From dd7aaf4bb811f8ed4d8b8a9fbe1a92c2155864d9 Mon Sep 17 00:00:00 2001
From: Colin Smith <7762103+colinmxs@users.noreply.github.com>
Date: Tue, 30 Jun 2026 15:56:53 -0700
Subject: [PATCH] Release/1.0.3 (#527)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Patch release 1.0.3 — maintenance only, no application code or user-facing
  behavior changes. Operators on 1.0.x upgrade in place (no migration).

  CI/CD (#524, #525):
  - Serialize platform.yml + backend.yml under one repo-global concurrency
    group (deploy-<ref>) so a CFN deploy and the API-driven backend code
    deploys can't run concurrently and stomp the same ECS service /
    AgentCore Runtime / Lambda. Frontend stays independent.
  - Re-enable push-triggered, path-scoped deploys for platform/backend/frontend
    (develop → dev env, main → prod), after being workflow_dispatch-only since v1.0.0.
  - Extract duplicated test gates into a reusable tests.yml; fix skipped
    single-suite job labels rendering raw ${{ }} expressions.
  - Prune dead nightly tracks + orphaned scripts; docs-deploy now publishes
    from main; fork-gate docs-deploy and release.

  Security & deps (#526):
  - joserfc 1.6.3 → 1.7.2 (GHSA-wphv-vfrh-23q5 / CVE-2026-48990).
  - Remove unused imports flagged by CodeQL (Optional, ssm).

  Also bumps VERSION/manifests/lockfiles to 1.0.3, adds brief RELEASE_NOTES.md
  and CHANGELOG.md entries, and updates the release-notes steering doc to scale
  write-up depth to release size (brief patches, deep feature releases).
---
 .github/docs/NIGHTLY-BUILD-QUICK-REF.md       |  15 +-
 .github/docs/NIGHTLY-BUILD.md                 |  32 +--
 .github/workflows/backend.yml                 |  56 ++--
 .github/workflows/ci.yml                      |  60 +---
 .github/workflows/docs-deploy.yml             |   6 +-
 .github/workflows/frontend-deploy.yml         |  33 +--
 .github/workflows/nightly-deploy-pipeline.yml |  73 +----
 .github/workflows/nightly.yml                 | 128 +--------
 .github/workflows/platform.yml                |  52 ++--
 .github/workflows/release.yml                 |   2 +
 .github/workflows/tests.yml                   | 101 +++++++
 .kiro/steering/release-notes.md               |  23 ++
 CHANGELOG.md                                  |  20 ++
 README.md                                     |   4 +-
 RELEASE_NOTES.md                              |  33 +++
 VERSION                                       |   2 +-
 backend/pyproject.toml                        |   2 +-
 backend/src/agents/main_agent/agent_types.py  |   2 +-
 backend/uv.lock                               |   8 +-
 frontend/ai.client/package-lock.json          |   4 +-
 frontend/ai.client/package.json               |   2 +-
 .../constructs/app-api/app-api-environment.ts |   2 -
 infrastructure/package-lock.json              |   4 +-
 infrastructure/package.json                   |   2 +-
 scripts/backup-data/uv.lock                   |   6 +-
 scripts/build/build-and-push-if-changed.sh    |   4 +-
 scripts/common/promote-ecr-image.sh           | 110 --------
 scripts/nightly/ai-coverage-analysis.py       | 256 ------------------
 28 files changed, 290 insertions(+), 752 deletions(-)
 create mode 100644 .github/workflows/tests.yml
 delete mode 100755 scripts/common/promote-ecr-image.sh
 delete mode 100755 scripts/nightly/ai-coverage-analysis.py

diff --git a/.github/docs/NIGHTLY-BUILD-QUICK-REF.md b/.github/docs/NIGHTLY-BUILD-QUICK-REF.md
index 4a979ca8a..74871e97f 100644
--- a/.github/docs/NIGHTLY-BUILD-QUICK-REF.md
+++ b/.github/docs/NIGHTLY-BUILD-QUICK-REF.md
@@ -19,14 +19,15 @@ Go to: **Actions** → **Nightly Build & Test** → **Run workflow**
 | `test-backend-<branch>` | Backend tests + coverage against `<branch>` |
 | `test-frontend-<branch>` | Frontend tests + coverage against `<branch>` |
 | `deploy-<branch>` | Full stack deploy from `<branch>` + smoke test + teardown |
-| `merge-validation:<base>:<overlay>` | Deploy `<base>`, overlay `<overlay>`, teardown |
-| `all` | All of the above with defaults (`develop` for tests/deploy, `main`→`develop` for MV) |
+| `e2e-<branch>` | Full stack deploy from `<branch>` + Playwright E2E tests + teardown |
+| `scan-images-<branch>` | Build + Trivy-scan Docker images from `<branch>` |
+| `all` | All of the above with defaults (`develop` for tests/deploy/e2e) |
 
 ### Examples
 ```
 test-backend-develop
 deploy-main,test-frontend-main
-merge-validation:main:feature/my-branch
+e2e-develop
 all
 ```
 
@@ -42,13 +43,12 @@ Set `NIGHTLY_TRACKS` in **Settings → Secrets and variables → Actions → Var
 ### Test Tracks
 1. ✅ Install dependencies + run tests with coverage
 2. 📊 Compare coverage against previous baseline
-3. 🤖 AI analysis creates GitHub issues for coverage gaps (`test-coverage` + `nightly-build` labels)
 
 ### Deploy Track
-Full pipeline: infra → rag → inference → app → frontend + gateway → smoke test → teardown
+Full pipeline: platform → backend code deploys → frontend → smoke test → teardown
 
-### Merge Validation
-Deploys base branch, then overlays another branch on top — catches CDK/infra incompatibilities before merging.
+### E2E Track
+Deploys a full stack and runs Playwright E2E tests against it, then tears down.
 
 ## Debugging Failed Runs
 
@@ -57,7 +57,6 @@ Deploys base branch, then overlays another branch on top — catches CDK/infra i
 | Nothing runs on schedule | Set `NIGHTLY_TRACKS` repo variable |
 | Deploy fails | Check AWS credentials + CDK variables in development environment |
 | Teardown fails | Manually empty S3 buckets + `npx cdk destroy --all --force` |
-| MV overlay fails | Intended — overlay branch has infra incompatibilities with base |
 | Coverage analysis fails | Check that test jobs uploaded artifacts |
 
 ## Cost Considerations
diff --git a/.github/docs/NIGHTLY-BUILD.md b/.github/docs/NIGHTLY-BUILD.md
index 2e7e0cd90..cc9b0e7c8 100644
--- a/.github/docs/NIGHTLY-BUILD.md
+++ b/.github/docs/NIGHTLY-BUILD.md
@@ -2,7 +2,7 @@
 
 ## Overview
 
-The nightly workflow validates the AgentCore Public Stack through configurable tracks — backend tests, frontend tests, full-stack deploys, and merge validation. It runs every night at 2 AM Mountain Time (9 AM UTC) and can be triggered manually.
+The nightly workflow validates the AgentCore Public Stack through configurable tracks — backend tests, frontend tests, full-stack deploys, E2E tests, and image scanning. It runs every night at 2 AM Mountain Time (9 AM UTC) and can be triggered manually.
 
 **Fork safety**: If the `NIGHTLY_TRACKS` repository variable is not set, no tracks run. Forked repos are safe by default.
 
@@ -18,8 +18,8 @@ Tracks are specified as a comma-separated string in the `NIGHTLY_TRACKS` repo va
 | `test-frontend-<branch>` | Run frontend tests against `<branch>` |
 | `deploy-<branch>` | Deploy full stack from `<branch>` with automatic teardown |
 | `e2e-<branch>` | Deploy full stack from `<branch>`, run Playwright E2E tests, then teardown |
-| `merge-validation:<base>:<overlay>` | Deploy `<base>`, then overlay `<overlay>` on top (colons delimit to avoid branch name ambiguity) |
-| `all` | Run all tracks with defaults: tests + deploy + e2e on `develop`, MV `main`→`develop` |
+| `scan-images-<branch>` | Build Docker images from `<branch>` and scan them with Trivy |
+| `all` | Run all tracks with defaults: tests + deploy + e2e on `develop` |
 
