v1.0.0 post-release stabilization backlog

[0sm0s1z]

Objective

Track hotfixes and regressions discovered immediately after the v1.0.0 launch.

Intake rules

• Add only production-impacting issues discovered after release.
• Link each item to a reproducible report and owner.
• Prioritize P0/P1 first and document mitigation/rollback steps.

Initial checklist

• Confirm no critical regressions in core scan workflow
• Confirm UI/API/Engine startup reliability in production-like environment
• Confirm release image consumption guidance is clear (latest vs version tag)
• Track and resolve any release follow-up CI/CD reliability items

References

• PR: Release: merge v1 into main for 1.0.0 #90
• Release: https://github.com/SiriusScan/Sirius/releases/tag/v1.0.0

[0sm0s1z]

Added concrete post-release regression issues from recent scanner stabilization debugging:

• Dev overlay startup scripts break on Windows due CRLF shell incompatibility #100 Dev overlay startup scripts break on Windows due CRLF shell incompatibility
• sirius-ui dev startup does not guarantee Prisma schema and seed initialization #101 sirius-ui dev startup does not guarantee Prisma schema and seed initialization
• Dev compose uses inconsistent POSTGRES_PASSWORD values across services #102 Dev compose uses inconsistent POSTGRES_PASSWORD values across services
• sirius-engine dev volume mounts can shadow required assets and cause restart loops #103 sirius-engine dev volume mounts can shadow required assets and cause restart loops
• Scan can remain stuck in running when source-aware API submission returns 401 #104 Scan can remain stuck in running when source-aware API submission returns 401
• SIRIUS_API_KEY drift across services causes internal 401 failures #105 SIRIUS_API_KEY drift across services causes internal 401 failures

Duplicate/overlap identified in existing reports:

• Sirius-engine container logs issue #91 and Error database and scan hosts #98 look like the same CVE migration failure cluster; recommend consolidation.

[0sm0s1z]

Update: The core scan workflow regression has been resolved.

Closed related issues:

• SIRIUS_API_KEY drift across services causes internal 401 failures #105 (API key drift causing 401s) -- Root cause: engine built scanner from old commit without X-API-Key header
• Dev compose uses inconsistent POSTGRES_PASSWORD values across services #102 (Postgres password drift) -- Unified .env secrets management
• sirius-ui dev startup does not guarantee Prisma schema and seed initialization #101 (Prisma seed initialization) -- Startup preflight guarantees
• Redis Password #83 (Redis/Valkey password) -- Installer auto-generates credentials

The scan pipeline now properly authenticates, persists host/vulnerability data, and transitions to "completed" status in the UI.