feat(phase-6): implement production hardening, security remediation, and open standards

CHANGELOG.md

@@ -11,6 +11,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [1.1.0] - 2026-08-27
+
+### Added
+- **Persistent RSA Cryptography**: Load persistent 2048-bit RSA PEM key pairs (`certs/private.pem`, `certs/public.pem`) in `JwtConfig` with environment variable overrides for zero-session-loss restarts and multi-replica consistency.
+- **Environment-Driven CORS Allowlist**: Replaced wildcard CORS with explicit allowed origin configuration (`app.cors.allowed-origins`) across REST and WebSocket STOMP ingress.
+- **Real AWS SDK v2 S3/MinIO Storage Adapter**: Direct binary uploads and cryptographic pre-signed download URLs via AWS SDK v2 `S3Client` and `S3Presigner` with resilient offline fallback.
+- **IDOR Protection & Team Authorization Gates**: Enforced team membership validation across task read, update, status transition, assignment, and deletion endpoints.
+- **Vendor-Neutral OpenTelemetry (OTel)**: Integrated Micrometer Tracing bridge for OpenTelemetry with standard OTLP HTTP exporter (`io.opentelemetry:opentelemetry-exporter-otlp`), W3C TraceContext propagation, and local Jaeger all-in-one container.
+- **OpenAPI 3.1 Standards & Export**: Validated static `docs/api/openapi.yaml` specification with automated integration test verification (`OpenApiExportTest`).
+- **Bounded In-Memory Rate Limiting**: Upgraded in-memory rate limiter fallback to Caffeine cache with 50k LRU capacity and 5-minute TTL eviction.
+- **Resilience & Concurrency**:
+  - Configured connection (5s) and read timeouts on AI RestClient.
+  - Added RFC 7807 409 Conflict handler for `ObjectOptimisticLockingFailureException`.
+  - Added Hibernate `@SQLRestriction("deleted_at IS NULL")` on `Task` and `TaskComment` entities for automated soft-delete filtering.
+  - Aligned Java compilation target to Java 25 bytecode release.
+  - Expanded ArchUnit fitness rules for layer isolation and dependency decoupling.
+  - Removed `allow-bean-definition-overriding` to catch bean configuration collisions early.
+
+---
+
 ## [1.0.0] - 2026-08-23
 
 ### Added

build.gradle.kts

@@ -38,6 +38,7 @@ dependencies {
 
     // Database & Migrations
     runtimeOnly("org.postgresql:postgresql")
+    implementation("org.springframework.boot:spring-boot-starter-flyway")
     implementation("org.flywaydb:flyway-core")
     implementation("org.flywaydb:flyway-database-postgresql")
 
@@ -51,6 +52,14 @@ dependencies {
     // OpenAPI & Swagger
     implementation("org.springdoc:springdoc-openapi-starter-webmvc-ui:$springdocVersion")
 
+    // OpenTelemetry & Observability
+    implementation("io.micrometer:micrometer-registry-prometheus")
+    implementation("io.micrometer:micrometer-tracing-bridge-otel")
+    implementation("io.opentelemetry:opentelemetry-exporter-otlp")
+
+    // In-memory Cache & Rate Limiting Fallback
+    implementation("com.github.ben-manes.caffeine:caffeine")
+
     // Testing
     testImplementation("org.springframework.boot:spring-boot-starter-test")
     testImplementation("org.springframework.boot:spring-boot-starter-webmvc-test")
@@ -81,7 +90,7 @@ checkstyle {
 
 tasks.withType<JavaCompile> {
     options.encoding = "UTF-8"
-    options.release.set(21)
+    options.release.set(25)
     options.compilerArgs.addAll(listOf("-parameters"))
 }
 

docker-compose.yml

@@ -64,6 +64,17 @@ services:
       timeout: 5s
       retries: 5
 
+  jaeger:
+    image: jaegertracing/all-in-one:latest
+    container_name: taskmaster-jaeger
+    restart: unless-stopped
+    ports:
+      - "4317:4317"   # OTLP gRPC
+      - "4318:4318"   # OTLP HTTP
+      - "16686:16686" # Jaeger UI
+    environment:
+      COLLECTOR_OTLP_ENABLED: "true"
+
 volumes:
   postgres_data:
     name: taskmaster_postgres_data

docs/ROADMAP.md

@@ -42,35 +42,46 @@ A trackable overview of delivery milestones and planned capabilities for the Tas
   - Automated task description synthesis and executive comment summarization
   - Smart priority recommendations, duplicate task detection, and automatic tagging
 