 ### Examples
 
@@ -29,9 +29,7 @@ test-frontend-main,test-backend-main
 deploy-develop
 deploy-main,deploy-develop
 e2e-develop
-merge-validation:main:develop
-merge-validation:main:feature/my-branch
-test-backend-develop,deploy-develop,e2e-develop,merge-validation:main:develop
+test-backend-develop,deploy-develop,e2e-develop
 all
 ```
 
@@ -46,7 +44,7 @@ The `resolve-tracks` job parses the tracks string into boolean flags and branch
 ## Workflow Jobs
 
 ### resolve-tracks
-Parses the tracks string and outputs boolean flags (`run_test_backend`, `run_test_frontend`, `run_deploy`, `run_e2e`, `run_mv`) and branch refs for each enabled track.
+Parses the tracks string and outputs boolean flags (`run_test_backend`, `run_test_frontend`, `run_deploy`, `run_e2e`, `run_scan_images`) and branch refs for each enabled track.
 
 ### Test Tracks
 
@@ -55,7 +53,6 @@ When `test-backend-<branch>` or `test-frontend-<branch>` is specified:
 1. **install-backend / install-frontend**: Install and cache dependencies
 2. **test-backend / test-frontend**: Run test suites with coverage, upload artifacts
 3. **analyze-coverage**: Compare coverage against previous baseline (runs if any test succeeded)
-4. **ai-coverage-analysis**: Uses GitHub Models API (GPT-4o) to analyze coverage gaps and create/update GitHub issues labeled `test-coverage` + `nightly-build`
 
 ### Deploy Track
 
@@ -82,15 +79,6 @@ E2E test failures are **informational** — they mark the nightly summary as "pa
 - `E2E_ADMIN_USERNAME` / `E2E_ADMIN_PASSWORD` — Cognito admin test account
 - `E2E_USER_USERNAME` / `E2E_USER_PASSWORD` — Cognito regular user test account
 
-### Merge Validation Track
-
-When `merge-validation:<base>:<overlay>` is specified:
-
-1. **mv-base**: Deploys `<base>` branch with `nightly-mv` prefix, `skip-teardown: true`. Uses `source-project-prefix: dev-boisestateai-v2` for Docker image promotion (promote-or-build pattern).
-2. **mv-overlay**: Deploys `<overlay>` branch on top of the same `nightly-mv` stack, then tears down.
-
-This simulates a real merge to catch CDK/infra incompatibilities between branches.
-
 ### Summary
 
 Generates a GitHub Actions job summary table showing the status of all enabled tracks.
@@ -108,13 +96,8 @@ Reusable workflow (`workflow_call`) containing the full deploy pipeline.
 | `alb-subdomain` | yes | ALB subdomain for the deployment |
 | `skip-teardown` | no | Skip teardown (default: `false`) |
 | `label` | no | Label for job names |
-| `source-project-prefix` | no | If set, Docker jobs try ECR image promotion before building |
 | `run-e2e` | no | Run Playwright E2E tests after smoke test (default: `false`) |
 
-### Promote-or-Build Pattern
-
-When `source-project-prefix` is provided, Docker jobs (rag-ingestion, inference-api, app-api) attempt to promote existing images from the source ECR before falling back to a full build. This avoids unnecessary Docker builds when images haven't changed.
-
 ## Manual Triggers
 
 Go to: **Actions** → **Nightly Build & Test** → **Run workflow**
@@ -138,7 +121,7 @@ Example values:
 
 ### Environment
 
-Deploy and MV tracks use the `development` GitHub environment with overrides:
+Deploy and E2E tracks use the `development` GitHub environment with overrides:
 - `CDK_RETAIN_DATA_ON_DELETE=false` (enables clean teardown)
 - Minimal resource sizing
 
@@ -179,9 +162,6 @@ Check that `NIGHTLY_TRACKS` is set as a repository variable (not a secret). Empt
 - Ensure test jobs uploaded coverage artifacts
 - Check Python script logs for errors
 
-### Merge validation fails on overlay
-This is the intended signal — it means the overlay branch has CDK/infra incompatibilities with the base branch that need to be resolved before merging.
-
 ### E2E tests fail
 - Download the `playwright-report-<label>` artifact for screenshots and traces
 - Check that `E2E_ADMIN_USERNAME`, `E2E_ADMIN_PASSWORD`, `E2E_USER_USERNAME`, `E2E_USER_PASSWORD` secrets are set in the `development` environment
diff --git a/.github/workflows/backend.yml b/.github/workflows/backend.yml
index 5e52a25fb..c00f0eff8 100644
--- a/.github/workflows/backend.yml
+++ b/.github/workflows/backend.yml
@@ -2,16 +2,13 @@ name: Backend Deploy
 
 on:
   workflow_dispatch:
-  # Push-triggered deploys are disabled for the v1.0.0 release so that
-  # forking/syncing the codebase never auto-deploys backend code into a
-  # user's AWS account. Deploy intentionally via the Actions tab. Re-enable
-  # by uncommenting the block below.
-  # push:
-  #   branches: [develop, main]
-  #   paths:
-  #     - 'backend/**'
-  #     - 'scripts/build/**'
-  #     - '.github/workflows/backend.yml'
+  # Deploy on pushes to backend code or its build plumbing.
+  push:
+    branches: [develop, main]
+    paths:
+      - 'backend/**'
+      - 'scripts/build/**'
+      - '.github/workflows/backend.yml'
 
 permissions:
   contents: read
@@ -20,8 +17,11 @@ env:
   CDK_REQUIRE_APPROVAL: never
   LOAD_ENV_QUIET: true
 
+# Shared "deploy-<ref>" group with platform.yml so a CFN deploy and these
+# API-driven code deploys never mutate the same ECS service / AgentCore
+# Runtime / Lambda concurrently — they queue instead.
 concurrency:
-  group: backend-${{ github.ref }}
+  group: deploy-${{ github.ref }}
   cancel-in-progress: false
 
 # ------------------------------------------------------------
@@ -42,41 +42,19 @@ concurrency:
 jobs:
   test-infra:
     name: Test infrastructure (jest)
-    runs-on: ubuntu-24.04
     permissions:
       contents: read
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: '22'
-          cache: 'npm'
-          cache-dependency-path: infrastructure/package-lock.json
-      - name: Install
-        working-directory: infrastructure
-        run: npm ci --prefer-offline
-      - name: Run tests
-        working-directory: infrastructure
-        run: npx jest --maxWorkers=2
+    uses: ./.github/workflows/tests.yml
+    with:
+      run_infra: true
 
   test-backend:
     name: Test backend (pytest)
-    runs-on: ubuntu-24.04
     permissions:
       contents: read
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
-        with:
-          version: '0.7.12'
-          enable-cache: true
-          cache-dependency-glob: 'backend/uv.lock'
-      - name: Sync deps
-        working-directory: backend
-        run: uv sync --extra agentcore --extra dev
-      - name: Run pytest
-        working-directory: backend
-        run: uv run pytest tests/ -v
+    uses: ./.github/workflows/tests.yml
+    with:
+      run_backend: true
 
   build-app-api:
     name: Build app-api image
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e31650ac4..457af1a0f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,59 +23,13 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  test-backend:
-    name: Test backend (pytest)
-    runs-on: ubuntu-24.04
+  tests:
+    name: Tests
     permissions:
       contents: read
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
-        with:
-          version: '0.7.12'
-          enable-cache: true
-          cache-dependency-glob: 'backend/uv.lock'
-      - name: Sync deps
-        working-directory: backend
-        run: uv sync --extra agentcore --extra dev
-      - name: Run pytest
-        working-directory: backend
-        run: uv run pytest tests/ -v
+    uses: ./.github/workflows/tests.yml
+    with:
+      run_backend: true
+      run_frontend: true
+      run_infra: true
 
-  test-frontend:
-    name: Test frontend (vitest)
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: '22'
-          cache: 'npm'
-          cache-dependency-path: frontend/ai.client/package-lock.json
-      - name: Install
-        working-directory: frontend/ai.client
-        run: npm ci --prefer-offline
-      - name: Run tests
-        working-directory: frontend/ai.client
-        run: npm run test:ci
-
-  test-infra:
-    name: Test infrastructure (jest)
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: '22'
-          cache: 'npm'
-          cache-dependency-path: infrastructure/package-lock.json
-      - name: Install
-        working-directory: infrastructure
-        run: npm ci --prefer-offline
-      - name: Run tests
-        working-directory: infrastructure
-        run: npx jest --maxWorkers=2
diff --git a/.github/workflows/docs-deploy.yml b/.github/workflows/docs-deploy.yml
index 715d52624..8f791196e 100644
--- a/.github/workflows/docs-deploy.yml
+++ b/.github/workflows/docs-deploy.yml
@@ -3,7 +3,8 @@ name: Docs Deploy
 on:
