[AZ-491] [AZ-492] [AZ-493] [AZ-494] [AZ-495] [AZ-496] Cycle 3 Step 17: retrospective + close cycle

Cycle-3 retrospective: - 6 tasks (AZ-491..AZ-496), 5 batches, 18 SP delivered. - 100% code review pass rate (5/5 PASS_WITH_WARNINGS, 0 FAIL). - 0 Critical/High/Medium review findings; 7 distinct Low. - Security audit PASS_WITH_WARNINGS: 0 new Medium, 3 Low (all test-only or operator-CLI), 2 Informational, 1 False Positive. - Net Architecture delta: **-3** (F-AUTH-2 + D1 + D3 RESOLVED; only new findings are Low test-side surfaces). First net-negative cycle on record. - 5 of 6 tasks completed first attempt (no post-review fix commits). Cycle-2's 2 prior-retro actions all translated to closed work (AZ-491 from Action 1, AZ-492 from Action 2, AZ-493 from Action 3). Top 3 cycle-4 improvement actions surfaced: 1. Execute the perf harness to capture PT-07/PT-08 baseline. 2. Bump TestSupport JWT pins 7.0.3 → 7.1.2+ (D4 NU1902 cleanup). 3. Add `workspace:` tag to cross-repo ACs in task-spec writing and render them separately in the traceability matrix. 3 new ring-buffer lessons appended to _docs/LESSONS.md: - [process] Option-B forcing functions for cross-team blockers. - [process] ACs prescribing a measurement should also prescribe the collection path. - [process] Cross-repo-write ACs need workspace tags. Structural snapshot at structure_2026-05-12_cycle3.md records the new SatelliteProvider.TestSupport project (+2 ProjectReference edges into it; no production-layer dependents) and the AZ-496 package bumps (8.0.21 → 8.0.25). Cycle 3 COMPLETE. State advanced to Step 9 (New Task) for cycle 4 per existing-code flow Re-Entry After Completion. Co-authored-by: Cursor <cursoragent@cursor.com>
[AZ-491] [AZ-492] [AZ-493] [AZ-494] [AZ-495] [AZ-496] Cycle 3 Step 15 skip + Step 16 deploy report
2026-06-22 23:11:13 +00:00 · 2026-05-12 03:46:41 +03:00 · 2026-05-12 03:42:10 +03:00
6 changed files with 488 additions and 7 deletions
@@ -0,0 +1,171 @@
 # Deploy Report — Cycle 3 (AZ-491 / AZ-492 / AZ-493 / AZ-494 / AZ-495 / AZ-496)
 **Date**: 2026-05-12
 **Cycle**: 3
 **Scope**: Test-infrastructure + dependency + security hardening from the cycle-2 retrospective backlog:
 - **AZ-491** — consolidate JWT test-mint helpers into a single `SatelliteProvider.TestSupport` source of truth (replaces cycle-2 duplicate factories).
 - **AZ-492** — wire perf harness PT-01..PT-06 JWT-attach + implement PT-07 (region cold/warm) and PT-08 (UAV batch upload) scenarios.
 - **AZ-493** — integration test DB reset hook with two-guard safety (env + Host allowlist); replaces the AZ-488 wall-clock coordinate workaround.
 - **AZ-494** — JWT `iss` / `aud` validation enabled (Option B per user decision); fail-fast at startup if env vars missing.
 - **AZ-495** — formalise doc folder convention for new tasks.
 - **AZ-496** — bump `Microsoft.AspNetCore.OpenApi` + `Microsoft.AspNetCore.Authentication.JwtBearer` 8.0.21 → 8.0.25 (closes cycle-1 D1 + cycle-2 D3 supply-chain findings).
 ## What is shipping
 ### Code changes (committed to `dev`, pushed)
 | Commit | Subject |
 |--------|---------|
 | `76076cb` | `[AZ-491] [AZ-492] [AZ-493] [AZ-494] [AZ-495] [AZ-496] Cycle 3 Step 9: 6 task specs` |
 | `9cfd80b` | `[AZ-495] [AZ-496] Cycle 3 batch 1: doc convention + AspNetCore 8.0.25` |
 | `c396740` | `[AZ-491] Cycle 3 batch 2: consolidate JWT test-mint helpers into TestSupport` |
 | `745f484` | `[AZ-493] Cycle 3 batch 3: integration test DB-reset hook` |
 | `080441d` | `[AZ-492] Cycle 3 batch 4: perf harness PT-07 + PT-08 + JWT-attach` |
 | `f979e18` | `[AZ-494] Enable JWT iss/aud validation with fail-fast startup` |
 | `495605f` | `[AZ-494] [AZ-492] Cycle 3 Step 16: full test suite green; close batches` |
 | `e42bf62` | `[AZ-491] [AZ-492] [AZ-493] [AZ-494] [AZ-495] [AZ-496] Cycle 3 Steps 11-13: test-spec sync + ripple log` |
 | `314d1de` | `[AZ-491] [AZ-492] [AZ-493] [AZ-494] [AZ-496] Cycle 3 Step 14: security audit refresh` |
 All 9 commits on `dev`, pushed to `origin/dev` as of this report.
 ### Database migration
 **None this cycle.** All cycle-3 work is at the application / test-infrastructure / config layer. The `tiles` table schema is unchanged.
