[1.8.0] Release TODOs and cross-repository integration checklist

[imbajin]

Release scope

Validate the selected 1.8.0 mainline and matching RC artifacts: Server/Toolchain/Doc master, AI main. The 1.7 → 1.8 path is an upgrade-compatibility gate.

This tracker focuses on release decisions and core correctness. Individual dependency-update PRs have been removed; dependency security, resolved-package compatibility and LICENSE/NOTICE remain release gates.

Audit / scoring policy

Scores are merge-quality judgments out of 10 covering correctness, compatibility/security, verification, documentation and scope. They are separate from release importance. ✅ Merge candidate means a candidate scoring at least 8.5 whose listed conditions still need confirmation; it is not an approval, a CI waiver, a merge, or RC acceptance. Re-review after a head change. Known code regressions remain Fix required, even with green CI.

Priority / decision summary

Priority	Core work / reviewed head	Quality	Decision and next action
P0 — upgrade blocker	HStore graph-ID compatibility #3224	—	No fix PR. Require transparent compatibility or a verified migration/recovery procedure before allowing a 1.7→1.8 HStore upgrade. Test startup Raft replay as well as the first write, old/new rows, every replica and rollback.
P1 — security / bounded completion	Auth bootstrap #3192 · 0be7fde7	8.3	Pending confirmation. Current-head CI is green and the helper shell suite passes. Document one-sided-auth rejection and unsupported config syntax, align the stale propagation/WARN description, and verify the supported mounted-config/whole-install-volume upgrade layouts. An old whole-directory volume can retain the old entrypoint as well as hide new helpers; do not assert that every such upgrade executes the new entrypoint and immediately fails.
P1 — query correctness	Cross-label index coverage #3243 · 0de33eda	7.8	Fix required. DELETING labels remain in coverage candidates and the shipped Example1 lacks compatible indexes. Add repository guidance, resolve patch coverage, and land Doc #503 with the code.
P1 — query correctness	Label/condition semantics #2994 · 2cbd5d71	7.8	Fix required. The earlier adjacency-suffix fix is present. Standard trailing steps such as tail/is/unfold still change index planning through the conservative fallback (current review); finish docs/coverage and combined #3243 regression.
P1 — distributed schema correctness	Schema convergence #3237 · 8d6e1868	6.8	Design/fix required. Schema mutation and version publication are not atomic; crash and graph-drop ordering gaps remain. The proposed push/lease protocol is not implemented. Split independent PD/HStore durability, ID and authentication-prefix repairs for bounded review; coordinate Doc #498.
P1 — API compatibility	Cypher error metadata #3241 · ed8344d1	5.8	Fix required. Top-level errors breaks existing Java Client/Hubble deserialization even on success. Preserve the response envelope, classify real parse errors and remove unsupported parameter hints; add matching repository docs. Doc #499 must distinguish Apache mainline from unmerged fork parameter-binding capabilities.
P1 — packaged startup regression	Startup path overrides #3253 · 8de1ddcf	6.7	Partially fixed; further fixes required. Bounded fix restores Store Fastjson safe mode and routes default GC logs through ${LOGS}. Plugin writability, restart getopts, monitor propagation, relative paths and deployment docs remain open; new-head CI has been approved to run.
P1 if deployment is included	Helm #3218 · 0e754b98	8.7	✅ Merge candidate. Independent strict lint and preset renders pass; no new blocking chart-code finding was confirmed. Confirm the organization-fork review disposition, current-head coverage and Doc #494. Keep explicit manual Store restore/replacement gates; chart validation does not prove same-RC upgrade/HA acceptance.
P1 if deployment is included	Readiness #3221 · 7fa80208	7.8	Fix required. Atomic cache and waiter-bound repairs are present. Fix the HBase API assertion, rebase the conflicting branch, add endpoint/config docs and define multi-backend coverage (new review). Only the first remote graph is selected; one healthy HBase cluster can hide another configured cluster's failure.
P2 — optional feature bundle	DECIMAL Server #3209 · d7eb80c8; Client/Loader #771 · 991a97f7	7.8 / 7.0	Fix or explicitly defer. Recent predicate/cardinality/Store-array fixes are present. Persistent schema userdata still changes ordinary fractional metadata to JSON strings after reopen; Loader mappings can lose exact precision and JSON numeric string-ID formatting can change identity. Qualify the Server/Client/Loader/Store bundle before Doc #504, including unsupported index/PK/sort/OLAP uses.
P2 — optional backend	ToplingDB #3134 · 30a949bc	6.7	Fix or explicitly defer. New P1 compatibility review: the default RocksDB path rejects existing rocksdb.data_disks configurations without Topling enabled. Preserve default-provider compatibility, trim unrelated working-state/lifecycle changes and qualify Linux JNI provenance, migration and artifacts. The failed RocksDB runtime job stops resolving a Maven-site dependency before runtime; it does not prove a JNI failure.
P2 — optional platform migration	Java/Groovy/TinkerPop #3117 · af6ecb84	7.1	Scope decision required. Still draft/conflicting with no current-head CI. POMs select Java 17 / Groovy 4.0.25 / TinkerPop 3.8.1, despite the older PR description. Ship mounted Gremlin-config and Client migration guidance, qualify sandbox/serialization/PD/Store/HStore behavior, or defer the bundle.
P2 — root-cause verification	Loader #710 · c6a2b0d2	6.7	Reproduce before fixing. Null guards do not establish the concurrent fetch/reset/close root cause; unrelated HDFS fixture changes increase scope. Resolve conflicts and verify actual parallel local/HDFS import behavior.
P3 — low-risk cleanup	Inactive redirect #3246 · 456cb36f	9.1	✅ Merge candidate. No blocking removal-path regression found; in-repository callers and retained node-role behavior were reviewed. Confirm the current-head codecov/project gate. Lower release priority than upgrade and query fixes.

