[1.8.0] Release TODOs and cross-repository integration checklist

[imbajin]

Release scope

Validate the selected 1.8.0 mainline and matching RC artifacts: Server/Toolchain/Doc master, AI main. The 1.7 → 1.8 path is an upgrade-compatibility gate.

This tracker focuses on release decisions and core correctness. Individual dependency-update PRs have been removed; dependency security, resolved-package compatibility and LICENSE/NOTICE remain release gates.

Audit / scoring policy

Scores are merge-quality judgments out of 10 covering correctness, compatibility/security, verification, documentation and scope. They are separate from release importance. ✅ Merge candidate means a candidate scoring at least 8.5 whose listed conditions still need confirmation; it is not an approval, a CI waiver, a merge, or RC acceptance. Re-review after a head change. Known code regressions remain Fix required, even with green CI.

Priority / decision summary

Priority	Core work / reviewed head	Quality	Decision and next action
P0 — upgrade blocker	HStore graph-ID compatibility #3224	—	No fix PR. Require transparent compatibility or a verified migration/recovery procedure before allowing a 1.7→1.8 HStore upgrade. Test startup Raft replay as well as the first write, old/new rows, every replica and rollback.
P1 — security / bounded completion	Auth bootstrap #3192 · 0be7fde7	8.3	Pending confirmation. Current-head CI is green and the helper shell suite passes. Document one-sided-auth rejection and unsupported config syntax, align the stale propagation/WARN description, and verify the supported mounted-config/whole-install-volume upgrade layouts. An old whole-directory volume can retain the old entrypoint as well as hide new helpers; do not assert that every such upgrade executes the new entrypoint and immediately fails.
P1 — query correctness	Cross-label index coverage #3243 · 0de33eda	7.8	Pending re-review. Current head 7f5a9173 differs from the scored head: visibility/DELETING and Example1 repairs are present and current-head CI/coverage passes. The new mixed composite/joint coverage-test review remains open. Author reports 79 combined RocksDB cases with #2994; current-head HStore/full TinkerPop acceptance and repository/paired Doc #503 delivery still need confirmation.
P1 — query correctness	Label/condition semantics #2994 · 2cbd5d71	7.8	Fix required; new head pending re-review. At 23cb5f07, the earlier trailing-step finding is repaired, but the new wrapper-step review still identifies local/optional/coalesce/union/choose/map/flatMap and math planning changes. Current patch coverage fails. Finish docs and qualify combined #3243 HStore/TinkerPop behavior; reported targeted RocksDB results are not full RC acceptance.
P1 — distributed schema correctness	Schema convergence #3237 · 8d6e1868	6.8	Design/fix required. Schema mutation and version publication are not atomic; crash and graph-drop ordering gaps remain. The proposed push/lease protocol is not implemented. Split independent PD/HStore durability, ID and authentication-prefix repairs for bounded review; coordinate Doc #498.
P1 — API compatibility	Cypher error metadata #3241 · ed8344d1	5.8	Fix required. Top-level errors breaks existing Java Client/Hubble deserialization even on success. Preserve the response envelope, classify real parse errors and remove unsupported parameter hints; add matching repository docs. Doc #499 must distinguish Apache mainline from unmerged fork parameter-binding capabilities.
P1 — packaged startup regression	Startup path overrides #3253 · 8de1ddcf	6.7	Partially fixed; further fixes required. The bounded 8de1ddcf repair restores Store Fastjson safe mode and ${LOGS} GC paths; current-head CI and both coverage checks pass. External init/config and relative graph-directory propagation, plugin writability, restart getopts, monitor propagation, relative paths and deployment docs remain open.
P1 if deployment is included	Helm #3218 · 0e754b98	8.7	Pending re-review. Current head d05741d9 differs from the scored head; lint-and-render passes while other current-head CI remains in progress. Confirm the updated organization-fork review disposition, coverage and paired Doc #494 at ed90090e. Keep manual Store restore/replacement and same-RC upgrade/HA gates.
P1 if deployment is included	Readiness #3221 · 7fa80208	7.8	Pending re-review. Current head 6cdd6ce9 differs from the scored head. The author reports rebase, every-distinct-remote-configuration probes, HBase enabled/available checks, API-test and deferred-channel-shutdown repairs; current-head CI/coverage passes. The k3s battery was not rerun. Confirm review closure, endpoint/config docs and real multi-backend/failure behavior on the RC; the HStore ping still does not verify the Raft/data path.
P2 — optional feature bundle	DECIMAL Server #3209 · d7eb80c8; Client/Loader #771 · 991a97f7	7.8 / 7.0	Fix or explicitly defer; new heads pending re-review. Server 371275c0, Client/Loader 5255714c and Doc #504 2c8bcbe5 differ from the scored heads. Authors report userdata-reload/OBJECT/CONTAINS and mapping/string-ID repairs plus targeted RocksDB/HStore tests. Server HStore CI and RocksDB Core each report 817 errors, repeatedly failing to remove fee while account uses it; other Server backend jobs and project coverage are red. Qualify the paired bundle and review the added OBJECT serialization fix; author tests do not close the full-suite failures. Doc #504 remains on hold until both code PRs are safe.
P2 — optional backend	ToplingDB #3134 · 30a949bc	6.7	Fix or explicitly defer. At 30a949bc, the RocksDB runtime rerun now passes in Apache #3134 and fork #179. Apache dependency-review and patch coverage still fail. The default RocksDB data_disks regression remains open; preserve default-provider compatibility, trim unrelated changes and qualify Linux JNI provenance, migration and release artifacts.
P2 — optional platform migration	Java/Groovy/TinkerPop #3117 · af6ecb84	7.1	Scope decision required. Still draft/conflicting with no current-head CI. POMs select Java 17 / Groovy 4.0.25 / TinkerPop 3.8.1, despite the older PR description. Ship mounted Gremlin-config and Client migration guidance, qualify sandbox/serialization/PD/Store/HStore behavior, or defer the bundle.
P2 — root-cause verification	Loader #710 · c6a2b0d2	6.7	Reproduce before fixing. Null guards do not establish the concurrent fetch/reset/close root cause; unrelated HDFS fixture changes increase scope. Resolve conflicts and verify actual parallel local/HDFS import behavior.

