Veritas Kanban 6.1.2 completes the repository-wide reliability, security, storage, provider-runtime, CI, container, and supportability audit. It is a backward-compatible patch release for 6.1.1 with no public API or SQLite schema-version change.

## What changed

- **One runtime data root.** Paths, migration, backup, integrity, health, and Docker mounts use the canonical `DATA_DIR` contract.
- **Storage boundary restored.** File and SQLite repositories own containment, locking, atomicity, and compatibility behavior.
- **Explicit provider adapters.** Launch, probes, events, completion, mutation, and stop behavior fail closed without implicit fallback.
- **One authenticated API client.** JSON, blob, stream, and download operations preserve credentials, base paths, and error envelopes.
- **Milestone-scoped tests.** Ordinary pull requests stay fast; complete test and artifact gates run at declared integration and release milestones.
- **Continuous supply-chain controls.** CodeQL, dependency alerts, secret scanning, immutable actions, and policy guards remain active.
- **Resolved CodeQL baseline.** Reviewed all 195 initial alerts: fixed 67, dispositioned 128, and left zero open on the default branch.
- **Measured production container.** The non-root runtime closure verifies health, auth, SQLite, static web, data paths, and size ceilings.
- **Lower maintenance debt.** Four unused dependencies were removed and the server warning budget fell from 600 to 458.
- **Coordinated security hardening.** The private remediation is integrated; disclosure remains gated on supported artifacts and approval.
- **Release-gate corrections.** Runtime boundary behavior now matches its checked-in contracts.

## Issue and pull request traceability

| Audit issue | Outcome | Pull requests |
| --- | --- | --- |
| #1162 | Canonical runtime data paths and legacy compatibility | #1184 |
| #1163 | Service/storage boundary restored across persisted domains | #1190-#1220 |
| #1164 | Provider and attempt lifecycle decomposition | #1223-#1230 |
| #1165 | Credential-aware frontend API migration | #1218 |
| #1166 | Production Docker size and runtime contract | #1222 |
| #1167 | Immutable GitHub Actions | #1179 |
| #1168 | Continuous security scanning | #1180 |
| #1169 | Critical-path coverage baselines and ratchets | #1183 |
| #1170 | Unused dependency removal | #1217 |
| #1171 | Native-loader-compatible Vite and Vitest configuration | #1178 |
| #1172 | Deterministic, milestone-scoped test gates | #1175, #1177, #1181, #1228 |
| #1173 | Server type-safety lint-debt ratchet | #1221 |
| #1231 | Initial CodeQL alert baseline resolved | #1232-#1235 |
| #1238 | Recovery-key alphabet and WebSocket header forwarding | #1239 |
| #1240 | Same-task lifecycle invocation ordering | #1241 |
| #1242 | Sanitized URI prefix validation | #1243 |

## Install or upgrade

Back up the complete stopped-writer workspace before upgrading and retain the backup until the new runtime is accepted.

```bash
brew update
brew upgrade --cask bradgroux/tap/veritas-kanban
```

For a first installation:

```bash
brew install --cask bradgroux/tap/veritas-kanban
```

The Assets section provides signed and notarized macOS arm64 DMG and ZIP packages after the release workflow completes. Linux and Windows packages remain unsigned verification previews.

## Compatibility, migration, and rollback

The public REST API remains `v1`, and SQLite schema migrations remain at 30 through 33. Upgrading from 6.1.1 does not run a new schema migration. Runtime path normalization can migrate legacy files into the configured canonical data directory; operators should verify the data root, health, backup, and integrity evidence before resuming automation.

Rollback is restore-first. Stop every writer, reinstall 6.1.1 only when its data contracts remain compatible, and otherwise restore the complete stopped-writer pre-upgrade workspace. Never copy an older database over a running instance.

See the [full release notes](https://github.com/BradGroux/veritas-kanban/blob/v6.1.2/docs/V6-RELEASE-NOTES.md), [upgrade guide](https://github.com/BradGroux/veritas-kanban/blob/v6.1.2/docs/V6-UPGRADE-INSTALL-ADMIN-GUIDE.md), [compatibility policy](https://github.com/BradGroux/veritas-kanban/blob/v6.1.2/docs/V6-COMPATIBILITY-AND-RELEASE-POLICY.md), and [changelog](https://github.com/BradGroux/veritas-kanban/blob/v6.1.2/CHANGELOG.md).