   workflow_dispatch:
   push:
-    branches: [develop, main]
+    # The github-pages environment must allow main to deploy.
+    branches: [main]
     paths:
       - 'docs-site/**'
       - '.github/workflows/docs-deploy.yml'
@@ -20,6 +21,8 @@ concurrency:
 jobs:
   build:
     name: Build Starlight site
+    # Don't auto-publish from forks (manual dispatch still works).
+    if: ${{ github.repository == 'Boise-State-Development/agentcore-public-stack' || github.event_name == 'workflow_dispatch' }}
     runs-on: ubuntu-24.04
     permissions:
       contents: read
@@ -44,6 +47,7 @@ jobs:
   deploy:
     name: Deploy to GitHub Pages
     needs: build
+    if: ${{ github.repository == 'Boise-State-Development/agentcore-public-stack' || github.event_name == 'workflow_dispatch' }}
     runs-on: ubuntu-24.04
     permissions:
       pages: write
diff --git a/.github/workflows/frontend-deploy.yml b/.github/workflows/frontend-deploy.yml
index d101893f1..87b7960ab 100644
--- a/.github/workflows/frontend-deploy.yml
+++ b/.github/workflows/frontend-deploy.yml
@@ -2,15 +2,13 @@ name: Frontend Deploy
 
 on:
   workflow_dispatch:
-  # Push-triggered deploys are disabled for the v1.0.0 release so that
-  # forking/syncing the codebase never auto-deploys the SPA into a user's
-  # AWS account. Deploy intentionally via the Actions tab. Re-enable by
-  # uncommenting the block below.
-  # push:
-  #   branches: [develop, main]
-  #   paths:
-  #     - 'frontend/**'
-  #     - 'scripts/frontend/**'
+  # Deploy on pushes to the SPA or its deploy plumbing.
+  push:
+    branches: [develop, main]
+    paths:
+      - 'frontend/**'
+      - 'scripts/frontend/**'
+      - '.github/workflows/frontend-deploy.yml'
 
 permissions:
   contents: read
@@ -25,22 +23,11 @@ concurrency:
 jobs:
   test-frontend:
     name: Test frontend (ng test)
-    runs-on: ubuntu-24.04
     permissions:
       contents: read
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: '22'
-          cache: 'npm'
-          cache-dependency-path: frontend/ai.client/package-lock.json
-      - name: Install
-        working-directory: frontend/ai.client
-        run: npm ci --prefer-offline
-      - name: Run tests
-        working-directory: frontend/ai.client
-        run: npm run test:ci
+    uses: ./.github/workflows/tests.yml
+    with:
+      run_frontend: true
 
   build:
     name: Build SPA
diff --git a/.github/workflows/nightly-deploy-pipeline.yml b/.github/workflows/nightly-deploy-pipeline.yml
index b2161f6f5..ed9927421 100644
--- a/.github/workflows/nightly-deploy-pipeline.yml
+++ b/.github/workflows/nightly-deploy-pipeline.yml
@@ -47,14 +47,6 @@ on:
         required: false
         default: ''
         type: string
-      source-project-prefix:
-        description: 'Reserved for ECR image promotion. Currently unused — the
-          content-hash build (scripts/build/build-one.sh) skips rebuilds when ECR
-          already has the hash, so promotion is unnecessary. Declared so existing
-          orchestrator calls remain valid.'
-        required: false
-        default: ''
-        type: string
       run-e2e:
         description: 'Run Playwright E2E tests after smoke test (requires Cognito test user secrets)'
         required: false
@@ -77,69 +69,30 @@ jobs:
   # deploy-frontend gates on test-frontend, deploy-platform gates on test-infra).
   test-infra:
     name: "[${{ inputs.label }}] Test infrastructure (jest)"
-    runs-on: ubuntu-24.04
     permissions:
       contents: read
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: ${{ inputs.ref }}
-          persist-credentials: false
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: '22'
-          cache: 'npm'
-          cache-dependency-path: infrastructure/package-lock.json
-      - name: Install
-        working-directory: infrastructure
-        run: npm ci --prefer-offline
-      - name: Run tests
-        working-directory: infrastructure
-        run: npx jest --maxWorkers=2
+    uses: ./.github/workflows/tests.yml
+    with:
+      run_infra: true
+      ref: ${{ inputs.ref }}
 
   test-backend:
     name: "[${{ inputs.label }}] Test backend (pytest)"
-    runs-on: ubuntu-24.04
     permissions:
       contents: read
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: ${{ inputs.ref }}
-          persist-credentials: false
-      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
-        with:
-          version: '0.7.12'
-          enable-cache: true
-          cache-dependency-glob: 'backend/uv.lock'
-      - name: Sync deps
-        working-directory: backend
-        run: uv sync --extra agentcore --extra dev
-      - name: Run pytest
-        working-directory: backend
-        run: uv run pytest tests/ -v
+    uses: ./.github/workflows/tests.yml
+    with:
+      run_backend: true
+      ref: ${{ inputs.ref }}
 
   test-frontend:
-    name: "[${{ inputs.label }}] Test frontend (ng test)"
-    runs-on: ubuntu-24.04
+    name: "[${{ inputs.label }}] Test frontend"
     permissions:
       contents: read
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: ${{ inputs.ref }}
-          persist-credentials: false
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: '22'
-          cache: 'npm'
-          cache-dependency-path: frontend/ai.client/package-lock.json
-      - name: Install
-        working-directory: frontend/ai.client
-        run: npm ci --prefer-offline
-      - name: Run tests
-        working-directory: frontend/ai.client
-        run: npm run test:ci
+    uses: ./.github/workflows/tests.yml
+    with:
+      run_frontend: true
+      ref: ${{ inputs.ref }}
 
   deploy-platform:
     name: "[${{ inputs.label }}] Deploy PlatformStack"
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index f81167170..70067e2fb 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -6,19 +6,16 @@
 #   test-frontend-<branch>             Run frontend tests against <branch>
 #   deploy-<branch>                    Deploy full stack from <branch>
 #   e2e-<branch>                       Deploy full stack, run Playwright E2E tests, teardown
-#   merge-validation:<base>:<overlay>  Deploy <base>, then overlay <overlay>
 #   scan-images-<branch>               Scan Docker images from <branch> for vulnerabilities
 #   all                                Run all tracks with default branches
-#                                      (tests + deploy + e2e on develop, MV main→develop)
+#                                      (tests + deploy + e2e on develop)
 #
 # Examples:
 #   test-backend-develop
 #   test-frontend-main,test-backend-main
 #   deploy-develop
 #   deploy-main,deploy-develop
-#   merge-validation:main:develop
-#   merge-validation:main:feature/my-branch
-#   test-backend-develop,deploy-develop,merge-validation:main:develop
+#   test-backend-develop,deploy-develop,e2e-develop
 #   all
 #
 # Fork safety: If NIGHTLY_TRACKS is not set (empty), NO tracks run.
@@ -75,9 +72,6 @@ jobs:
       test_frontend_ref: ${{ steps.resolve.outputs.test_frontend_ref }}
       run_deploy: ${{ steps.resolve.outputs.run_deploy }}
       deploy_ref: ${{ steps.resolve.outputs.deploy_ref }}
-      run_mv: ${{ steps.resolve.outputs.run_mv }}
-      mv_base_ref: ${{ steps.resolve.outputs.mv_base_ref }}
-      mv_overlay_ref: ${{ steps.resolve.outputs.mv_overlay_ref }}
       run_scan_images: ${{ steps.resolve.outputs.run_scan_images }}
       scan_images_ref: ${{ steps.resolve.outputs.scan_images_ref }}
       run_e2e: ${{ steps.resolve.outputs.run_e2e }}
@@ -101,9 +95,6 @@ jobs:
           test_frontend_ref=""
           run_deploy=false
           deploy_ref=""
-          run_mv=false
-          mv_base_ref=""
-          mv_overlay_ref=""
           run_scan_images=false
           scan_images_ref=""
           run_e2e=false
@@ -125,9 +116,6 @@ jobs:
                   test_frontend_ref="develop"
                   run_deploy=true
                   deploy_ref="develop"
-                  run_mv=true
-                  mv_base_ref="main"
-                  mv_overlay_ref="develop"
                   run_scan_images=true
                   scan_images_ref="develop"
                   run_e2e=true
@@ -145,11 +133,6 @@ jobs:
                   run_deploy=true
                   deploy_ref="${token#deploy-}"
                   ;;
-                merge-validation:*:*)
-                  run_mv=true
-                  mv_base_ref="$(echo "$token" | cut -d: -f2)"
-                  mv_overlay_ref="$(echo "$token" | cut -d: -f3)"