Companion documentation

PR / reviewed head	Quality	Decision
Doc #506: Client/Loader/Hubble alignment · 7e765b5f	8.7	✅ Merge candidate. Site checks pass; settle host config / mounted-container path instructions. The reported Hubble 1.8 with Server/PD/Store 1.7 is mixed-version evidence, not same-RC Client/Loader or failover acceptance.
Doc #503: cross-label guidance · 1e679825	8.7	✅ Merge candidate (coordinate with #3243). Settle candidate/exception wording and bilingual formatting; publish with the qualified code change.
Doc #494: Helm/recovery · c4ed3619	8.5	✅ Merge candidate (coordinate with #3218). Resolve operational wording and rerun site CI; Build latest currently fails on missing scripts/oink_module.py, not a demonstrated Helm prose failure.
Doc #504: DECIMAL · 4e4d3f16	8.1	Incomplete. JSON number/string requests versus string responses are corrected. Add type-use limitations; hold publication until both code PRs are safe.
Doc #498: schema cache · 05437da0	7.9	Incomplete. State applicability and full option bounds; do not describe the unimplemented convergence protocol as available.
Doc #499: Cypher · 3599a2bd	6.8	Fix required. Correct unsupported mainline request forms and fork references. Build latest also fails on missing scripts/update_oink.py; separate that workflow issue from API-contract defects.
Doc #505: Ask AI/community · 3379caf8	7.8	Optional; may be deferred. Existing third-party consent/withdrawal and navigation behavior comments remain. This optional UI work does not complete 1.8 release notes, version or download metadata.

Essential unresolved issues and acceptance

Upgrade and recovery

• [Bug] HStore: data written by 1.7.0 under the missing graph id 0xFFFE becomes unreachable once master allocates a real graph id (raft log replay at the upgrade restart, or the first batch write); no migration path for #3153 #3224: verify 1.7 batch/Loader rows under 0xFFFE after startup Raft replay and after the first client write; cover snapshots, old/new rows and every replica. The reported remap workaround is per-replica, single-graph-limited and can hide intervening rows under a new ID. Rolling back jars alone does not undo persisted mappings. The public report shows data becoming unreachable, not proven permanent data loss; maintainer RC acceptance remains required.
• Fail fast for incompatible HStore serializers (#3225); require serializer=binary before writes.
• Resolve or explicitly document deployment recovery boundaries for PD snapshot error #3222, PD RocksDB-open failure #3226, Gremlin binding after PD outage #3228, Store restore readiness #3229, and remaining PD task no-op/follower distinctions #3231. Helm workarounds do not fix the underlying service behavior.
• Test retained data/Schema, init_store.enabled, credentials/secrets, metadata cluster prefixes, backup and rollback. Validate empty-volume Store replacement, old Store-ID retirement, PD leader changes and DNS/connection recovery within the selected topology.