Companion documentation

PR / reviewed head	Quality	Decision
Doc #503: cross-label guidance · 1e679825	8.7	Pending re-review (coordinate with #3243). Current head c87d2497 differs from the scored head. Candidate/type/visibility wording and bilingual formatting were revised; the exact PRIMARY_KEY-condition review remains open. No current-head workflow result is available; publish with the qualified code change.
Doc #494: Helm/recovery · c4ed3619	8.5	Pending re-review (coordinate with #3218). Current head ed90090e differs from the scored head; Version builds including Build latest now pass, while aggregate CI remains in progress. Confirm operational wording and updated Helm compatibility, then complete site checks.
Doc #504: DECIMAL · 4e4d3f16	8.1	On hold; new head pending re-review. At 2c8bcbe5, the author added type-use limits and the release qualifier in both languages. Number/string inputs versus string outputs remain documented; publication awaits safe Server #3209 and Toolchain #771. No current-head workflow result is available.
Doc #498: schema cache · 05437da0	7.9	Incomplete. State applicability and full option bounds; do not describe the unimplemented convergence protocol as available.
Doc #499: Cypher · 3599a2bd	6.8	Fix required; new head pending re-review. At 6f52040d, release/fork request-form provenance was revised, but write-example schema compatibility and released-version migration guidance reviews remain open. No current-head workflow result is available; do not carry forward the old missing-script failure as its current CI result.

Essential unresolved issues and acceptance

Upgrade and recovery

• [Bug] HStore: data written by 1.7.0 under the missing graph id 0xFFFE becomes unreachable once master allocates a real graph id (raft log replay at the upgrade restart, or the first batch write); no migration path for #3153 #3224: verify 1.7 batch/Loader rows under 0xFFFE after startup Raft replay and after the first client write; cover snapshots, old/new rows and every replica. The reported remap workaround is per-replica, single-graph-limited and can hide intervening rows under a new ID. Rolling back jars alone does not undo persisted mappings. The public report shows data becoming unreachable, not proven permanent data loss; maintainer RC acceptance remains required.
• Fail fast for incompatible HStore serializers (#3225); require serializer=binary before writes.
• Resolve or explicitly document deployment recovery boundaries for PD snapshot error #3222, PD RocksDB-open failure #3226, Gremlin binding after PD outage #3228, Store restore readiness #3229, and remaining PD task no-op/follower distinctions #3231. Helm workarounds do not fix the underlying service behavior.
• Test retained data/Schema, init_store.enabled, credentials/secrets, metadata cluster prefixes, backup and rollback. Validate empty-volume Store replacement, old Store-ID retirement, PD leader changes and DNS/connection recovery within the selected topology.