-                  ;;
                 scan-images-*)
                   run_scan_images=true
                   scan_images_ref="${token#scan-images-}"
@@ -168,7 +151,7 @@ jobs:
           # Determine if any track is enabled
           any_track=false
           if [ "$run_test_backend" = "true" ] || [ "$run_test_frontend" = "true" ] || \
-             [ "$run_deploy" = "true" ] || [ "$run_mv" = "true" ] || \
+             [ "$run_deploy" = "true" ] || \
              [ "$run_scan_images" = "true" ] || [ "$run_e2e" = "true" ]; then
             any_track=true
           fi
@@ -181,9 +164,6 @@ jobs:
             echo "test_frontend_ref=$test_frontend_ref"
             echo "run_deploy=$run_deploy"
             echo "deploy_ref=$deploy_ref"
-            echo "run_mv=$run_mv"
-            echo "mv_base_ref=$mv_base_ref"
-            echo "mv_overlay_ref=$mv_overlay_ref"
             echo "run_scan_images=$run_scan_images"
             echo "scan_images_ref=$scan_images_ref"
             echo "run_e2e=$run_e2e"
@@ -196,7 +176,6 @@ jobs:
           echo "  test-backend:  $run_test_backend (ref: $test_backend_ref)"
           echo "  test-frontend: $run_test_frontend (ref: $test_frontend_ref)"
           echo "  deploy:        $run_deploy (ref: $deploy_ref)"
-          echo "  mv:            $run_mv (base: $mv_base_ref, overlay: $mv_overlay_ref)"
           echo "  scan-images:   $run_scan_images (ref: $scan_images_ref)"
           echo "  e2e:           $run_e2e (ref: $e2e_ref)"
           echo "  any_track:     $any_track"
@@ -424,50 +403,6 @@ jobs:
           echo "status=$STATUS" >> "$GITHUB_OUTPUT"
           echo "duration=$SECONDS" >> "$GITHUB_OUTPUT"
 
-  ai-coverage-analysis:
-    name: AI Coverage Gap Analysis
-    runs-on: ubuntu-24.04
-    needs: [resolve-tracks, analyze-coverage]
-    if: >-
-      always() && needs.analyze-coverage.result == 'success'
-    outputs:
-      status: ${{ steps.summary.outputs.status }}
-      duration: ${{ steps.summary.outputs.duration }}
-    permissions:
-      issues: write
-      contents: read
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: ${{ needs.resolve-tracks.outputs.test_backend_ref || needs.resolve-tracks.outputs.test_frontend_ref }}
-
-      - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: '3.13'
-
-      - name: Download coverage comparison report
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: coverage-comparison
-          path: .
-
-      - name: Run AI coverage analysis
-        id: run-ai-analysis
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GITHUB_REPOSITORY: ${{ github.repository }}
-        run: python3 scripts/nightly/ai-coverage-analysis.py
-
-      - name: Generate summary
-        id: summary
-        if: always()
-        run: |
-          if [ "${{ steps.run-ai-analysis.outcome }}" = "success" ]; then STATUS="success"; else STATUS="failure"; fi
-          echo "status=$STATUS" >> "$GITHUB_OUTPUT"
-          echo "duration=$SECONDS" >> "$GITHUB_OUTPUT"
-
   # ── Deploy Track ──────────────────────────────────────────────────────────
 
   deploy:
@@ -506,41 +441,6 @@ jobs:
       run-e2e: 'true'
     secrets: inherit
 
-  # ── Merge Validation Track ────────────────────────────────────────────────
-  # Deploys base branch first, then overlays the overlay branch on top —
-  # simulating a real merge to catch CDK/infra incompatibilities.
-
-  mv-base:
-    needs: resolve-tracks
-    if: needs.resolve-tracks.outputs.run_mv == 'true'
-    permissions:
-      id-token: write
-      contents: read
-    uses: ./.github/workflows/nightly-deploy-pipeline.yml
-    with:
-      ref: ${{ needs.resolve-tracks.outputs.mv_base_ref }}
-      project-prefix: nightly-mv
-      alb-subdomain: nightly-mv-api
-      skip-teardown: 'true'
-      label: MV-base-${{ needs.resolve-tracks.outputs.mv_base_ref }}
-      source-project-prefix: dev-boisestateai-v2
-    secrets: inherit
-
-  mv-overlay:
-    needs: [resolve-tracks, mv-base]
-    if: needs.resolve-tracks.outputs.run_mv == 'true'
-    permissions:
-      id-token: write
-      contents: read
-    uses: ./.github/workflows/nightly-deploy-pipeline.yml
-    with:
-      ref: ${{ needs.resolve-tracks.outputs.mv_overlay_ref }}
-      project-prefix: nightly-mv
-      alb-subdomain: nightly-mv-api
-      skip-teardown: ${{ github.event.inputs.skip_teardown || 'false' }}
-      label: MV-overlay-${{ needs.resolve-tracks.outputs.mv_overlay_ref }}
-    secrets: inherit
-
   # ── Image Scanning Track ──────────────────────────────────────────────────
 
   scan-images:
@@ -628,13 +528,13 @@ jobs:
   summary:
     name: Nightly Summary
     runs-on: ubuntu-24.04
-    needs: [resolve-tracks, test-backend, test-frontend, analyze-coverage, ai-coverage-analysis, deploy, e2e, mv-base, mv-overlay, scan-images]
+    needs: [resolve-tracks, test-backend, test-frontend, analyze-coverage, deploy, e2e, scan-images]
     if: always() && needs.resolve-tracks.outputs.any_track == 'true'
     steps:
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          ref: ${{ needs.resolve-tracks.outputs.test_backend_ref || needs.resolve-tracks.outputs.deploy_ref || needs.resolve-tracks.outputs.mv_overlay_ref || 'develop' }}
+          ref: ${{ needs.resolve-tracks.outputs.test_backend_ref || needs.resolve-tracks.outputs.deploy_ref || needs.resolve-tracks.outputs.e2e_ref || 'develop' }}
 
       - name: Generate nightly summary
         env:
@@ -642,12 +542,9 @@ jobs:
           RUN_TEST_FRONTEND: ${{ needs.resolve-tracks.outputs.run_test_frontend }}
           RUN_DEPLOY: ${{ needs.resolve-tracks.outputs.run_deploy }}
           RUN_E2E: ${{ needs.resolve-tracks.outputs.run_e2e }}
-          RUN_MV: ${{ needs.resolve-tracks.outputs.run_mv }}
           RUN_SCAN_IMAGES: ${{ needs.resolve-tracks.outputs.run_scan_images }}
           DEPLOY_REF: ${{ needs.resolve-tracks.outputs.deploy_ref }}
           E2E_REF: ${{ needs.resolve-tracks.outputs.e2e_ref }}
-          MV_BASE_REF: ${{ needs.resolve-tracks.outputs.mv_base_ref }}
-          MV_OVERLAY_REF: ${{ needs.resolve-tracks.outputs.mv_overlay_ref }}
         run: |
           source scripts/common/summary.sh
 
@@ -681,10 +578,6 @@ jobs:
             status="$(map_status "${{ needs.analyze-coverage.result }}")"
             ROWS+=("Coverage Analysis|${status}|${{ needs.analyze-coverage.outputs.duration || '0' }}")
             [ "$status" = "failure" ] && [ "$AGGREGATE" != "failure" ] && AGGREGATE="partial"
-
-            status="$(map_status "${{ needs.ai-coverage-analysis.result }}")"
-            ROWS+=("AI Coverage Analysis|${status}|${{ needs.ai-coverage-analysis.outputs.duration || '0' }}")
-            [ "$status" = "failure" ] && [ "$AGGREGATE" != "failure" ] && AGGREGATE="partial"
           fi
 
           # Deploy track (reusable workflow — single aggregate result)
@@ -701,17 +594,6 @@ jobs:
             [ "$status" = "failure" ] && [ "$AGGREGATE" != "failure" ] && AGGREGATE="partial"
           fi
 
-          # MV tracks
-          if [ "$RUN_MV" = "true" ]; then
-            status="$(map_status "${{ needs.mv-base.result }}")"
-            ROWS+=("[MV] Base (${MV_BASE_REF})|${status}|0")
-            [ "$status" = "failure" ] && AGGREGATE="failure"
-
-            status="$(map_status "${{ needs.mv-overlay.result }}")"
-            ROWS+=("[MV] Overlay (${MV_OVERLAY_REF})|${status}|0")
-            [ "$status" = "failure" ] && AGGREGATE="failure"
-          fi
-
           # Image scan track
           if [ "$RUN_SCAN_IMAGES" = "true" ]; then
             status="$(map_status "${{ needs.scan-images.result }}")"
diff --git a/.github/workflows/platform.yml b/.github/workflows/platform.yml
index a0c18440c..bd42691dc 100644
--- a/.github/workflows/platform.yml
+++ b/.github/workflows/platform.yml
@@ -2,19 +2,17 @@ name: Platform Stack
 
 on:
   workflow_dispatch:
-  # Push-triggered deploys are disabled for the v1.0.0 release so that
-  # forking/syncing the codebase never auto-deploys infrastructure into a
-  # user's AWS account. Deploy intentionally via the Actions tab. Re-enable
-  # by uncommenting the block below.
-  # push:
-  #   branches: [develop, main]
-  #   paths:
-  #     - 'infrastructure/lib/platform-stack.ts'
-  #     - 'infrastructure/lib/constructs/**'
-  #     - 'infrastructure/lib/config.ts'
-  #     - 'infrastructure/bin/infrastructure.ts'
-  #     - 'infrastructure/bootstrap-assets/**'
-  #     - 'scripts/platform/**'
+  # Deploy on pushes to the CDK stack or its deploy plumbing.