 ### Configuration changes (operator must verify before promoting)
 | Setting | Was | Now | Source |
 |---------|-----|-----|--------|
 | `JWT_ISSUER` (env var) | unset | **MUST be set to admin-team-confirmed value** | AZ-494 — required for API to start. App throws `InvalidOperationException` at startup if missing or whitespace. |
 | `JWT_AUDIENCE` (env var) | unset | **MUST be set to admin-team-confirmed value** | AZ-494 — same fail-fast contract as `JWT_ISSUER` / `JWT_SECRET`. |
 | `Jwt:Issuer` (appsettings) | n/a | empty in `appsettings.json`; `DEV-ONLY-iss-admin-azaion-local` in `appsettings.Development.json` | AZ-494. Env var overrides config. |
 | `Jwt:Audience` (appsettings) | n/a | empty in `appsettings.json`; `DEV-ONLY-aud-satellite-provider` in `appsettings.Development.json` | AZ-494. Env var overrides config. |
 | `appsettings.json` → `Jwt.Issuer` / `Jwt.Audience` | absent | empty string | AZ-494 — empty prod values guarantee the fail-fast contract triggers. |
 | `Microsoft.AspNetCore.OpenApi` PackageReference | 8.0.21 | **8.0.25** | AZ-496 — closes cycle-1 D1 (CVE-2026-26130 SignalR DoS; not reachable in this app but the bump is hygiene). |
 | `Microsoft.AspNetCore.Authentication.JwtBearer` PackageReference | 8.0.21 | **8.0.25** | AZ-496 — closes cycle-2 D3 (same 8.0.21 patch line). |
 | `docker-compose.yml` → `api.environment` | (already had `JWT_SECRET`) | adds `JWT_ISSUER=${JWT_ISSUER}` + `JWT_AUDIENCE=${JWT_AUDIENCE}` | AZ-494 |
 | `docker-compose.tests.yml` → `integration-tests.environment` | (already had `JWT_SECRET`) | adds same `JWT_ISSUER` + `JWT_AUDIENCE` pass-through + `ASPNETCORE_ENVIRONMENT=Testing` + `INTEGRATION_KEEP_STATE=${…:-}` | AZ-493 + AZ-494 |
 | `.env.example` | (no iss/aud lines) | adds `JWT_ISSUER` + `JWT_AUDIENCE` placeholder lines + documents fail-fast contract | AZ-494 |
 | `scripts/run-tests.sh` | (loaded `JWT_SECRET`) | also loads + fail-fasts on `JWT_ISSUER` + `JWT_AUDIENCE`; `--keep-state` flag added | AZ-493 + AZ-494 |
 | `scripts/run-performance-tests.sh` | (script-rot: no JWT attach, perf-test stubs) | full rewrite: JWT attach across PT-01..PT-06, PT-07 cold/warm distribution, PT-08 batch distribution, AZ-494 iss/aud handling | AZ-492 + AZ-494 |
 | `SatelliteProvider.TestSupport` project (new) | n/a | added by AZ-491; consumed by `SatelliteProvider.Tests` + `SatelliteProvider.IntegrationTests`. `IsPackable=false`; **never ships in a production container image**. | AZ-491 |
 ### Documentation, test-spec, audit, leftover artifacts (all committed in the commits above)
 - `_docs/02_document/architecture.md`, `module-layout.md`, `modules/api_program.md`, `modules/tests_unit.md`, `modules/tests_integration.md` — Step 13 (Update Docs).
 - `_docs/02_document/tests/{traceability-matrix,security-tests,environment,performance-tests}.md` — Step 12 (Test-Spec Sync) + AZ-492's PT-07/PT-08 entries.
 - `_docs/02_document/ripple_log_cycle3.md` — Step 13 ripple log (new).
 - `_docs/05_security/{dependency_scan,static_analysis,owasp_review,infrastructure_review,security_report}.md` — Step 14 (Security Audit), cycle-3 deltas appended. **PASS_WITH_WARNINGS**.
 - `_docs/_process_leftovers/2026-05-12_perf-cycle3-harness-execution.md` (new) — Step 15 deferral.
 - `_docs/03_implementation/batch_0{1,2,3,4,5}_cycle3_report.md` + matching `reviews/batch_0{1,2,3,4,5}_cycle3_review.md` — Step 10 per-batch + review reports.
 - `_docs/03_implementation/cumulative_review_batches_0{1-3,4-5}_cycle3_report.md` — Step 10 cumulative reviews (every 3 batches).
 - `_docs/02_tasks/done/AZ-49{1,2,3,4,5,6}_*.md` (moved from todo/).
 - `_docs/02_tasks/_dependencies_table.md` (statuses updated to `In Testing`).
 - `_docs/_process_leftovers/2026-05-11_perf-pt07-harness.md` — deleted (resolved by AZ-492).
 ## Pre-deploy gate recap
 | Gate | Outcome |
 |------|---------|
 | Step 11 — Run Tests | **PASS** — `scripts/run-tests.sh --full` green against the post-cycle-3 build (log at `/tmp/run-tests-cycle3-step16.log`, 8025 lines, "All tests passed (mode=full)"). 4 new AZ-494 fail-fast unit tests + 2 new integration scenarios (`JwtIntegrationTests.WrongIssuer_Returns401` line 650, `WrongAudience_Returns401` line 653) PASS. Full integration suite (incl. all SEC-, BT-, RL- scenarios from cycle 1+2) green. Test-run skill execution skipped per its § Functional Mode (same runner, immediately preceding invocation as Implement skill's Step-16 internal gate). |
 | Step 12 — Test-Spec Sync | **PASS** — cycle-update mode appended traceability rows for AZ-491 AC-1..AC-6, AZ-493 AC-1..AC-6, AZ-494 AC-1..AC-7 (AC-7 ◐ deferred), AZ-495, AZ-496; SEC-12 (wrong iss → 401) + SEC-13 (wrong aud → 401) added to `security-tests.md`; `environment.md` env-var table extended with `JWT_SECRET` / `JWT_ISSUER` / `JWT_AUDIENCE` / `INTEGRATION_TEST_DB_RESET` (closes a cycle-2 oversight where `JWT_SECRET` was never recorded). |
 | Step 13 — Update Docs | **PASS** — most module / architecture / security docs were already updated inline during batches; `tests_unit.md` had a duplicate `AuthenticationServiceCollectionExtensionsTests` entry consolidated; `ripple_log_cycle3.md` generated. |
 | Step 14 — Security Audit | **PASS_WITH_WARNINGS** — 0 Critical, 0 High, 0 new Medium. F-AUTH-2 (cycle-2 Medium) RESOLVED by AZ-494; D1 (cycle-1) + D3 (cycle-2) supply-chain RESOLVED by AZ-496. New cycle-3 findings: D4 (Low, test-only NU1902 7.0.3 < 7.1.2), F-AUTH-3 (Informational, test-runner-only iss/aud log), F-AUTH-4 (Informational, by-design DEV-ONLY placeholders), F-DBR-1 (false positive, hard-coded TRUNCATE table list), F-DBR-2 (Low, operator-bypassable two-guard model), F-PERF-1 (Low, 4-hour GPS token on stdout). |
 | Step 15 — Performance Test | **SKIPPED** (user skipped the optional gate question). The cycle-3 perf-harness work (AZ-492 PT-07/PT-08) is runnable but was not executed. Tracked in `_docs/_process_leftovers/2026-05-12_perf-cycle3-harness-execution.md`. |
 | `dotnet format whitespace --verify-no-changes` | Implicitly passed via Step 11 (first line of the test-run log: "Step 0: dotnet format whitespace --verify-no-changes"). |
 ## Cycle-3-specific operational risks (the deploy operator must act on these)
 ### **R1 — `JWT_ISSUER` + `JWT_AUDIENCE` must be set to admin-team-confirmed prod values**
 The API throws `InvalidOperationException` at startup if either is missing or whitespace (caught by 4 new unit tests `AddSatelliteJwt_ThrowsOn{Missing,Empty}{Issuer,Audience}` and verified by SEC-12 / SEC-13 integration scenarios). HOWEVER: an operator who copies `appsettings.Development.json` verbatim into prod, or who sets `JWT_ISSUER` / `JWT_AUDIENCE` to the literal `DEV-ONLY-iss-admin-azaion-local` / `DEV-ONLY-aud-satellite-provider` placeholders, would pass the non-empty check. The placeholders are deliberately published in this repo (Option B forcing function).