Query and cross-repository contracts

• Run combined fix(server): clarify condition resolution semantics for label queries #2994/fix(server): reject incomplete cross-label index coverage #3243 regressions on the selected RC: nested/negative predicates, count, deletion races, range-index ordered scans, partitions, limits/offsets/pages/cursor recovery and duplicate/missing rows. Enable the new ordered-scan protocol only after every Store is upgraded; verify mixed-version rejection.
• Keep HStore contract/tests #3090 scoped: codec/lifecycle exclusions remain; corrected historical scan claims are not current reproduced master failures.
• Verify REST/Gremlin, Java Client/Hubble, Loader and Python/GraphMCP contracts against one RC set, including non-default GraphSpace and unauthorized rejection. Correct Client timeout units and verify Loader concurrency; resolve AI partial-import #373 with explicit property/endpoint diagnostics.
• Validate Hubble V2 English/Chinese permissions, standalone/PD discovery, H2 migration and import-task recovery; distinguish Server user auth, PD service auth and Hubble Operations credentials.
• Validate GraphMCP/Skills installation and controlled-write expiration/replay/restart behavior, retaining documented disabled operations and the single SQLite writer boundary. Prepare Python SDK before MCP artifacts; source versions and TestPyPI do not establish production publication.
• Run GraphRAG/Text2Gremlin/extraction regressions for input/chunking, IDs/Schema, streaming duplicate execution and credential isolation. Define any text2gql branch feature/artifact inclusion explicitly; it is not automatically mainline functionality.

Completed code is not RC acceptance

Verified merged work includes inactive redirect removal (#3246) and Toolchain/Ask AI documentation (Doc #506/#505), alongside paging/retry/batching and HStore pushdown/snapshot/watch repairs (#3207/#3204/#3193/#3184/#3164/#3157), Store rejoin and PD APIs (#3234/#3232/#3233), scheduler/election cleanup (#3244), GraphMCP/Skills and Python/Vermeer fixes (AI #374/#375), and bilingual core/PD-auth guidance (Doc #501/#502). Retain combined RC regression. SeaTunnel integration and documentation are complete. SeaTunnel 3.0.0 was officially released on 2026-09-29: official downloads and 3.0.0 release notes.

Final release gates

• Freeze repository inclusion/exclusions, owners, source commits/tags and RC artifacts; update selected repository versions to 1.8.0. Optional features and speculative optimizations must not silently become release blockers.
• Verify resolved dependencies/security advisories, coherent dependency families, LICENSE/NOTICE and dependency inventory. Keep individual bot upgrade PRs outside this core decision list.
• Prepare artifacts in dependency order: shared Server/PD libraries → Java Client → Hubble/Loader; Python SDK → GraphMCP/AI. Test matching immutable packages/image digests instead of floating master/latest deployments.
• Qualify selected standalone/minimal-HStore/HA topologies and actual amd64/arm64 images/native loading. Restrict RISC-V claims to verified RocksDB-only support; measure any performance claims reproducibly.
• Close Doc #491: matching repository/website docs, English/Chinese migration/recovery and new API guides, 1.8 release notes, downloads/signatures and version navigation. Execute the documented commands against RC artifacts; pass site build/link/version/browser checks.
• Release Manager prepares the branch/tag/signing configuration; build and stage source/binary/Maven/Python/image artifacts, then validate source builds, provenance, signatures, SHA512 and staging contents. Complete the community vote before publishing and verify downloads/registries/images/site after publication. See the Apache release procedure.

Review findings and small fixes

New reviews cover default RocksDB multi-disk compatibility, multi-backend readiness scope, and the Java/Gremlin migration guide. The #3253 startup repair is included in the original PR.

#3253 verification: startup-script before/after tests cover default paths, absolute log overrides and custom JVM options; real JDK 11 opens the captured GC paths, and Fastjson 1.2.83 confirms safe mode. Formatting, shell syntax and diff checks pass. Full reactor compilation passes using pre-generated Java after verifying identical proto inputs; fresh native Protobuf generation remains unverified. Current-head CI, CodeQL and coverage now pass at 8de1ddcf; unresolved configuration/restart/monitor reviews and full Store-cluster acceptance remain separate gates.

Doc #505/#506 are included in the successful 2026-10-02 master site publication, head 3e8d3e33. That workflow does not verify a real CAPTCHA-backed answer or same-RC distributed integration.

The proposed shared-foundation migration #260 is implemented in the community fork, but inclusion remains undecided. At d7a722a1, current Server and PD logs fail compilation because ApplicationConfig.java imports the unavailable HugeException; current Cluster CI fails, rather than retaining the previous head’s cancellation status. StringId comparison, paired website docs and downstream publication/Java-SPI/coordinated-upgrade qualification remain required. Local evidence tied to earlier 308276fc does not certify this head.

[SebastianGruza]

For the "1.7 -> 1.8 upgrade compatibility testing" section, please add #3224: a graph loaded on 1.7.0 through batch/loader sits under graph id 0xFFFE, and the first Store start with 1.8 jars (raft log replay) or the first batch write allocates a real id, after which everything older than the last snapshot is no longer visible; rolling the jars back does not help. Measured on a 1 PD + 3 Store lab in two variants; the /fix/update_graph_id workaround restores the data, but without a decision on the fix (adopt 0xFFFE at first allocation, or a migration endpoint) an in-place upgrade from 1.7.0 to 1.8 loses data. A harness to check any fix is in the validation repo (cycle4_graphid.sh, acceptance 16/16 without the remap).