+  push:
+    branches: [develop, main]
+    paths:
+      - 'infrastructure/lib/platform-stack.ts'
+      - 'infrastructure/lib/constructs/**'
+      - 'infrastructure/lib/config.ts'
+      - 'infrastructure/bin/infrastructure.ts'
+      - 'infrastructure/bootstrap-assets/**'
+      - 'scripts/platform/**'
+      - '.github/workflows/platform.yml'
 
 permissions:
   contents: read
@@ -23,32 +21,24 @@ env:
   CDK_REQUIRE_APPROVAL: never
   LOAD_ENV_QUIET: true
 
-# cancel-in-progress: false to avoid leaving CloudFormation in
-# ROLLBACK_IN_PROGRESS / UPDATE_ROLLBACK_FAILED after a mid-deploy
-# cancel. Enforced by tests/supply_chain/test_concurrency_config.py.
+# Shared "deploy-<ref>" group with backend.yml so a CFN deploy and the
+# API-driven backend code deploys never mutate the same ECS service /
+# AgentCore Runtime / Lambda concurrently — they queue instead.
+# cancel-in-progress: false avoids leaving CloudFormation in
+# ROLLBACK_IN_PROGRESS / UPDATE_ROLLBACK_FAILED after a mid-deploy cancel.
+# Enforced by tests/supply_chain/test_concurrency_config.py.
 concurrency:
-  group: platform-${{ github.ref }}
+  group: deploy-${{ github.ref }}
   cancel-in-progress: false
 
 jobs:
   test-infra:
     name: Test infrastructure (jest)
-    runs-on: ubuntu-24.04
     permissions:
       contents: read
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: '22'
-          cache: 'npm'
-          cache-dependency-path: infrastructure/package-lock.json
-      - name: Install
-        working-directory: infrastructure
-        run: npm ci --prefer-offline
-      - name: Run tests
-        working-directory: infrastructure
-        run: npx jest --maxWorkers=2
+    uses: ./.github/workflows/tests.yml
+    with:
+      run_infra: true
 
   deploy:
     name: Deploy PlatformStack
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 445970317..175b92280 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,6 +14,8 @@ env:
 jobs:
   release:
     name: Create Release
+    # Don't create releases/tags in forks.
+    if: ${{ github.repository == 'Boise-State-Development/agentcore-public-stack' }}
     runs-on: ubuntu-24.04
 
     permissions:
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
new file mode 100644
index 000000000..3ee059e6b
--- /dev/null
+++ b/.github/workflows/tests.yml
@@ -0,0 +1,101 @@
+# Reusable test gates (pytest / vitest / jest). Callers pick suites via the
+# run_* inputs; unselected jobs are skipped.
+
+name: Tests
+
+on:
+  workflow_call:
+    inputs:
+      ref:
+        description: 'Git ref to check out (empty = the ref that triggered the caller)'
+        required: false
+        default: ''
+        type: string
+      run_backend:
+        description: 'Run backend pytest suite'
+        required: false
+        default: false
+        type: boolean
+      run_frontend:
+        description: 'Run frontend test suite'
+        required: false
+        default: false
+        type: boolean
+      run_infra:
+        description: 'Run infrastructure jest suite'
+        required: false
+        default: false
+        type: boolean
+
+permissions:
+  contents: read
+
+jobs:
+  test-backend:
+    if: ${{ inputs.run_backend }}
+    name: Test backend (pytest)
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ inputs.ref }}
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          version: '0.7.12'
+          enable-cache: true
+          cache-dependency-glob: 'backend/uv.lock'
+      - name: Sync deps
+        working-directory: backend
+        run: uv sync --extra agentcore --extra dev
+      - name: Run pytest
+        working-directory: backend
+        run: uv run pytest tests/ -v
+
+  test-frontend:
+    if: ${{ inputs.run_frontend }}
+    name: Test frontend
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ inputs.ref }}
+          persist-credentials: false
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: '22'
+          cache: 'npm'
+          cache-dependency-path: frontend/ai.client/package-lock.json
+      - name: Install
+        working-directory: frontend/ai.client
+        run: npm ci --prefer-offline
+      - name: Run tests
+        working-directory: frontend/ai.client
+        run: npm run test:ci
+
+  test-infra:
+    if: ${{ inputs.run_infra }}
+    name: Test infrastructure (jest)
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ inputs.ref }}
+          persist-credentials: false
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: '22'
+          cache: 'npm'
+          cache-dependency-path: infrastructure/package-lock.json
+      - name: Install
+        working-directory: infrastructure
+        run: npm ci --prefer-offline
+      - name: Run tests
+        working-directory: infrastructure
+        run: npx jest --maxWorkers=2
diff --git a/.kiro/steering/release-notes.md b/.kiro/steering/release-notes.md
index f16477402..c2cd86091 100644
--- a/.kiro/steering/release-notes.md
+++ b/.kiro/steering/release-notes.md
@@ -16,6 +16,27 @@ Both files are updated in the **same release pass** from the same source of comm
 
 ---
 
+## Match Depth to Release Size
+
+Release depth scales with what actually shipped — not every release earns a long writeup. We expect to cut patches frequently (potentially several per day), so a small patch must stay **short and digestible**, while a feature or minor release earns the full narrative treatment described later in this doc.
+
+Decide the tier first, then write to it:
+
+| Release type | SemVer | What's in it | `RELEASE_NOTES.md` depth | `CHANGELOG.md` depth |
+|---|---|---|---|---|
+| **Patch** | `x.y.Z` | Bug fixes, security/dep bumps, CI/CD, docs, internal refactors — no new user-facing capability | **Brief.** A 2-4 sentence Highlights paragraph + compact per-category bullets + a one-paragraph deployment note. **No** feature spotlights, **no** per-layer (backend/frontend/infra) subsections, **no** test-coverage section. Aim for a screen or less. | One-line bullets per change, grouped by category. A one-sentence lead paragraph is enough. |
+| **Minor / feature** | `x.Y.0` | New features, endpoints, pages, or capabilities | **Deep.** Full treatment: Highlights, one feature spotlight per major feature with backend/frontend/infrastructure/test-coverage subsections, then per-category bullets. | Spotlight-worthy items get a richer bullet; everything else one line. Narrative stays in `RELEASE_NOTES.md`. |
+| **Major** | `X.0.0` | Breaking changes, architecture shifts, migrations | **Deepest.** Everything above plus a prominent migration/upgrade section and breaking-change callouts. | Breaking changes prefixed `**Breaking:**` with migration pointers. |
+
+Rules of thumb:
+
+- **Don't pad a patch.** If the release is three CI/CD commits and a dependency bump, the notes should be a screen or less. Resist inventing spotlights or test-coverage line counts that don't matter.
+- **Don't starve a feature.** A new capability still gets a spotlight with the what/why/how and the file/endpoint/class detail this audience expects — brevity-for-patches is not license to thin out feature notes.
+- **The category bullets (🔒 / 📦 / 🔧 / 🐛 / …) are the same in both tiers.** The difference is whether they're preceded by narrative spotlights (feature) or stand alone (patch).
+- **When in doubt, size the notes to the largest single change in the release.** One real feature among ten chores makes it a feature release for write-up purposes.
+
+---
+
 ## Branch Model & Why This Is Hard
 
 This repo uses a squash-merge workflow: `develop` accumulates feature branches via merge commits, and when a release is cut, `develop` is squash-merged into `main`. This means `main` and `develop` have **divergent git histories** — you cannot do a simple `git log main..develop` to get a clean diff. Commit SHAs on `main` don't correspond to anything on `develop`.
@@ -113,6 +134,8 @@ When drafting `RELEASE_NOTES.md`, lead with the outcome, then explain the mechan
 
 The new release goes at the **top** of the file. Do not modify previous release sections.
 
+> **Patch releases use the short form.** The full section order and feature-spotlight template below describe a **feature / minor or major** release. For a patch (see *Match Depth to Release Size*), keep only the **Header**, a short **Highlights** paragraph, the relevant **per-category bullets**, and **Deployment notes** — omit feature spotlights, per-layer subsections, and the test-coverage section.
+
 ### Header
 