 **Operator action**:
 1. Confirm with the admin team the exact `iss` value the admin API stamps into prod tokens.
 2. Confirm the `aud` value satellite-provider should require.
 3. Set both as environment variables in the deploy environment (NOT in committed config).
 4. Grep the rendered deploy environment for `DEV-ONLY-` and confirm zero hits before promoting beyond `dev`.
 ### **R2 — Cross-repo doc update (AZ-494 AC-7) still pending**
 The cycle-3 work did NOT touch `suite/_docs/10_auth.md` in the parent monorepo. AZ-494 AC-7 says the suite-level auth contract should either document the iss/aud values or note that satellite-provider validates them locally. This write is outside satellite-provider's autodev workspace boundary.
 **Operator action**: ask the suite repo's owner to add a paragraph to `suite/_docs/10_auth.md` noting that satellite-provider validates `iss` + `aud` against `JWT_ISSUER` / `JWT_AUDIENCE` env vars (admin-team-supplied) with fail-fast at startup.
 ### **R3 — Cycle-2 R1 / R3 follow-ups remain operationally relevant**
 The cycle-2 R1 (`gps-denied-onboard` must attach Bearer tokens) and R3 (UAV consumers need `GPS` permission) are unchanged from cycle 2. **Now additionally**: those tokens must also have `iss` + `aud` matching the operator-set prod values, or they 401 (post-AZ-494). The admin team is the single source of truth for both the secret-distribution and the iss/aud values.
 ### **R4 — DEV-ONLY iss/aud values are NOT secrets but are still operator-visible in test logs**
 The integration-test runner's bootstrap line (`Auth    : JWT_SECRET resolved (… bytes); iss=...; aud=...`) prints the resolved values at startup. In local / CI runs against the DEV-ONLY placeholders this is harmless; in any production-pointing test run (NOT recommended) it would echo prod values into the test log. The production API itself does NOT log iss/aud — verified by repo grep.
 **Operator action**: do not point the integration-test runner at production env vars. If a smoke test against a live prod API is needed, mint a token manually with the prod values and run a curl probe — do not run the full test-runner image against prod.
 ## Rollback plan
 This deploy ships zero schema changes. Rollback is purely an image-version flip plus a config rollback:
 1. Re-deploy the pre-cycle-3 image (last cycle-2 deploy commit was `b69cf56`).
 2. Optionally remove the `JWT_ISSUER=${JWT_ISSUER}` + `JWT_AUDIENCE=${JWT_AUDIENCE}` lines from the deployed `docker-compose.yml` (the previous image does NOT validate them, so leaving them is harmless).
 3. No DB rollback needed — `tiles` table is identical before and after cycle 3.
 4. Inform consumers (if any AZ-494-specific debugging is needed) that iss/aud claim values are no longer enforced; they may continue to attach matching claims (harmless) or stop.
 5. The 8.0.25 → 8.0.21 ASP.NET Core downgrade reverts the AZ-496 hygiene bump; this is acceptable for an emergency rollback (the CVE-2026-26130 path is not reachable in this app).
 ## Post-deploy verification
 After the cycle-3 image is deployed and the API is bound:
 1. **JWT iss/aud smoke** (NEW, AZ-494):
   ```bash
   # Token with WRONG issuer must be rejected:
   curl -s -o /dev/null -w "%{http_code}\n" -H "Authorization: Bearer $TOKEN_WITH_WRONG_ISS" \
     "$API_URL/api/satellite/tiles/latlon?Latitude=47.461747&Longitude=37.647063&ZoomLevel=18"
   # Expected: 401
   # Token with WRONG audience must be rejected:
   curl -s -o /dev/null -w "%{http_code}\n" -H "Authorization: Bearer $TOKEN_WITH_WRONG_AUD" \
     "$API_URL/api/satellite/tiles/latlon?Latitude=47.461747&Longitude=37.647063&ZoomLevel=18"
   # Expected: 401
   # Token with MATCHING iss + aud must be accepted (cycle-2 JWT smoke still works):
   curl -s -o /dev/null -w "%{http_code}\n" -H "Authorization: Bearer $VALID_TOKEN" \
     "$API_URL/api/satellite/tiles/latlon?Latitude=47.461747&Longitude=37.647063&ZoomLevel=18"
   # Expected: 200
   ```
 2. **Fail-fast smoke**: deliberately deploy ONCE with `JWT_ISSUER` unset to confirm the API refuses to start. Then set the env var and confirm the API binds.
 3. **Cycle-2 verifications still apply**: JWT smoke (anonymous → 401, valid token → 200), UAV upload smoke (`GPS` permission → 200; no permission → 403), Swagger Bearer button visible.
 4. **No regression in tile reads**: same as cycle-2 R4 verification — `GET /api/satellite/tiles/latlon?...` against a multi-source cell.
 5. **Tail Serilog** for the first hour after promote: alert on `InvalidOperationException` (would indicate fail-fast triggered after a successful first bind, which means env vars went away mid-run — unusual but worth knowing) and on any spike in 401s (would indicate the prod iss/aud value drifted from what admin-API is stamping).
 ## CI/CD path
 `.woodpecker/02-build-push.yml` (unchanged this cycle) builds and pushes on push to `dev`, `stage`, `main`. All 9 cycle-3 commits are on `dev` and pushed to `origin/dev`, so the dev-tier image is being built / has built automatically.
 Promote to `stage` / `main` only after R1 (admin-team-confirmed iss/aud values) is satisfied AND the R3 cycle-2 consumer coordination is still in place.
 **Push policy**: per `git-workflow.mdc`, this autodev pushed only to `dev`. Manual operator action required for `stage` / `main` promotion.
 ## Resolved-this-cycle backlog items
 - **F-AUTH-2** (cycle-2 Medium) — `iss`/`aud` not validated. **RESOLVED in AZ-494**. Operational gate replaces the code-level gate.
 - **D1** (cycle-1 Medium) — `Microsoft.AspNetCore.OpenApi` on the 8.0.21 patch line. **RESOLVED in AZ-496** — bumped to 8.0.25.
 - **D3** (cycle-2 Low) — `Microsoft.AspNetCore.Authentication.JwtBearer` on the same 8.0.21 line. **RESOLVED in AZ-496**.
 - **PT-07 / PT-08 leftover** (cycle-2 leftover) — perf-harness work for `Authorization: Bearer` attach + PT-07 + PT-08 scenarios. **RESOLVED in AZ-492** — harness now runnable; only execution itself is now-deferred (separate cycle-3 leftover).
 Cycle-1 carry-overs (S1, S2, S4, D1 closed, D2, I1, I3, I5) — S1, S2, S4, I1, I3, I5 unchanged; still flagged in `_docs/05_security/security_report.md` as the pre-public-network hardening backlog.
 ## Cycle-3 follow-ups (NOT cycle-blocking; tracked for future PBIs)
 - **D4** (cycle-3 Low, test-only) — bump `System.IdentityModel.Tokens.Jwt 7.0.3` + `Microsoft.IdentityModel.Tokens 7.0.3` to ≥ 7.1.2 (or align to the 8.0.x family) to eliminate the NU1902 warning noise. Test-only, no production reachability.