Query and cross-repository contracts

• Run combined fix(server): clarify condition resolution semantics for label queries #2994/fix(server): reject incomplete cross-label index coverage #3243 regressions on the selected RC: nested/negative predicates, count, deletion races, range-index ordered scans, partitions, limits/offsets/pages/cursor recovery and duplicate/missing rows. Enable the new ordered-scan protocol only after every Store is upgraded; verify mixed-version rejection.
• Keep HStore contract/tests #3090 scoped: codec/lifecycle exclusions remain; corrected historical scan claims are not current reproduced master failures.
• Verify REST/Gremlin, Java Client/Hubble, Loader and Python/GraphMCP contracts against one RC set, including non-default GraphSpace and unauthorized rejection. Correct Client timeout units and verify Loader concurrency; resolve AI partial-import #373 with explicit property/endpoint diagnostics.
• Validate Hubble V2 English/Chinese permissions, standalone/PD discovery, H2 migration and import-task recovery; distinguish Server user auth, PD service auth and Hubble Operations credentials.
• Validate GraphMCP/Skills installation and controlled-write expiration/replay/restart behavior, retaining documented disabled operations and the single SQLite writer boundary. Prepare Python SDK before MCP artifacts; source versions and TestPyPI do not establish production publication.
• Run GraphRAG/Text2Gremlin/extraction regressions for input/chunking, IDs/Schema, streaming duplicate execution and credential isolation. Define any text2gql branch feature/artifact inclusion explicitly; it is not automatically mainline functionality.

Completed code is not RC acceptance

Verified merged work includes paging/retry/batching and HStore pushdown/snapshot/watch repairs (#3207/#3204/#3193/#3184/#3164/#3157), Store rejoin and PD APIs (#3234/#3232/#3233), scheduler/election cleanup (#3244), GraphMCP/Skills and Python/Vermeer fixes (AI #374/#375), and bilingual core/PD-auth guidance (Doc #501/#502). Retain combined RC regression. SeaTunnel integration, documentation and the official 3.0.0 release are complete.

Final release gates

• Freeze repository inclusion/exclusions, owners, source commits/tags and RC artifacts; update selected repository versions to 1.8.0. Optional features and speculative optimizations must not silently become release blockers.
• Verify resolved dependencies/security advisories, coherent dependency families, LICENSE/NOTICE and dependency inventory. Keep individual bot upgrade PRs outside this core decision list.
• Prepare artifacts in dependency order: shared Server/PD libraries → Java Client → Hubble/Loader; Python SDK → GraphMCP/AI. Test matching immutable packages/image digests instead of floating master/latest deployments.
• Qualify selected standalone/minimal-HStore/HA topologies and actual amd64/arm64 images/native loading. Restrict RISC-V claims to verified RocksDB-only support; measure any performance claims reproducibly.
• Close Doc #491: matching repository/website docs, English/Chinese migration/recovery and new API guides, 1.8 release notes, downloads/signatures and version navigation. Execute the documented commands against RC artifacts; pass site build/link/version/browser checks.
• Release Manager prepares the branch/tag/signing configuration; build and stage source/binary/Maven/Python/image artifacts, then validate source builds, provenance, signatures, SHA512 and staging contents. Complete the community vote before publishing and verify downloads/registries/images/site after publication. See the Apache release procedure.

Review findings and small fixes

New reviews cover default RocksDB multi-disk compatibility, multi-backend readiness scope, and the Java/Gremlin migration guide. The #3253 startup repair is included in the original PR.

#3253 verification: startup-script before/after tests cover default paths, absolute log overrides and custom JVM options; real JDK 11 opens the captured GC paths, and Fastjson 1.2.83 confirms safe mode. Formatting, shell syntax and diff checks pass. Full reactor compilation passes using pre-generated Java after verifying identical proto inputs; fresh native Protobuf generation remains unverified. Six current-head workflows were approved, but their outcome and full Store-cluster acceptance remain pending.

[SebastianGruza]

For the "1.7 -> 1.8 upgrade compatibility testing" section, please add #3224: a graph loaded on 1.7.0 through batch/loader sits under graph id 0xFFFE, and the first Store start with 1.8 jars (raft log replay) or the first batch write allocates a real id, after which everything older than the last snapshot is no longer visible; rolling the jars back does not help. Measured on a 1 PD + 3 Store lab in two variants; the /fix/update_graph_id workaround restores the data, but without a decision on the fix (adopt 0xFFFE at first allocation, or a migration endpoint) an in-place upgrade from 1.7.0 to 1.8 loses data. A harness to check any fix is in the validation repo (cycle4_graphid.sh, acceptance 16/16 without the remap).