 ```markdown
diff --git a/CHANGELOG.md b/CHANGELOG.md
index b9ac50911..da6d816ad 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,26 @@ All notable changes to this project are documented in this file. Format follows
 
 For narrative release notes written for operators and product owners, see [RELEASE_NOTES.md](RELEASE_NOTES.md).
 
+## [1.0.3] - 2026-06-30
+
+Maintenance patch: CI/CD pipeline cleanup, re-enabled path-scoped auto-deploys, and a dependency/CodeQL sweep. No application code or user-facing behavior changes; upgrade in place.
+
+### 🔒 Security
+
+- Removed unused imports flagged by CodeQL: `Optional` in `agents/main_agent/agent_types.py`, `ssm` in `app-api/app-api-environment.ts` (#526)
+
+### 📦 Dependencies
+
+- **backend:** `joserfc` 1.6.3 → 1.7.2 (`backend/uv.lock`) and 1.6.5 → 1.7.2 (`scripts/backup-data/uv.lock`); remediates Dependabot GHSA-wphv-vfrh-23q5 / CVE-2026-48990 (#526)
+
+### 🔧 CI/CD
+
+- Serialize `platform.yml` and `backend.yml` under one repo-global concurrency group (`deploy-<ref>`) so a CloudFormation deploy and the API-driven backend code deploys can't run concurrently and stomp the same ECS service / AgentCore Runtime / Lambda; frontend stays independent, `cancel-in-progress` stays false (#525)
+- Re-enabled push-triggered, path-scoped deploys for platform, backend, and frontend (develop → development env, main → production) after being `workflow_dispatch`-only since v1.0.0; each trigger is scoped to its own surface (#524)
+- Extracted duplicated test gates into a reusable `tests.yml`, wired into `ci`, `platform`, `backend`, `frontend-deploy`, and `nightly-deploy-pipeline`; render the reusable test-gate job names statically so skipped single-suite callers no longer show raw `${{ }}` expressions as labels (#524, #526)
+- Pruned dead nightly tracks (AI coverage analysis, merge-validation) and orphaned scripts (`ai-coverage-analysis.py`, `promote-ecr-image.sh`); removed the dead `source-project-prefix` input (#524)
+- `docs-deploy` now publishes from `main` (was `develop`); fork-gated `docs-deploy` and `release` so forks syncing `main` don't auto-publish or auto-create releases (#524)
+
 ## [1.0.2] - 2026-06-29
 
 Second patch on the 1.0.0 single-stack architecture. Headlined by **restoring tool use in assistant chats** (reverting the 1.0.0 knowledge-base-only change), plus a CodeQL security-hardening sweep, remediation of 6 Dependabot alerts, and a nightly-pipeline fix. No migration; upgrade in place.
diff --git a/README.md b/README.md
index 129dbd342..5571891ca 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@
 **An open-source, production-ready Generative AI platform for institutions**
 *Built by Boise State University, designed for everyone.*
 
-[![Release](https://img.shields.io/badge/Release-v1.0.2-6366f1?style=flat&logo=github&logoColor=white)](RELEASE_NOTES.md)
+[![Release](https://img.shields.io/badge/Release-v1.0.3-6366f1?style=flat&logo=github&logoColor=white)](RELEASE_NOTES.md)
 [![Nightly](https://github.com/Boise-State-Development/agentcore-public-stack/actions/workflows/nightly.yml/badge.svg)](https://github.com/Boise-State-Development/agentcore-public-stack/actions/workflows/nightly.yml)
 
 ![Python](https://img.shields.io/badge/Python-3.13+-3776AB?style=flat&logo=python&logoColor=white)
@@ -296,7 +296,7 @@ agentcore-public-stack/
 
 See [RELEASE_NOTES.md](RELEASE_NOTES.md) for the full changelog, including new features, bug fixes, platform upgrades, and deployment notes for each release.
 
-**Current release:** v1.0.2
+**Current release:** v1.0.3
 
 ---
 
diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md
index 2bb7ab01c..4a3185807 100644
--- a/RELEASE_NOTES.md
+++ b/RELEASE_NOTES.md
@@ -1,3 +1,36 @@
+# Release Notes — v1.0.3
+
+**Release Date:** June 30, 2026
+**Previous Release:** v1.0.2 (June 29, 2026)
+
+---
+
+> ⚠️ **Upgrading from a beta?** 1.0.3 is an in-place upgrade from 1.0.0/1.0.1/1.0.2 with no migration. Moving from any pre-1.0.0 beta is still the destructive backup → teardown → redeploy → restore migration described in the [1.0.0 notes](#upgrading-an-existing-deployment). Brand-new deployments need none of this.
+
+---
+
+## Highlights
+
+v1.0.3 is a maintenance patch — no application code or user-facing behavior changes. It's almost entirely **CI/CD pipeline work**: platform and backend deploys are now serialized through a shared concurrency group so they can't race each other onto the same ECS service / AgentCore Runtime / Lambda, push-triggered (path-scoped) auto-deploys are back on for the platform/backend/frontend workflows, and the duplicated test gates are consolidated into one reusable workflow. Rounding it out is a small dependency + CodeQL sweep (a `joserfc` CVE patch and a couple of unused-import removals). Operators on 1.0.x upgrade in place with no migration.
+
+## 🔒 Security & 📦 Dependencies
+
+- `joserfc` 1.6.3 → 1.7.2 (backend) and 1.6.5 → 1.7.2 (backup-data tooling), remediating Dependabot GHSA-wphv-vfrh-23q5 / CVE-2026-48990. (#526)
+- Removed unused imports flagged by CodeQL — `Optional` in `agents/main_agent/agent_types.py`, `ssm` in `app-api/app-api-environment.ts`. (#526)
+
+## 🔧 CI/CD
+
+- **Serialized deploys.** `platform.yml` and `backend.yml` now share one repo-global concurrency group (`deploy-<ref>`), so a CloudFormation deploy and the API-driven backend code deploys queue instead of running at once and stomping the same ECS service / AgentCore Runtime / Lambda. Frontend stays independent; `cancel-in-progress` stays false. (#525)
+- **Auto-deploy restored.** Push-triggered, path-scoped deploys are re-enabled for platform/backend/frontend (develop → development, main → production) after being manual-dispatch-only since v1.0.0. Each trigger is scoped to its own surface so unrelated changes don't redeploy. (#524)
+- **Reusable test gates.** Duplicated test jobs are extracted into a shared `tests.yml` consumed by `ci`, `platform`, `backend`, `frontend-deploy`, and `nightly-deploy-pipeline`; skipped single-suite callers now render correct job labels instead of raw `${{ }}` expressions. (#524, #526)
+- **Pipeline cleanup.** Pruned dead nightly tracks (AI coverage analysis, merge-validation) and orphaned scripts; `docs-deploy` now publishes from `main` (was `develop`), and `docs-deploy`/`release` are fork-gated so forks syncing `main` don't auto-publish or auto-release. (#524)
+
+## 🚀 Deployment notes
+
+In-place patch on the single-stack `PlatformStack` — no new infrastructure, env vars, or migration. The only operator-visible change is to CI/CD behavior: pushes to `develop`/`main` once again auto-deploy (path-scoped), and platform vs. backend deploys now queue rather than run concurrently.
+
+---
+
 # Release Notes — v1.0.2
 
 **Release Date:** June 29, 2026
diff --git a/VERSION b/VERSION
index 6d7de6e6a..21e8796a0 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.0.2
+1.0.3
diff --git a/backend/pyproject.toml b/backend/pyproject.toml
index 98ed0e0cb..f2bb88ab7 100644
--- a/backend/pyproject.toml
+++ b/backend/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentcore-stack"
-version = "1.0.2"
+version = "1.0.3"
 requires-python = ">=3.10"
 description = "Multi-agent conversational AI system with AWS Bedrock AgentCore"
 readme = "README.md"
diff --git a/backend/src/agents/main_agent/agent_types.py b/backend/src/agents/main_agent/agent_types.py
index 377fdd727..b937b8c0f 100644
--- a/backend/src/agents/main_agent/agent_types.py
+++ b/backend/src/agents/main_agent/agent_types.py
@@ -6,7 +6,7 @@
 """
 
 import logging
-from typing import Optional, List
+from typing import List
 
 from agents.main_agent.base_agent import BaseAgent
 
diff --git a/backend/uv.lock b/backend/uv.lock
index c6244a6db..5af1a6a41 100644
--- a/backend/uv.lock
+++ b/backend/uv.lock
@@ -12,7 +12,7 @@ resolution-markers = [
 
 [[package]]
 name = "agentcore-stack"
-version = "1.0.2"
+version = "1.0.3"
 source = { editable = "." }
 dependencies = [
     { name = "aiofiles" },
@@ -1732,14 +1732,14 @@ wheels = [
 
