3, D4, D7, D9). Deferred:

  • D2 GPU support path — niche today; revisit when a template
    user demands GPU serving
  • D5 More reusable GHA — deploy-common.yml already done in
    v1.7.1; no other workflows are big enough to pay off yet
  • D6 Terraform tests (terratest-lite) — significant commitment
    that deserves its own ADR + staged rollout
  • D8 Publish as GitHub template repo — operational doc, not code
    change; waits until v2.0.0 messaging

New files

  • .windsurf/skills/batch-inference/SKILL.md
  • docs/decisions/ADR-013-gitops-strategy.md
  • templates/scripts/dora_metrics.py
  • templates/tests/unit/test_dora_metrics.py
  • .devcontainer/devcontainer.json
  • .devcontainer/post-create.sh
  • docs/runbooks/secret-rotation.md
  • releases/v1.9.0.md (this file)

Tests

  • 127 passing (was 118 in v1.8.1)
    • test_dora_metrics.py: 9 new tests

Migration

No breaking changes. All additions opt-in:

  1. Batch — run the batch-inference skill against a service when a
    cadence demands scheduled scoring.
  2. GitOps — read ADR-013 before any CD-plane discussion; no action
    required today.
  3. DORA — wire dora_metrics.py to a monthly CI job to populate
    ops/dora/ for dashboards.
  4. Devcontainer — contributors opt in by opening in Codespaces /
    Remote Containers.
  5. Secret rotation — schedule quarterly calendar entry per the
    runbook table.

Related

  • AGENTS.md — Session Init protocol should check for ops/audit.jsonl
    and ops/dora/ before proposing operations
  • ADR-005 — Behavior Protocol (batch deploy is STOP in prod)
  • ADR-010 — Dynamic Behavior Protocol (DORA mttr informs error_budget)
  • ADR-011 — Environment promotion gates (rotation reuses the same chain)
Assets 2
Loading