 - **F-DBR-2** (cycle-3 Low, test-only) — consider adding a third guard to `IntegrationTestResetGuard` requiring explicit `INTEGRATION_TEST_DB_RESET_CONFIRM=I-UNDERSTAND-THIS-TRUNCATES` env var when running against non-`postgres` hosts.
 - **F-PERF-1** (cycle-3 Low, operator-CLI) — pipe `--mint-only` token via process substitution / `xargs` so it never lands in shell history.
 - **AZ-492 image-fixture consolidation** — `UavUploadTests.CreateValidJpeg` + `PerfBootstrap.GenerateUavFixture` + `UavTileImageFactory` are 3 sites that all produce conceptually-similar JPEGs; consolidate into one factory in TestSupport.
 - **AZ-492 server-side per-item timing** — PT-08 currently reports per-item gate cost as a derived proxy (`batch_p95 / batch_size`); true per-call `UavTileQualityGate.Validate` timing requires server-side instrumentation.
 - **AZ-493 DB-name alignment** — optional rename `satelliteprovider` → `satelliteprovider_test` in `docker-compose.tests.yml` would let `IntegrationTestResetGuard` adopt the spec's original DB-name pattern as a second guard alongside Host allowlist.
 - **AZ-494 AC-7 cross-repo doc** — write paragraph in `suite/_docs/10_auth.md` (parent monorepo).
 - **No token revocation list** (residual A07 after AZ-494) — Low; re-evaluate if user-revocable tokens or session management is ever required.
@@ -0,0 +1,182 @@
 # Retrospective — Cycle 3 (2026-05-12)
 **Tasks**: AZ-491 (consolidate JWT test-mint helpers, 3 SP) + AZ-492 (perf harness PT-07 + PT-08 + JWT-attach, 5 SP) + AZ-493 (integration test DB reset hook, 3 SP) + AZ-494 (JWT iss/aud validation, 3 SP, Option B) + AZ-495 (doc folder convention, 2 SP) + AZ-496 (bump AspNetCore 8.0.25, 2 SP)
 **Mode**: cycle-end (autodev Step 17)
 **Previous retro**: `retro_2026-05-11_cycle2.md`
 ## 1. Implementation Metrics
 | Metric | Cycle 3 | Δ vs cycle 2 |
 |--------|---------|--------------|
 | Tasks implemented | **6** (AZ-491, AZ-492, AZ-493, AZ-494, AZ-495, AZ-496) | +4 |
 | Batches executed | **5** | +3 |
 | Avg tasks / batch | 1.2 | -1.3 (cycle 2 = 1.0 tasks/batch but only 2 batches) |
 | Total complexity delivered | **18 SP** | +8 (cycle 2 = 10 SP) |
 | Avg complexity / batch | 3.6 SP | -1.4 |
 | Tasks at-or-below 5 SP cap | **6 of 6** (100%) | +4 (cycle 2 = 1 of 2) |
 | Tasks above cap | 0 | -1 (cycle 2 had AZ-488 at 8 SP) |
 | Cumulative reviews | **2** (after batches 01-03, after batches 04-05) | +1 (cycle 2 had 0) |
 **Sequencing**: batches ordered to respect Cycle-2 retro's Action 1 (Action 1 → AZ-491 first) so subsequent perf and DB-reset work could consume the consolidated factory. AZ-494 was sequenced LAST because it depended on AZ-491's TestSupport + AZ-492's perf-harness env-var pass-through.
 ## 2. Quality Metrics
 | Metric | Cycle 3 | Δ vs cycle 2 |
 |--------|---------|--------------|
 | Code review pass rate | **5/5 = 100%** (all PASS_WITH_WARNINGS) | unchanged |
 | Code review findings — Critical | 0 | unchanged |
 | Code review findings — High | 0 | unchanged |
 | Code review findings — Medium | 0 | unchanged |
 | Code review findings — Low | **7 distinct** (batch-01 F1 + F2 + batch-02 L1 + batch-03 F1 + batch-04 L1 + L2 + batch-05 L1) | +2 |
 | Code review FAIL count | 0 | unchanged |
 | Cumulative review findings | 4 Low (carry-overs from per-batch) + 1 operational gate (AZ-494 prod iss/aud) | new metric |
 | Security audit verdict | **PASS_WITH_WARNINGS** | unchanged |
 | Security findings introduced by cycle 3 | 0 new Medium, 3 new Low (D4 test-only, F-DBR-2 test-only, F-PERF-1 operator-CLI), 2 Informational (F-AUTH-3 test-runner log, F-AUTH-4 DEV-ONLY by design), 1 False Positive (F-DBR-1) | **better** (cycle 2 had 2 new Medium + 4 new Low + 1 Info) |
 | Security findings RESOLVED by cycle 3 | **F-AUTH-2 (Medium)** by AZ-494; **D1 (Medium)** + **D3 (Low)** by AZ-496 | first cycle with explicit resolved-finding count |
 ## 3. Structural Metrics (snapshot: `structure_2026-05-12_cycle3.md`)
 | Metric | Cycle 3 | Δ vs cycle 2 |
 |--------|---------|--------------|
 | .NET projects (csproj) | **9** | +1 (new: `SatelliteProvider.TestSupport`) |
 | Cross-project edges (ProjectReference) | grew by 2 (TestSupport ← Tests, TestSupport ← IntegrationTests) | +2 |
 | Cycles in project graph | 0 | unchanged |
 | Public API symbols in TestSupport | 3 (`JwtTokenFactory`, `IntegrationTestResetGuard`, internal helpers) | new |
 | New Architecture violations | **0** | unchanged |
 | Resolved Architecture violations | F-AUTH-2 (auth contract gap), D1+D3 (supply-chain drift), PT-07/PT-08 deferred-since-cycle-2 | **best metric of cycle** — first net-negative architecture delta cycle |
 | Net Architecture delta | **-3** (resolved minus new) | improvement |
 | Contract coverage % | unchanged (no new public API surfaces this cycle) | n/a |
 A snapshot was written to `_docs/06_metrics/structure_2026-05-12_cycle3.md` (see Step 1 self-verification).
