Release 4.0.0

.dockerignore

@@ -1,7 +1,13 @@
-# Root .dockerignore — reduces build context for frontend Dockerfile
-# (which uses context: . to access VERSION file from repo root)
+# Root .dockerignore — governs every image built with context: . , which is now
+# the frontend AND the backend targets (api/worker/beat). Both need the repo-root
+# VERSION file, which cannot be reached from a context rooted inside their own
+# directory.
 #
-# The backend/ and bnk-operator/ have their own .dockerignore files.
+# backend/.dockerignore no longer takes effect for those builds — Docker only
+# reads the ignore file at the context root — so the backend-specific exclusions
+# that still matter are reproduced below with a backend/ prefix.
+#
+# bnk-operator/ still builds with its own context and its own .dockerignore.
 
 # Version control
 .git/
@@ -31,16 +37,33 @@ htmlcov/
 .ruff_cache/
 .mypy_cache/
 backend/.venv/
+backend/venv/
+backend/env/
 backend/tests/
 bnk-operator/tests/
 
+# Local runtime data under backend/ — mounted as volumes in production, never
+# part of an image. Previously excluded by backend/.dockerignore.
+backend/projects/
+backend/keys/
+backend/state/
+backend/workspaces/
+backend/helm_charts/
+
 # Node artifacts (frontend has its own context via COPY)
 frontend-v2/node_modules/
 frontend-v2/dist/
 
 # Environment files (secrets!)
+# OPS-004: exclude ALL .env files so they never enter a build context. These
+# patterns have no path prefix, so they match <root>/.env only — they do NOT
+# descend into backend/. The backend/ forms below carry over the rules from the
+# deleted backend/.dockerignore, which is the one set that did not come across
+# with the venvs and runtime dirs.
 .env
 .env.*
+backend/.env
+backend/.env.*
 secrets/
 
 # Test artifacts

.env.example

@@ -88,6 +88,26 @@
 # MCP_SERVICE_PASSWORD=mcp-service-changeme
 # DEFAULT_ADMIN_PASSWORD=changeme
 
+# ============================================================================
+# BENCHMARK AGENT AUTHENTICATION
+# ============================================================================
+#
+# The agent-facing endpoints (POST /api/benchmarks/results, /results/aiperf,
+# /agents) require an agent-class bearer token by default. Accepted roles:
+# agent (provisioned agents + the built-in agent's bootstrap token), operator,
+# admin. A viewer token authenticates but may not write here.
+#
+# The built-in forge-agent needs no setup: the backend mints a bootstrap token
+# into a dedicated volume (bnk-forge-agent-token) at startup and
+# docker-compose.yml mounts that volume, read-only, into the agent. External agents get a token from the provisioning flow
+# (or set FORGE_AGENT_TOKEN to hand one to the built-in agent explicitly).
+#
+# Set to false ONLY on a trusted network where you want the open curl flow;
+# it re-opens unauthenticated writes to those three endpoints.
+#
+# BENCHMARK_AGENT_AUTH_REQUIRED=true
+# FORGE_AGENT_TOKEN=
+
 # ============================================================================
 # BRANDING (Frontend logo: F5 ball or neutral Forge anvil)
 # ============================================================================

.github/BRANCH_PROTECTION.md

@@ -75,7 +75,7 @@ Release: Version bump + tag + changelog          [manual, requires CI Gate]
 | `P2 · Proxy Config` | No (aggregated) | Nginx config via `make test-proxy` |
 | `P2 · DB Migrations` | No (aggregated) | Migration tests via `make test-db` |
 | `P2 · Build · Frontend` | No (aggregated) | Build check via `make build-frontend-check` |
-| `P3 · Integration Tests` | No (aggregated) | Integration tests via `make test-integration-full` |
+| `P3 · Integration Tests` | No (aggregated) | Integration tests via `make test-integration` + `make test-integration-full` (complementary marker sets — both are needed to cover `tests/integration/`) |
 | `P4 · Security Audit` | No (aggregated) | pip-audit + npm audit via `make security-audit` |
 | `P4 · Docker Build + Scan` | No (aggregated) | Docker build + Trivy scan |
 | `P5 · E2E Tests` | ❌ No | Manual/nightly only |

.github/PULL_REQUEST_TEMPLATE.md

@@ -4,6 +4,11 @@ A clear and concise description of the changes in this Pull Request.
 