+- ✅ **Phase 6: Production Hardening, Security Remediation & Open Standards**
+  - Persistent PEM-encoded RSA key pair for zero-session-loss restarts and multi-replica consistency
+  - Environment-driven CORS origin allowlist eliminating wildcard credential exposure
+  - Real AWS SDK v2 S3/MinIO durable file storage adapter with pre-signed URL offloading
+  - Team-scoped authorization checks preventing IDOR vulnerabilities across task operations
+  - Vendor-neutral OpenTelemetry (OTel) distributed tracing via standard OTLP protocol
+  - Validated OpenAPI 3.1 YAML specification (`docs/api/openapi.yaml`) with CI export verification
+  - Bounded Caffeine LRU cache fallback for sliding-window rate limiter
+  - Java 25 compiler bytecode release alignment and expanded ArchUnit regression rule suite
+  - Hibernate `@SQLRestriction` for automatic soft-delete query protection
+
 ---
 
 ## Advanced Horizons
 
-- ⬜ **Phase 6: Advanced Search & Analytics**
+- ⬜ **Phase 7: Advanced Search & Analytics**
   - Dedicated Elasticsearch cluster synchronization
   - Fuzzy typo-tolerant search and type-ahead auto-completion
   - Team velocity, cycle time, and workload distribution analytics
   - Event-sourced audit trail with full historical replay
 
-- ⬜ **Phase 7: Performance & Reliability**
+- ⬜ **Phase 8: Performance & Reliability**
   - Distributed Redis rate limiting with atomic Lua execution
   - Multi-tier caching with declarative invalidation
   - Circuit breaking and fault tolerance via Resilience4j
   - Idempotency key tracking for non-idempotent mutations
 
-- ⬜ **Phase 8: DevOps & Cloud Deployment**
+- ⬜ **Phase 9: DevOps & Cloud Deployment**
   - Multi-stage minimal containerization
   - Production Kubernetes manifests (Deployments, Services, HPA, ConfigMaps)
   - GitHub Actions automated CI/CD pipeline
   - Full observability stack (OpenTelemetry tracing, Prometheus metrics, Grafana dashboards)
 
-- ⬜ **Phase 9: Extended Platform Capabilities**
+- ⬜ **Phase 10: Extended Platform Capabilities**
   - Directed Acyclic Graph (DAG) task dependency engine with cycle detection
   - Recurring scheduled task engine
   - Kanban board drag-and-drop positional reordering
   - Webhooks dispatching system for external automation
 
-- ⬜ **Phase 10: Modern Collaborative Web Application (Frontend)**
+- ⬜ **Phase 11: Modern Collaborative Web Application (Frontend)**
   - Next.js (App Router) & React 19 single-page progressive web application
   - Responsive, accessible UI system using Tailwind CSS, Radix UI primitives, and Lucide icons
   - Interactive Kanban board with drag-and-drop state transitions (`@dnd-kit`)
@@ -86,4 +97,3 @@ A trackable overview of delivery milestones and planned capabilities for the Tas
 - ✅ Complete
 - 🔄 In Progress
 - ⬜ Planned
-

docs/adr/0006-opentelemetry-vendor-neutrality.md

@@ -0,0 +1,31 @@
+# ADR 0006: OpenTelemetry (OTel) Standard for Vendor-Neutral Observability
+
+## Status
+Accepted
+
+## Context
+Production-grade distributed systems require comprehensive observability across distributed tracing, application metrics, and structured log aggregation. Proprietary APM SDKs (e.g., Datadog, New Relic, Dynatrace, AWS X-Ray) create strong vendor lock-in, proprietary agent maintenance overhead, and steep licensing lock-in.
+
+In modern cloud-native architectures (2026 standard):
+- The **OpenTelemetry (OTel)** project governed by the Cloud Native Computing Foundation (CNCF) is the definitive industry standard for telemetry data generation and transmission.
+- Standard **OpenTelemetry Protocol (OTLP)** over HTTP/gRPC enables applications to export telemetry to any compliant collector, gateway, or visualization backend with zero code modifications.
+- Spring Boot provides first-class Micrometer Observation and OpenTelemetry tracing bridges (`micrometer-tracing-bridge-otel`, `opentelemetry-exporter-otlp`).
+
+## Decision
+We adopt **OpenTelemetry (OTel)** as the universal, vendor-neutral telemetry baseline for TaskMaster:
+
+1. **Standard OTLP Export**: The application runtime exports distributed traces via standard OTLP HTTP/gRPC (`management.otlp.tracing.endpoint: ${OTEL_EXPORTER_OTLP_ENDPOINT:http://localhost:4318/v1/traces}`).
+2. **Context Propagation (W3C TraceContext)**: Standard W3C `traceparent` and `tracestate` headers propagate across HTTP and WebSocket STOMP boundaries, coupled with MDC correlation IDs (`X-Correlation-ID`) for unified trace-to-log correlation.
+3. **Pluggable Collector & Backend Architecture**:
+   - **Local & Open-Source**: Zero-cost Jaeger all-in-one or OpenTelemetry Collector deployed via Docker Compose.
+   - **Cloud Free-Tiers**: Drop-in compatible with Grafana Cloud, SigNoz, or Honeycomb free tiers.
+   - **Enterprise Production**: Direct export to Datadog, Dynatrace, AWS X-Ray, or GCP Cloud Trace by changing only the environment variable endpoint.
+
+## Consequences
+### Positive
+- **Zero Vendor Lock-In**: Telemetry backends can be swapped or multi-cast at the collector tier without recompiling or redeploying application code.
+- **Unified Tracing & Logging**: MDC `correlationId` and OTel `traceId`/`spanId` provide end-to-end request visibility across REST controllers, domain event listeners, and WebSocket STOMP dispatchers.
+- **Low Overhead**: Native Micrometer Tracing bridge introduces negligible CPU and memory footprint on virtual thread execution.
+
+### Considerations
+- Sampling probability is configurable via `management.tracing.sampling.probability` to balance observability detail with network/storage bandwidth in high-throughput environments.