 ## 4. Efficiency Metrics
 | Metric | Cycle 3 | Δ vs cycle 2 |
 |--------|---------|--------------|
 | Blocked tasks (during implementation) | **1 of 6** — AZ-494 blocked on cross-team input (admin-team iss/aud values), resolved by user choosing Option B (plumbing only, fail-fast at deploy) | new pattern |
 | Tasks completed first attempt (no post-review fix commits) | **5 of 6** — only AZ-491 had a follow-on batch-02 fix (`fix:` commit) for the env-var save/restore pattern between iss/aud overrides; the rest landed clean | **best cycle on record** (cycle 1 = 0 of 1; cycle 2 = 0 of 2) |
 | Tasks requiring multiple post-code-review fix commits | 0 | -2 (cycle 2 had 2 of 2) |
 | Most-findings batch | batch 04 (AZ-492, 2 Low: L1 proxy measurement + L2 dupe JPEG factory) | batch 02 in cycle 2 |
 | Cumulative-review-only findings | 0 — every cumulative-review item was already raised at the per-batch level | new metric; the cumulative review acted as confirmation, not discovery |
 | Step-15 (Perf Test) execution | **SKIPPED** (user skipped the gate question; recorded as leftover) | unchanged vs cycle 2 (also skipped) |
 | Step-14 (Security Audit) — net findings improvement | **+1** (3 Resolved, 3 new Low test-only) | net-zero in cycle 2 |
 ## 5. Patterns Identified
 ### Pattern 1 — Action items from prior retros directly drove the cycle scope and DID resolve
 Cycle 2 retro identified three Top-3 actions:
 - **Action 1** (consolidate JWT test-mint helpers) → drove **AZ-491**. Verdict: **resolved**. The Phase-6 code-review rule added during AZ-491 review (the AZ-491 batch produced both the consolidation AND the rule that prevents recurrence) immediately fired on AZ-492 batch-04's L2 finding (dupe JPEG factory), proving the rule is doing useful work.
 - **Action 2** (perf harness work as real task) → drove **AZ-492**. Verdict: **resolved**. PT-07 + PT-08 now runnable; the leftover from cycle 2 was deleted.
 - **Action 3** (DB-state reset) → drove **AZ-493**. Verdict: **resolved**. Wall-clock workaround removed; two-guard model unit-tested.
 This is the first cycle where retro actions translated directly to next-cycle work AND closed. Pattern is healthy. Keep doing it.
 ### Pattern 2 — One AC (AZ-494 AC-7) requires cross-repo work; workspace-boundary rule fired correctly
 AZ-494 AC-7 says "Suite contract reflects reality" — i.e. update `suite/_docs/10_auth.md`. That file lives in a different workspace. The autodev correctly did NOT write across workspaces; instead, the batch report + cumulative review + deploy report all flagged the cross-repo write as deferred operational work.
 **Insight**: ACs that require cross-repo writes should be split — one AC per workspace — and tagged with the workspace they target. Otherwise an AC tagged "deferred" on technicality looks like incomplete work in the traceability matrix when it's actually the right outcome.
 ### Pattern 3 — Spec-vs-reality drift on measurement / sentinel paths repeated twice
 - **AZ-492 L1**: spec said "per-item gate cost < 50 ms" without specifying the measurement path; harness produced a derived proxy because direct measurement requires server-side instrumentation outside AZ-492's scope.
 - **AZ-493 F1**: spec prescribed "DB name contains `_test`" as Guard 2; reality uses `Database=satelliteprovider` and rename requires user confirmation; the implementation substituted Host allowlist as an equivalent guard.
 Both cases were caught and documented during code review, but the underlying pattern is the same: **ACs that prescribe a specific measurement or sentinel mechanism should also prescribe (or explicitly defer) the path for collecting / enforcing it, so the implementation has a clear bound between "follow the spec" and "substitute an equivalent".**
 ### Pattern 4 — Option-B forcing functions (fail-fast in prod) elegantly handle cross-team blockers
 AZ-494 was blocked on the admin team's iss/aud values. Rather than freeze the work, Option B (user choice) shipped the validation code with empty `appsettings.json` values, guaranteeing prod fails at startup until the real values are supplied. This:
 - Unblocks cycle 3 implementation immediately.
 - Forces the cross-team conversation to happen before prod deploy, not after.
 - Leaves no silently-broken state ("validation off in prod") possible.
 This is a generalizable pattern: **for cross-team blockers, prefer a fail-fast scaffold over a defer-the-whole-task decision.** Worth adding as a lesson.
 ### Pattern 5 — NU1902 warning surfaced AT build, was triaged inline, accepted as cycle-3 D4
 The new TestSupport project's `System.IdentityModel.Tokens.Jwt 7.0.3` pin triggered NU1902 (moderate severity) at every restore — visible in the build log 9 times. The batch-02 review (AZ-491) recorded this; the cycle-3 security audit recorded it again as D4; the deploy report carries it as a follow-up.
 The path from "compiler warning during test runs" → "tracked security finding with a remediation owner" worked correctly. Worth keeping as a positive example: build-side warnings should ride into the security audit, not be silenced by the agent.
 ### Pattern 6 — `dotnet format whitespace --verify-no-changes` ran transparently; no format-drift commits
 Format drift caused two extra fix commits in cycle 2 (CS0104 fix, JwtFactory net8.0 fix). Cycle 3 had ZERO format-drift fixes — `dotnet format` ran as the first step of `run-tests.sh`, was visible in the log, and all 5 batches passed it without intervention. The earlier hardening (cycle 2 added format check to the test runner) pays off here.
 ## 6. Comparison vs. previous retro
 | Metric                               | Cycle 1        | Cycle 2        | Cycle 3        |
 |--------------------------------------|----------------|----------------|----------------|
 | Tasks implemented                    | 1              | 2              | 6              |
 | Batches                              | 1              | 2              | 5              |
 | Critical/High review findings        | 0              | 0              | 0              |
 | New Medium review findings           | 0              | 0              | **0**          |
 | New Low review findings              | 3              | 6 (5 distinct) | **7**          |
 | Code review pass rate                | 100% (1/1)     | 100% (2/2)     | **100% (5/5)** |
 | Tasks completed first attempt        | 0 of 1         | 0 of 2         | **5 of 6**     |
 | New Medium security findings         | 2              | 2              | **0**          |
 | Resolved security findings           | 0              | 0              | **3** (F-AUTH-2, D1, D3) |
 | Net Architecture delta               | n/a (baseline) | +0             | **-3**         |
 | Step-15 (Perf) executed              | N/A            | SKIPPED        | SKIPPED        |
 | Step-15 leftover present at retro    | N/A            | YES (PT-07)    | YES (cycle-3 perf-harness execution) |
 ### Did the cycle-2 actions land?
 - **Cycle 2 Action 1 (consolidate JWT mint helpers)** — landed as **AZ-491**. Phase-6 code-review rule added simultaneously. Rule fired in AZ-492 batch-04 (L2 dupe JPEG factory) as designed. **Verdict**: full implementation + recurrence prevention.
 - **Cycle 2 Action 2 (perf harness as real feature)** — landed as **AZ-492**. PT-07 + PT-08 are now runnable. Cycle-2 leftover file deleted. **Verdict**: full implementation. (Execution is a separate cycle-3 leftover, see Action 3 below.)
 - **Cycle 2 Action 3 (DB reset between runs)** — landed as **AZ-493**. AZ-488 wall-clock workaround removed; two-guard model in place. **Verdict**: full implementation.