 [[package]]
 name = "joserfc"
-version = "1.6.3"
+version = "1.7.2"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cryptography" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/ce/90/b8cc8635c4ce2e5e8104bf26ef147f6e599478f6329107283cdc53aae97f/joserfc-1.6.3.tar.gz", hash = "sha256:c00c2830db969b836cba197e830e738dd9dda0955f1794e55d3c636f17f5c9a6", size = 229090, upload-time = "2026-02-25T15:33:38.167Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/f1/26/abe1ad855eb334b5ebc9c6495d4798e12bee70e5e8e815d54570710b8312/joserfc-1.7.2.tar.gz", hash = "sha256:537ffb8888b2df039cb5b6d017d7cff6f09d521ce65d89cc9b8ab752b1cff947", size = 233183, upload-time = "2026-06-29T09:03:10.868Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/12/4f/124b3301067b752f44f292f0b9a74e837dd75ff863ee39500a082fc4c733/joserfc-1.6.3-py3-none-any.whl", hash = "sha256:6beab3635358cbc565cb94fb4c53d0557e6d10a15b933e2134939351590bda9a", size = 70465, upload-time = "2026-02-25T15:33:36.997Z" },
+    { url = "https://files.pythonhosted.org/packages/13/80/d1b30336582cced4dce0dae776508a6011723e32f907bc7a702c0b25890a/joserfc-1.7.2-py3-none-any.whl", hash = "sha256:ddd818c0ca9b4f17bbc2d72cb3966e6ded7502be089316c62c3cc64ae86132b5", size = 70426, upload-time = "2026-06-29T09:03:09.393Z" },
 ]
 
 [[package]]
diff --git a/frontend/ai.client/package-lock.json b/frontend/ai.client/package-lock.json
index 9b3bcf4f5..d290dec97 100644
--- a/frontend/ai.client/package-lock.json
+++ b/frontend/ai.client/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "ai.client",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "ai.client",
-      "version": "1.0.2",
+      "version": "1.0.3",
       "dependencies": {
         "@angular/cdk": "21.2.14",
         "@angular/common": "21.2.17",
diff --git a/frontend/ai.client/package.json b/frontend/ai.client/package.json
index aaeeb08f7..ef7f986f4 100644
--- a/frontend/ai.client/package.json
+++ b/frontend/ai.client/package.json
@@ -1,6 +1,6 @@
 {
   "name": "ai.client",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "scripts": {
     "ng": "ng",
     "start": "ng serve",
diff --git a/infrastructure/lib/constructs/app-api/app-api-environment.ts b/infrastructure/lib/constructs/app-api/app-api-environment.ts
index 80c7ffb06..8de73a3ee 100644
--- a/infrastructure/lib/constructs/app-api/app-api-environment.ts
+++ b/infrastructure/lib/constructs/app-api/app-api-environment.ts
@@ -7,8 +7,6 @@
  * objects it can pass to the task definition and IAM grants module.
  */
 
-import * as ssm from 'aws-cdk-lib/aws-ssm';
-
 import { AppConfig, buildCorsOrigins } from '../../config';
 import { PlatformComputeRefs } from '../platform-compute-refs';
 
diff --git a/infrastructure/package-lock.json b/infrastructure/package-lock.json
index f036d6dbe..bfc7ce12e 100644
--- a/infrastructure/package-lock.json
+++ b/infrastructure/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "infrastructure",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "infrastructure",
-      "version": "1.0.2",
+      "version": "1.0.3",
       "dependencies": {
         "aws-cdk-lib": "2.260.0",
         "constructs": "10.6.0"
diff --git a/infrastructure/package.json b/infrastructure/package.json
index 3685a3e73..2edef91ba 100644
--- a/infrastructure/package.json
+++ b/infrastructure/package.json
@@ -1,6 +1,6 @@
 {
   "name": "infrastructure",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "bin": {
     "infrastructure": "bin/infrastructure.js"
   },
diff --git a/scripts/backup-data/uv.lock b/scripts/backup-data/uv.lock
index a662157e5..091f8b628 100644
--- a/scripts/backup-data/uv.lock
+++ b/scripts/backup-data/uv.lock
@@ -285,14 +285,14 @@ wheels = [
 
 [[package]]
 name = "joserfc"
-version = "1.6.5"
+version = "1.7.2"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cryptography" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/3b/dc/5f768c2e391e9afabe5d18e3221346deb5fb6338565f1ccc9e7c6d7befdd/joserfc-1.6.5.tar.gz", hash = "sha256:1482a7db78fb4602e44ed89e51b599d052e091288c7c532c5b694e20149dec48", size = 231881, upload-time = "2026-05-06T04:58:13.408Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/f1/26/abe1ad855eb334b5ebc9c6495d4798e12bee70e5e8e815d54570710b8312/joserfc-1.7.2.tar.gz", hash = "sha256:537ffb8888b2df039cb5b6d017d7cff6f09d521ce65d89cc9b8ab752b1cff947", size = 233183, upload-time = "2026-06-29T09:03:10.868Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/54/3b/ad1cb22e75c963b1f07c8a2329bf47227ce7e4361df5eb2fb101b2ce33ef/joserfc-1.6.5-py3-none-any.whl", hash = "sha256:e9878a0f8243fe7b95e11fdda81374ca9f7a689e302751579d3dfdeec559675e", size = 70464, upload-time = "2026-05-06T04:58:11.668Z" },
+    { url = "https://files.pythonhosted.org/packages/13/80/d1b30336582cced4dce0dae776508a6011723e32f907bc7a702c0b25890a/joserfc-1.7.2-py3-none-any.whl", hash = "sha256:ddd818c0ca9b4f17bbc2d72cb3966e6ded7502be089316c62c3cc64ae86132b5", size = 70426, upload-time = "2026-06-29T09:03:09.393Z" },
 ]
 
 [[package]]
diff --git a/scripts/build/build-and-push-if-changed.sh b/scripts/build/build-and-push-if-changed.sh
index 8e1271633..4e215e41a 100755
--- a/scripts/build/build-and-push-if-changed.sh
+++ b/scripts/build/build-and-push-if-changed.sh
@@ -87,8 +87,8 @@ log "Content hash: $TAG"
 