docs/adr/0007-free-tier-pluggable-infrastructure.md

@@ -0,0 +1,30 @@
+# ADR 0007: Pluggable Free-Tier & Open-Source First Infrastructure Strategy
+
+## Status
+Accepted
+
+## Context
+Deploying, developing, and evaluating modern cloud-native systems requires minimizing operational friction, licensing barriers, and proprietary infrastructure dependencies while preserving seamless forward compatibility with managed enterprise cloud platforms.
+
+Developers and operators need:
+1. **Zero-Cost Local Development Parity**: 100% functional local execution without requiring paid cloud accounts, proprietary APIs, or active credit card billing.
+2. **Open-Source Defaults**: Industry-standard open-source components for storage, relational data, caching, telemetry, and artificial intelligence.
+3. **Frictionless Enterprise Upgrades**: One-line configuration switches to upgrade to high-availability managed cloud equivalents without code changes.
+
+## Decision
+We adopt a **Pluggable Free-Tier & Open-Source First Infrastructure Strategy** across all core platform capabilities:
+
+| Domain | Open-Source / Free-Tier Default | Enterprise / Managed Equivalent | Switch Mechanism |
+|:---|:---|:---|:---|
+| **AI Engine** | Groq Cloud (`llama-3.3-70b` free tier), Google Gemini (`gemini-2.5-flash` free tier), Local Ollama (`llama3.2` 100% offline) | OpenAI GPT-4o, Anthropic Claude, Enterprise AI Gateways (LiteLLM/Portkey) | Environment variables (`AI_BASE_URL`, `AI_API_KEY`, `AI_MODEL`) |
+| **Object Storage** | MinIO (100% open-source S3 API) via Docker Compose | AWS S3, Cloudflare R2, Google Cloud Storage | Environment variables (`AWS_S3_ENDPOINT`, `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`) |
+| **Relational Database** | PostgreSQL 17 (open-source) via Docker Compose / Neon Serverless (free tier) | AWS Aurora PostgreSQL, Google Cloud SQL, Azure Database for PostgreSQL | JDBC URL & Spring profile (`application-prod.yml`) |
+| **Cache & Limiting** | Redis 7 (open-source) via Docker Compose / Upstash Redis (free tier) | AWS ElastiCache for Redis, Redis Enterprise Cloud | Connection host & password environment variables |
+| **Observability** | OpenTelemetry + Jaeger / Prometheus / Grafana Loki (open-source) | Grafana Cloud, Datadog, Dynatrace, New Relic | Standard OTLP endpoint (`OTEL_EXPORTER_OTLP_ENDPOINT`) |
+| **API Contract** | OpenAPI 3.1 static YAML & Swagger UI (open-source) | Postman Enterprise, Stoplight, SwaggerHub | Standard `docs/api/openapi.yaml` |
+
+## Consequences
+### Positive
+- **Instant Developer Onboarding**: A complete development environment starts with a single command (`docker compose up -d && ./gradlew bootRun`) with zero external API dependencies.
+- **Predictable Cost Control**: Development, staging, and continuous integration pipelines operate at zero cloud infrastructure cost.
+- **Portability**: The application runs identically on bare metal, local laptops, Kubernetes, AWS, GCP, or Azure.