 This is the **first cycle in which all prior retro actions translated to closed work**. Cycle 1 actions had mixed outcomes; cycle 2 actions were the input to cycle 3.
 ## 7. Top 3 Improvement Actions (ranked by impact)
 ### Action 1 — Execute the cycle-3 perf harness against the deployed `dev` image to convert the cycle-3 perf-execution leftover into PT-07/PT-08 baseline numbers
 **Why this is the highest impact**: PT-07 and PT-08 are NOW runnable (AZ-492 closed cycle 2's biggest backlog item). The harness is sitting unexercised because Step 15 was skipped. The next time anyone makes a change that touches the region read or upload paths, the perf gate must compare against *something* — and right now there is no recent baseline.
 **Action**: at the start of cycle 4 (or as a one-off "ops" task), run `./scripts/run-performance-tests.sh` against the deployed `dev`-tier image. Record the PT-01..PT-06 / PT-07 / PT-08 numbers in `_docs/06_metrics/perf_<YYYY-MM-DD>.md` (mirrors `perf_2026-05-11_cycle1_az484.md`). Use those numbers as the new baseline.
 **Cost**: ~30 minutes (script run + record + delete leftover file). Possibly tracked as a 2-SP cycle-4 PBI rather than ad-hoc.
 ### Action 2 — Bump `System.IdentityModel.Tokens.Jwt` 7.0.3 → 7.1.2+ (or to 8.0.x) in `SatelliteProvider.TestSupport` to clear the NU1902 build noise
 **Why**: 9 NU1902 hits in every test build log degrade the signal-to-noise ratio of CI output and add a low-grade "is this PR adding new vulnerabilities?" cognitive load during review. The fix is one csproj edit; the trade-off is just verifying test compat with the newer version. Test-only finding, NOT production-reachable, but cleaning it up is cheap.
 **Action**: 2 SP PBI in cycle 4. Recommended pin: `7.1.2` to stay on the 7.x line that JwtBearer 8.0.25 transitively depends on. Verify all `JwtTokenFactory` unit + integration tests still pass.
 ### Action 3 — Make "ACs requiring cross-repo writes" structurally visible during task decomposition
 **Why**: AZ-494 AC-7 was correctly deferred to a cross-repo write, but the traceability matrix shows AC-7 as `◐ deferred` which looks like missed work. Future cycles will accumulate more cross-repo ACs as the satellite-provider's contract surface grows; without structure, the traceability matrix gradually fills with `◐` markers that mean "different thing each time".
 **Action**:
 - Add a `workspace:` field to task spec ACs (where applicable): `workspace: satellite-provider` (default) or `workspace: suite`.
 - In `new-task/SKILL.md` Step 6 (AC writing), prompt: "if this AC requires changes outside this workspace, tag with `workspace: <name>` and confirm with user that a cross-repo PBI will be filed".
 - In the traceability matrix, render cross-workspace ACs in a separate section ("Cross-Workspace Follow-ups") rather than mixed with in-workspace ACs.
 **Cost**: 2 SP — small skill rule addition + traceability template update + one-time backfill of AZ-494 AC-7.
 ## 8. Recommended Rule / Skill updates
 1. **Add to `coderule.mdc`**: "When a task's success depends on cross-team input that may not be available in-cycle, prefer an Option-B forcing function (ship the validation/scaffolding with prod-empty config that fails-fast at deploy) over deferring the entire task. The fail-fast contract makes the cross-team conversation impossible to skip." (Justified by Pattern 4.)
 2. **Add to `coderule.mdc` (or new `task-spec.mdc`)**: "ACs that prescribe a specific measurement or sentinel mechanism (e.g. 'per-item latency < 50ms', 'guard fires if DB name contains _test') should also prescribe — or explicitly defer — the path for collecting / enforcing it, so the implementation has a clear bound between 'follow the spec' and 'substitute an equivalent.'" (Justified by Pattern 3.)
 3. **Update `.cursor/skills/new-task/SKILL.md`** (Step 6): introduce optional `workspace:` field on each AC; warn when an AC implies cross-repo work. (Justified by Action 3.)
 4. **Keep the Phase-6 dupe-helper rule** added to `.cursor/skills/code-review/SKILL.md` during AZ-491 review — it fired correctly in AZ-492 batch-04 and is a low-cost / high-signal check. No change needed.
 ## 9. Decision items carried over (operator)
 - **Admin team iss/aud confirmation** (deploy R1 from cycle-3 deploy report) — required before promoting beyond `dev`. Tracked in `deploy_cycle3.md`.
 - **Cross-repo doc** (deploy R2 / Pattern 2 / Action 3) — `suite/_docs/10_auth.md` paragraph addition. Tracked in `deploy_cycle3.md`.
 - **Cycle-1 hardening backlog** (S1, S2, S4, I1, I3, I5) — pre-public-network items, unchanged. Tracked in cycle-1 retro + `security_report.md`.
 ## 10. What this retro says about process maturity
 Cycle 3 is the first cycle that:
 - Closes more security findings than it opens (-3 Medium-or-above).
 - Lands all prior-retro action items.
 - Has every task at-or-below the 5-SP cap.
 - Achieves a >80% first-attempt-completion rate (5/6 = 83%).
 - Has zero format-drift fix commits.
 - Has zero code-review FAIL verdicts.
 The process is converging. The next areas of friction are (a) cross-repo coordination (Action 3), (b) following through on the perf-harness execution that the harness work itself enabled (Action 1), and (c) ongoing test-side supply-chain hygiene (Action 2). None of these are systemic; all are concrete cycle-4 PBI candidates.
@@ -0,0 +1,78 @@
 # Structural Snapshot — 2026-05-12 (post-cycle 3, AZ-491 / AZ-492 / AZ-493 / AZ-494 / AZ-495 / AZ-496)
 Cycle 3 delta against `structure_2026-05-11_cycle2.md`. Source of truth: `_docs/02_document/module-layout.md` + on-disk `*.csproj` graph + `_docs/02_document/contracts/`.