 Fixes / Implements: #[Issue Number]
 
+<!-- Use "Fixes #N" (or Closes/Resolves) when this PR should CLOSE the issue on
+     merge to staging -- the auto-close Action matches those keywords, including
+     in the "Fixes / Implements: #N" form above. Use "Refs #N" for a partial fix
+     that must leave the issue open. "Implements: #N" alone does not close. -->
+
 ---
 
 ## Architectural Decision Record (ADR)

.github/workflows/auto-close-issues-on-staging-merge.yml

@@ -51,13 +51,44 @@ jobs:
           import os, re
           body = os.environ.get("PR_BODY") or ""
           repo = os.environ["REPO"]
+          # Neutralise fenced blocks and inline code spans BEFORE scanning. A PR
+          # that documents closing keywords (a parser change, a template change,
+          # a how-to) otherwise closes the issues it is merely talking about --
+          # #158's own description parsed as issues=94 128 7, two of them open
+          # with their real fixes still unmerged. Fences first (they may contain
+          # backticks), then spans. Both fence styles -- ``` and ~~~ -- since ~~~
+          # is what an author reaches for when the example itself contains
+          # backticks, i.e. exactly the case this exists for. Like-to-like: a
+          # ~~~ block must close with ~~~ (backreference), so a stray ~~~ cannot
+          # "close" a ``` fence and over-strip.
+          #
+          # Replace with a NON-WHITESPACE sentinel, never ''. Deleting the code
+          # outright glues a keyword onto a following reference -- "Fixes `x`
+          # #94" becomes "Fixes  #94" and the [:\s]* separator swallows the
+          # gap -- a NEW false-close the pre-stripping parser never produced.
+          # The sentinel cannot be eaten by the separator or the "/ Implements"
+          # skip, so the barrier survives; a real "Fixes #94" in prose is
+          # unaffected because it contains no code to replace.
+          #
+          # Indented (4-space) code blocks are NOT neutralised: they need a
+          # line-based pass and nobody in this repo writes them. Known
+          # safe-direction gap: an unbalanced backtick in prose can swallow a
+          # real closing line -> the issue simply stays open (the pre-Action
+          # status quo).
+          CODE = "\u2400"  # U+2400 SYMBOL FOR NULL: non-whitespace, never in a ref
+          body = re.sub(r'(```|~~~).*?\1', CODE, body, flags=re.S)
+          body = re.sub(r'`[^`]*`', CODE, body)
           kw_pat = re.compile(r'(?i)\b(?:close|closes|closed|fix|fixes|fixed|resolve|resolves|resolved)\b')
           ref_pat = re.compile(r'([A-Za-z0-9._-]+/[A-Za-z0-9._-]+)?#(\d+)')
           sep_pat = re.compile(r'[ \t,]+')
           out=[]; seen=set()
           for m in kw_pat.finditer(body):
               i = m.end()
-              i += re.match(r'[:\s]*', body[i:]).end()
+              # Accept the PR template's own line, "Fixes / Implements: #N":
+              # allow an optional "/ Implements" (or "/ Closes" etc.) between the
+              # keyword and the reference. Before this, the template form matched
+              # NOTHING and every issue had to be closed by hand.
+              i += re.match(r'(?i)[:\s]*(?:/\s*(?:implements|closes|fixes|resolves)\s*)?[:\s]*', body[i:]).end()
               while True:
                   r = ref_pat.match(body, i)
                   if not r: