v0.3.0

v0.3.0 — Load becomes real, steerable, and honest

DD-028..DD-035: dashboard read-path auth; lock-free load; operator-path agent boundary;
cost-ranked + opt-in pheromone replay; load as a first-class citizen; running dashboard
graph; and honest method/session/sequence-aware replay with driftUnavailable.
See CHANGELOG.md and docs/BENCHMARKS.md.

v0.2.0 — first release

Basquin v0.2.0 — first release

Basquin is Kubernetes-native fuzz + load testing for JVM apps: instrument an unmodified
deployed app, explore it coverage-guided over HTTP, then replay the interesting corpus under
sustained load — watching availability invariants (latency, heap, thread leaks) the whole time.

This is the first published release. Everything below ships from this tag.

Install

helm repo add basquin https://ianp94.github.io/basquin/charts
helm repo update
helm install basquin basquin/basquin-operator \
  --namespace basquin-system --create-namespace --set fullnameOverride=basquin

Or grab the basquin CLI from the release assets below (linux/darwin/windows × amd64/arm64).

Highlights

• Operator, namespaced by design — a BasquinTarget CR instruments only the Deployments you
  name (initContainer + shared volume + appended JVM opts), fully revertible by deleting the CR.
  No mutating webhook, no ClusterRoleBinding; one release per namespace.
• Campaigns — a BasquinCampaign CR runs a complete test: gates on the injected target,
  launches the driver Job, publishes coverage % and findings to status. Two modes:
  • explore — grammar/corpus-driven coverage-guided exploration (JaCoCo signal over HTTP,
    union-merged across replicas); interesting inputs are emitted as a campaign-owned ConfigMap.
  • load — replays that corpus at fixed concurrency for a duration; throughput, latency
    percentiles, and heap/thread drift land in status.load.
• Per-campaign dashboard — the operator stands up an owner-referenced dashboard
  Deployment+Service per campaign (status.dashboardURL): fleet view, findings clustered by
  fingerprint, coverage bar, rich input drill-down, optional Claude-powered cluster analysis.
  Pushes are authenticated with a per-campaign 256-bit token minted into a Secret.
• CLI — basquin instrument, run, status, dashboard (self-contained port-forward),
  version; applies real typed CRs via controller-runtime.
• Agents — Java agent (iteration boundaries, invariants, reset strategies), JVMTI native agent
  (event-driven thread leak tracking), namespace-free Tomcat valve (one jar for both
  javax.servlet/Tomcat 9 and jakarta.servlet/Tomcat 10+).
• Images — ghcr.io/ianp94/basquin-{operator,agents,runner,dashboard}, all multi-arch
  manifest lists (linux/amd64 + linux/arm64). One version input: the git tag drives the chart
  appVersion and every image tag.

Known limitations

• ⚠️ arm64 is build-validated only. CI compiles the native JVMTI .so for arm64 under QEMU,
  but no arm64 runner has yet loaded it in a real JVM. A bad -agentpath library is fatal at
  JVM startup, so treat arm64 as unproven until a functional arm64 run lands.
• Dashboard reads are unauthenticated (writes are token-authenticated). Any pod with network
  reach to the ClusterIP can read a campaign's findings. Fine for a single-tenant namespace —
  which is what the namespaced operator assumes — not sufficient for a shared multi-tenant
  cluster. See OPERATOR-USAGE §6.
• War-only target images: the driver's coverage-classes initContainer copies
  WEB-INF/classes from the target image; an image shipping only an unexploded ROOT.war finds
  nothing (the verify-classes initContainer fails loud rather than reporting a silent 0%).
  Workaround: explode the war into the image at build time.
• Helm does not upgrade/delete CRDs; re-apply crds/ manually on upgrade.

Verification behind this release

• envtest controller suite green; Java suite green in CI (JDK 17 + 21).
• In-cluster e2e in CI: builds every image, Helm-installs the operator into an ephemeral kind
  cluster, instruments a raw JPetStore, runs an explore campaign (asserts non-zero coverage), a
  load campaign, and the dashboard — with zero RBAC errors.
• 10k-iteration soak: clean, latency p50=1ms / p99=2ms.