 ## Projects
 | Layer | csproj | Cycle 3 delta |
 |-------|--------|---------------|
 | 1 (Foundation) | `SatelliteProvider.Common` | unchanged |
 | 1 (Foundation) | `SatelliteProvider.DataAccess` | unchanged |
 | 3 (Application) | `SatelliteProvider.Services.TileDownloader` | unchanged |
 | 3 (Application) | `SatelliteProvider.Services.RegionProcessing` | unchanged |
 | 3 (Application) | `SatelliteProvider.Services.RouteManagement` | unchanged |
 | 4 (API / Entry) | `SatelliteProvider.Api` | +`Authentication/AuthenticationServiceCollectionExtensions` extended with `iss`/`aud` resolution + fail-fast (AZ-494); `Microsoft.AspNetCore.OpenApi` 8.0.21 → 8.0.25 and `Microsoft.AspNetCore.Authentication.JwtBearer` 8.0.21 → 8.0.25 (AZ-496) |
 | **5 (Test-Support, NEW)** | **`SatelliteProvider.TestSupport`** | **NEW project** (AZ-491). `IsPackable=false`. Public surface: `JwtTokenFactory` (the canonical HS256 mint helper, with iss/aud parameters added by AZ-494) + `IntegrationTestResetGuard` (the two-guard model added by AZ-493). NuGet refs: `Microsoft.IdentityModel.Tokens 7.0.3` + `System.IdentityModel.Tokens.Jwt 7.0.3`. |
 | 6 (Tests) | `SatelliteProvider.Tests` | +`ProjectReference` to `SatelliteProvider.TestSupport` (AZ-491); removed local `TestUtilities/JwtTokenFactory.cs` |
 | 6 (Tests) | `SatelliteProvider.IntegrationTests` | +`ProjectReference` to `SatelliteProvider.TestSupport` (AZ-491); +`PerfBootstrap.cs` (AZ-492); +`IntegrationTestDatabaseReset.cs` (AZ-493); `JwtTestHelpers.cs` extended with `MintAuthenticated`/`MintExpired`/`ResolveIssuerOrThrow`/`ResolveAudienceOrThrow` (AZ-491 + AZ-494); removed direct `Microsoft.IdentityModel.JsonWebTokens` PackageReference |
 **Project count**: 9 (+1 from cycle 2; new `SatelliteProvider.TestSupport`).
 ## Cross-Project Import Edges (compile-time `ProjectReference`)
 | Edge | Count |
 |------|-------|
 | Api → {Common, DataAccess, TileDownloader, RegionProcessing, RouteManagement} | 5 (unchanged) |
 | TileDownloader → {Common, DataAccess} | 2 (unchanged) |
 | DataAccess → {Common} | 1 (unchanged) |
 | RegionProcessing → {Common, DataAccess} | 2 (unchanged) |
 | RouteManagement → {Common, DataAccess} | 2 (unchanged) |
 | Tests → {Api, TileDownloader, RegionProcessing, RouteManagement, Common, DataAccess} | 6 (unchanged; cycle-2 baseline) |
 | **Tests → TestSupport** | **+1 (AZ-491)** |
 | **IntegrationTests → TestSupport** | **+1 (AZ-491)** |
 **Total ProjectReference edges**: 20 (+2 vs cycle 2). Both new edges go INTO TestSupport; no production-layer dependency on TestSupport (the IsPackable=false guarantee blocks accidental shipping).
 ## Source-import sites — cycle 3 delta
 | Importer | Imports from | Cycle 3 delta |
 |----------|--------------|---------------|
 | WebApi `Authentication` | `Microsoft.IdentityModel.Tokens` | +1 site (`ResolveRequiredOrThrow` extension; `ValidateIssuer`/`ValidateAudience` flags on `TokenValidationParameters`) |
 | IntegrationTests | `SatelliteProvider.TestSupport` | +N sites (`JwtTokenFactory`, `IntegrationTestResetGuard`) — replaces removed local helpers |
 | Tests | `SatelliteProvider.TestSupport` | +N sites (`JwtTokenFactory` in 5 test files; `IntegrationTestResetGuard` in unit `IntegrationTestResetGuardTests`) |
 | IntegrationTests | `Npgsql` | +1 site (`IntegrationTestDatabaseReset` uses `NpgsqlConnection` + `NpgsqlCommand`) |
 | IntegrationTests | `SixLabors.ImageSharp` (already present) | +1 site (`PerfBootstrap.CreateValidJpeg`) |
 ## Graph properties
 - **Cycles in project import graph**: 0 (clean DAG — unchanged)
 - **Average ProjectReferences per component**: 20 / 9 = ~2.2 (cycle 2 = 12 / 8 = 1.5; growth is concentrated in test surface, not production)
 - **Max in-degree**: Common (still highest at 6 — Api, TileDownloader, DataAccess, RegionProcessing, RouteManagement, Tests). TestSupport in-degree = 2 (Tests + IntegrationTests).
 - **Max out-degree**: Tests (7 — adds the new TestSupport edge to its existing 6).
 - **TestSupport position**: leaf-of-test-subgraph; no production-layer importers. Out-degree = 0 from a project-graph standpoint (it does not depend on any other satellite-provider project). NuGet-only dependencies.
 ## NuGet dependency hygiene (cycle 3)
 | Package | Version | Status |
 |---------|---------|--------|
 | `Microsoft.AspNetCore.OpenApi` | 8.0.21 → **8.0.25** | RESOLVED D1 (AZ-496) |
 | `Microsoft.AspNetCore.Authentication.JwtBearer` | 8.0.21 → **8.0.25** | RESOLVED D3 (AZ-496) |
 | `Microsoft.IdentityModel.Tokens` (TestSupport) | 7.0.3 (NEW) | NEW D4 — CVE-2024-21319, test-only, bump to 7.1.2 tracked as future PBI |
 | `System.IdentityModel.Tokens.Jwt` (TestSupport) | 7.0.3 (NEW) | NEW D4 — same advisory; same disposition |
 | `SixLabors.ImageSharp` | 3.1.11 (unchanged) | clean |
 | `Npgsql` | 9.0.2 (unchanged) | clean (now consumed by AZ-493's reset hook) |
 | `Microsoft.Extensions.*` | 9.0.10 (unchanged across DataAccess, TileDownloader, Tests, RegionProcessing, RouteManagement) | consistent across all 5 sites |
 ## Architecture / contract surface (cycle 3 delta)
 - No new public-API contracts under `_docs/02_document/contracts/` this cycle. AZ-494 strictly tightens token acceptance (rejects with 401 on iss/aud mismatch) without changing the public HTTP surface.
 - The `Microsoft.AspNetCore.Authentication.JwtBearer` middleware now validates four claim-shape invariants instead of two (signing key + lifetime + **issuer** + **audience**).
 - Cycle-2 contract `_docs/02_document/contracts/api/uav-tile-upload.md` v1.0.0 unchanged.
 ## Net Architecture delta vs cycle 2
 - **Resolved**: F-AUTH-2 (iss/aud unvalidated), D1 (OpenApi 8.0.21 patch line), D3 (JwtBearer 8.0.21 patch line), PT-07/PT-08 cycle-2 leftover. **Total: 4 resolved.**
 - **Newly introduced**: D4 (Low, test-only NU1902 pin), F-AUTH-3 (Informational, test-runner log), F-AUTH-4 (Informational, by-design DEV-ONLY placeholders), F-DBR-2 (Low, test-only TRUNCATE guard), F-PERF-1 (Low, operator-CLI token-on-stdout). F-DBR-1 explicit false-positive. **Total: 3 new Low + 2 Informational + 1 FP.**
 - **Net Architecture delta**: -1 finding overall, -3 Medium-or-above (the 3 cycle-3 introductions are all Low or Informational; the 3 prior resolutions were 2 Medium + 1 Low).
