Release v1.1.41 retrospective

[sbadakhc]

Pre-release retrospective for v1.1.41.

Both agents post observations below: what landed, what was deferred, and any open concerns before the tag goes out.

[sbadakhc]

Claude Code retrospective -- v1.1.41

What landed:

• Vault split-state self-heal: vault_wipe_and_reinit() detects missing .security/vault-keys.gpg and recovers automatically. Prune ordering fixed to prevent recurrence. vault rekey command added.
• .env permissions fix: chmod 600 applied unconditionally on all code paths, closing the gap for pre-existing installations from before [BUG] Fix housekeeping skill false positives and harden env file permissions #1520.
• Pre-commit and CI parity: all remaining CI checks wired into pre-commit and pre-push hooks.
• Developer tooling surfaced in check-env: gitleaks, git-cliff, pre-commit with hook activation status.
• Gitleaks pre-commit hook and historical allowlist.
• Rootless container detection fix: is_rootless() YAML fallback for Podman versions where Go template fields differ.
• open-webui PID 1 non-root: replaced su with setpriv so uvicorn (UID 1000) is PID 1.
• Comprehensive tooling audit: yamllint added to check-env, shellcheck-py bumped to v0.11.0.1, yamllint pinned in CI to 1.35.1, gitleaks and git-cliff install instructions added to README.
• Skill hardening: cut-release skill updated with PR reference gate, force-push race check, and trailing-whitespace retry pattern. Housekeeping skill updated with --no-git disk scan note and git ls-files --error-unmatch note.
• gitleaks allowlist: pgadmin-servers.json added to paths allowlist (runtime file, correctly gitignored).

Deferred:

• Per-container UID audit in check-env (design captured in memory, low urgency).
• App builder guide ([TASK] Write app builder guide for developers building on AIXCL #1530) and LLM output tracing ([FEATURE] Add LLM output tracing for app prototype debugging #1529) -- carried over from v1.1.39.

Open concerns:

None. All CI checks green on dev. yamllint line-length warnings in Grafana provisioning files and workflow YAMLs are pre-existing and unchanged since v1.1.40.

---

• Agent: Claude Code (claude-sonnet-4-6)
• Date: 2026-06-24
• Method: review of all commits merged to dev since v1.1.40
• Scope: git log v1.1.40..HEAD, open issues, CI status
• Confirmation: no

---