 First cycle with a net-negative architecture delta. Pattern: prior-retro Action items + targeted dependency bumps + spec hardening combined to retire more debt than they introduced.
@@ -37,6 +37,12 @@ If the enum's wire string happens to match a member name case-insensitively (e.g
 ## Ring buffer (last 15 entries — newest at top)
 - [2026-05-12] [process] For cross-team blockers (admin team must supply config values, etc.), prefer an Option-B forcing function (ship the validation/scaffolding with prod-empty config that fails-fast at deploy) over deferring the entire task — the fail-fast contract makes the cross-team conversation impossible to skip and ships the in-workspace work in the current cycle (cycle 3: AZ-494 shipped iss/aud validation with empty prod appsettings so deploy must supply real values).
  Source: _docs/06_metrics/retro_2026-05-12_cycle3.md
 - [2026-05-12] [process] ACs that prescribe a specific measurement or sentinel mechanism (e.g. "per-item latency < 50ms", "guard fires when DB name contains _test") should also prescribe — or explicitly defer — the path for collecting / enforcing it, or implementations will substitute proxies / equivalents that look like spec drift in review (cycle 3: AZ-492 PT-08 per-item gate cost became a derived proxy; AZ-493 DB-name guard became Host-allowlist).
  Source: _docs/06_metrics/retro_2026-05-12_cycle3.md
 - [2026-05-12] [process] ACs that require cross-repo writes should be tagged with the target workspace and rendered separately in the traceability matrix — mixing them with in-workspace ACs makes "correctly deferred" indistinguishable from "incomplete work" (cycle 3: AZ-494 AC-7 deferred for the suite-repo write; matrix renders as `◐ deferred` which is ambiguous).
  Source: _docs/06_metrics/retro_2026-05-12_cycle3.md
 - [2026-05-11] [testing] Test helpers shared across unit + integration projects must live in one consolidated location — duplicate near-identical copies will diverge and require parallel fixes (cycle 2: `JwtTokenFactory.cs` and `JwtTestHelpers.cs` had the same `Expires < NotBefore` bug fixed in separate commits).
  Source: _docs/06_metrics/retro_2026-05-11_cycle2.md
 - [2026-05-11] [process] Deferred-status NFR entries are allowed at most ONCE per NFR — if a Deferred NFR has not landed by the end of the cycle that follows the one in which it was deferred, the harness work must be promoted to a real PBI before any new NFR is accepted as Deferred (cycle 2 inherited cycle 1's PT-07 + added PT-08 + JWT-attach script-rot).
@@ -2,14 +2,14 @@
 ## Current Step
 flow: existing-code
-step: 14
+step: 9
-name: Security Audit
+name: New Task
-status: completed
+status: not_started
 sub_step:
-  phase: 5
+  phase: 0
-  name: PASS_WITH_WARNINGS
+  name: awaiting-invocation
-  detail: "Step 14 PASS_WITH_WARNINGS — all 5 phases (Dependency Scan, Static Analysis, OWASP Top 10, Infrastructure, Security Report) refreshed for cycle 3. Resolved: F-AUTH-2 (Medium, AZ-494), D1 (Medium, AZ-496), D3 (Low, AZ-496). New cycle-3 findings: D4 (Low, test-only NU1902), F-AUTH-3 (Info, test-runner), F-AUTH-4 (Info, by design), F-DBR-1 (false positive), F-DBR-2 (Low, test-only TRUNCATE guard), F-PERF-1 (Low, operator-CLI). 0 Critical, 0 High, 0 new Medium. Next: Step 15 (Performance Test, optional gate)."
+  detail: "CYCLE 3 COMPLETE. Step 17 (Retrospective) wrote retro_2026-05-12_cycle3.md + structure_2026-05-12_cycle3.md + 3 new ring-buffer lessons in LESSONS.md. Verdict: first cycle with net-negative architecture delta (-3 Medium-or-above resolved, 0 new Medium); 100% review pass rate (5/5 batches); 5 of 6 tasks completed first attempt; all prior-retro actions translated to closed work. Loop back to Step 9 (New Task) for cycle 4 per existing-code.md § Re-Entry After Completion."
 retry_count: 0
-cycle: 3
+cycle: 4
 tracker: jira
 auto_push: true
@@ -0,0 +1,44 @@
 # Leftover — Cycle 3 perf harness execution
 **Timestamp**: 2026-05-12T00:00:00Z (UTC+3 wallclock 2026-05-12 ~03:00)
 **Reason for deferral**: User skipped the Step 15 (Performance Test) gate. Per `meta-rule.mdc`, performance tests require explicit approval; a skipped question is not approval. Defaulted to skip + record-as-leftover to avoid blocking the autodev's progress through Steps 16-17.
 ## What was deferred
 Execution of `scripts/run-performance-tests.sh` against the cycle-3 build. The harness was made runnable by AZ-492 and would exercise:
 - **PT-01..PT-06** — regression probes (latency / status checks for the existing endpoints with JWT attach, post-AZ-487 + post-AZ-494)
 - **PT-07** — cold + warm region-tile distribution (cold p50/p95 vs warm p50/p95; fails if warm p95 ≥ cold p95)
 - **PT-08** — UAV batch upload distribution (batch p50/p95 + per-item proxy; gated at AZ-488 NFR of batch p95 ≤ 2000 ms)
 ## Pre-requisites for replay
 The harness needs the same env vars that the cycle-3 test run consumes:
 - `JWT_SECRET` — ≥ 32 bytes; already in `.env`
 - `JWT_ISSUER` — already in `.env` as DEV-ONLY (AZ-494)
 - `JWT_AUDIENCE` — already in `.env` as DEV-ONLY (AZ-494)
 - `GOOGLE_MAPS_API_KEY` — already in `.env`
 Optionally:
 - `PERF_REPEAT_COUNT` (default 20)
 - `PERF_UAV_BATCH_SIZE` (default 10)
 ## How to replay
 ```bash
 ./scripts/run-performance-tests.sh
 ```
 (brings up its own docker-compose stack; cleans up on exit; ~3-5 minutes for default counts)
 ## Why this is NOT a hard blocker
 - The cycle-3 implementation report and code review verdicts already note that the perf harness was statically verified (script grep + integration-test compile + AZ-492 AC-1/AC-4/AC-5/AC-6 covered).
 - The AZ-488 batch-p95 threshold was set in cycle 2 and existing integration tests do NOT regress at the cycle-3 build (Step 11 full suite all-green).
 - No cycle-3 change altered the production hot paths beyond JWT validation (AZ-494 adds two string comparisons per request — sub-microsecond).
 - The cycle-2 deploy also skipped this gate (Option B) without negative consequences.
 ## Replay obligation
 Per `tracker.mdc` Leftovers Mechanism: at the start of the next `/autodev` invocation, this leftover should be replayed by running the perf harness, then either deleted (if it passes) or updated with the failure detail.