 # 2. Ensure the ECR repository exists. CDK only IMPORTS these repos
 # (via ecr.Repository.fromRepositoryName), so they must be provisioned
-# out-of-band. We follow the same pattern as scripts/common/promote-ecr-image.sh:
-# describe-then-create with scanOnPush, AES256, and the standard tags.
+# out-of-band with a describe-then-create using scanOnPush, AES256, and
+# the standard tags.
 if ! aws ecr describe-repositories \
         --region "$AWS_REGION" \
         --repository-names "$REPO_NAME" \
diff --git a/scripts/common/promote-ecr-image.sh b/scripts/common/promote-ecr-image.sh
deleted file mode 100755
index 8fa66dd89..000000000
--- a/scripts/common/promote-ecr-image.sh
+++ /dev/null
@@ -1,110 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-# Script: Promote ECR Image
-# Description: Copies a Docker image from a source ECR repository (SOURCE_PROJECT_PREFIX)
-#              to a target ECR repository (CDK_PROJECT_PREFIX) within the same account.
-#              This avoids rebuilding images when promoting across nightly environments.
-#
-# Usage: bash scripts/common/promote-ecr-image.sh <service-name>
-#   e.g. bash scripts/common/promote-ecr-image.sh app-api
-#
-# Required environment variables:
-#   CDK_AWS_ACCOUNT          - AWS account ID
-#   CDK_AWS_REGION           - AWS region
-#   CDK_PROJECT_PREFIX       - Target project prefix (e.g. nightly-mv)
-#   SOURCE_PROJECT_PREFIX    - Source project prefix (e.g. agentcore)
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_ROOT="$(cd "${SCRIPT_DIR}/../.." && pwd)"
-
-log_info()    { echo "[INFO] $1"; }
-log_error()   { echo "[ERROR] $1" >&2; }
-log_success() { echo "[SUCCESS] $1"; }
-
-main() {
-    local service_name="${1:?Usage: promote-ecr-image.sh <service-name>}"
-
-    # Validate required env vars
-    for var in CDK_AWS_ACCOUNT CDK_AWS_REGION CDK_PROJECT_PREFIX SOURCE_PROJECT_PREFIX; do
-        if [ -z "${!var:-}" ]; then
-            log_error "${var} is not set"
-            exit 1
-        fi
-    done
-
-    local ecr_registry="${CDK_AWS_ACCOUNT}.dkr.ecr.${CDK_AWS_REGION}.amazonaws.com"
-    local src_repo="${SOURCE_PROJECT_PREFIX}-${service_name}"
-    local dst_repo="${CDK_PROJECT_PREFIX}-${service_name}"
-
-    log_info "Promoting image: ${src_repo} -> ${dst_repo}"
-
-    # Login to ECR
-    log_info "Logging in to ECR..."
-    aws ecr get-login-password --region "${CDK_AWS_REGION}" | \
-        docker login --username AWS --password-stdin "${ecr_registry}"
-
-    # Read the current image tag from the source SSM parameter
-    local ssm_param="/${SOURCE_PROJECT_PREFIX}/${service_name}/image-tag"
-    log_info "Reading image tag from SSM: ${ssm_param}"
-
-    local image_tag
-    image_tag=$(aws ssm get-parameter \
-        --name "${ssm_param}" \
-        --query "Parameter.Value" \
-        --output text \
-        --region "${CDK_AWS_REGION}")
-
-    if [ -z "${image_tag}" ]; then
-        log_error "Could not read image tag from ${ssm_param}"
-        exit 1
-    fi
-
-    log_info "Source image tag: ${image_tag}"
-
-    local src_image="${ecr_registry}/${src_repo}:${image_tag}"
-    local dst_image="${ecr_registry}/${dst_repo}:${image_tag}"
-
-    # Ensure target ECR repository exists
-    log_info "Ensuring target ECR repository exists: ${dst_repo}"
-    if ! aws ecr describe-repositories --repository-names "${dst_repo}" --region "${CDK_AWS_REGION}" > /dev/null 2>&1; then
-        log_info "Creating ECR repository: ${dst_repo}"
-        aws ecr create-repository \
-            --repository-name "${dst_repo}" \
-            --region "${CDK_AWS_REGION}" \
-            --image-scanning-configuration scanOnPush=true \
-            --encryption-configuration encryptionType=AES256 \
-            --tags Key=Project,Value="${CDK_PROJECT_PREFIX}" Key=ManagedBy,Value=GitHubActions
-    fi
-
-    # Pull from source, tag for target, push
-    log_info "Pulling: ${src_image}"
-    docker pull "${src_image}"
-
-    log_info "Tagging: ${dst_image}"
-    docker tag "${src_image}" "${dst_image}"
-
-    log_info "Pushing: ${dst_image}"
-    docker push "${dst_image}"
-
-    # Store the tag in the target SSM parameter so CDK picks it up
-    local dst_ssm_param="/${CDK_PROJECT_PREFIX}/${service_name}/image-tag"
-    log_info "Writing image tag to SSM: ${dst_ssm_param} = ${image_tag}"
-    aws ssm put-parameter \
-        --name "${dst_ssm_param}" \
-        --value "${image_tag}" \
-        --type "String" \
-        --description "Promoted image tag for ${service_name} from ${SOURCE_PROJECT_PREFIX}" \
-        --overwrite \
-        --region "${CDK_AWS_REGION}"
-
-    log_success "Promoted ${service_name} image ${image_tag} from ${src_repo} to ${dst_repo}"
-
-    # Export for downstream workflow steps
-    if [ -n "${GITHUB_OUTPUT:-}" ]; then
-        echo "IMAGE_TAG=${image_tag}" >> "$GITHUB_OUTPUT"
-    fi
-    echo "IMAGE_TAG=${image_tag}" >> "$GITHUB_ENV"
-}
-
-main "$@"
diff --git a/scripts/nightly/ai-coverage-analysis.py b/scripts/nightly/ai-coverage-analysis.py
deleted file mode 100755
index 264211f8c..000000000
--- a/scripts/nightly/ai-coverage-analysis.py
+++ /dev/null
@@ -1,256 +0,0 @@
-#!/usr/bin/env python3
-"""
-AI Coverage Analysis Script
-Uses GitHub Models API to analyze coverage gaps and create/update GitHub issues.
-"""
-
-import json
-import os
-import sys
-from pathlib import Path
-from typing import Dict, List, Optional
-import urllib.request
-import urllib.error
-
-GITHUB_MODELS_API = "https://models.inference.ai.azure.com/chat/completions"
-MODEL = "gpt-4o"
-
-def log_info(msg: str):
-    print(f"[INFO] {msg}")
-
-def log_error(msg: str):
-    print(f"[ERROR] {msg}", file=sys.stderr)
-
-def log_success(msg: str):
-    print(f"[SUCCESS] {msg}")
-
-def call_github_models(prompt: str, token: str) -> Optional[str]:
-    """Call GitHub Models API with GPT-4o."""
-    headers = {
-        'Content-Type': 'application/json',
-        'Authorization': f'Bearer {token}'
-    }
-    
-    data = {
-        'model': MODEL,
-        'messages': [
-            {
-                'role': 'system',
-                'content': 'You are a test coverage analyst. Analyze code coverage gaps and suggest specific test scenarios that should be added.'
-            },
-            {
-                'role': 'user',
-                'content': prompt
-            }
-        ],
-        'temperature': 0.7,
-        'max_tokens': 1000
-    }
-    
-    try:
-        req = urllib.request.Request(
-            GITHUB_MODELS_API,
-            data=json.dumps(data).encode('utf-8'),
-            headers=headers
-        )
-        with urllib.request.urlopen(req) as response:
-            result = json.loads(response.read())
-            return result['choices'][0]['message']['content']
-    except Exception as e:
-        log_error(f"GitHub Models API call failed: {e}")
-        return None
-
-def search_existing_issues(repo: str, token: str, file_path: str) -> Optional[int]:
-    """Search for existing issue about this file's coverage."""
-    query = f"repo:{repo} is:issue is:open label:test-coverage,nightly-build in:title {Path(file_path).name}"
-    api_url = f"https://api.github.com/search/issues?q={urllib.parse.quote(query)}"
-    
-    headers = {
-        'Authorization': f'Bearer {token}',
-        'Accept': 'application/vnd.github.v3+json'
-    }
-    
-    try:
-        req = urllib.request.Request(api_url, headers=headers)
-        with urllib.request.urlopen(req) as response:
-            data = json.loads(response.read())
-            items = data.get('items', [])
-            if items:
-                return items[0]['number']
-    except Exception as e:
-        log_error(f"Error searching issues: {e}")
-    
-    return None
-
-def create_issue(repo: str, token: str, title: str, body: str) -> Optional[int]:
-    """Create a new GitHub issue."""
-    api_url = f"https://api.github.com/repos/{repo}/issues"
-    
-    headers = {
-        'Authorization': f'Bearer {token}',
-        'Accept': 'application/vnd.github.v3+json',
-        'Content-Type': 'application/json'
-    }
-    
-    data = {
-        'title': title,
-        'body': body,
-        'labels': ['test-coverage', 'nightly-build']
-    }
-    
-    try:
-        req = urllib.request.Request(
-            api_url,
-            data=json.dumps(data).encode('utf-8'),
-            headers=headers,
-            method='POST'
-        )
-        with urllib.request.urlopen(req) as response:
-            result = json.loads(response.read())
-            return result['number']
-    except Exception as e:
-        log_error(f"Error creating issue: {e}")
-        return None
-
-def update_issue(repo: str, token: str, issue_number: int, body: str) -> bool:
-    """Update an existing GitHub issue."""
-    api_url = f"https://api.github.com/repos/{repo}/issues/{issue_number}/comments"
-    
-    headers = {
-        'Authorization': f'Bearer {token}',
-        'Accept': 'application/vnd.github.v3+json',
-        'Content-Type': 'application/json'
-    }
-    
-    data = {
-        'body': body
-    }
-    
-    try:
-        req = urllib.request.Request(
-            api_url,
-            data=json.dumps(data).encode('utf-8'),
-            headers=headers,
-            method='POST'
-        )
-        with urllib.request.urlopen(req) as response:
-            return True
-    except Exception as e:
-        log_error(f"Error updating issue: {e}")
-        return False
-
-def analyze_coverage_gap(file_info: Dict, github_token: str) -> Optional[Dict]:
-    """Use AI to analyze coverage gap and generate issue content."""
-    file_path = file_info['file']
-    previous_cov = file_info['previous_coverage']
-    current_cov = file_info['current_coverage']
-    decrease = file_info['decrease']
-    
-    prompt = f"""
-Analyze this test coverage decrease:
-
-File: {file_path}
-Previous Coverage: {previous_cov}%
-Current Coverage: {current_cov}%
-Decrease: {decrease}%
-
-This file is in a critical path (APIs, RBAC, auth, or agents).
-
-Provide:
-1. A brief analysis of why this coverage gap matters
-2. 2-3 specific test scenarios that should be added to improve coverage
-3. Priority level (High/Medium/Low)
-
-Keep the response concise and actionable.
-"""
-    
-    analysis = call_github_models(prompt, github_token)
-    if not analysis:
-        return None
-    
-    return {
-        'file': file_path,
-        'title': f"Test Coverage Decreased: {Path(file_path).name}",
-        'body': f"""## Coverage Decrease Detected
-
-**File:** `{file_path}`
-**Previous Coverage:** {previous_cov}%
-**Current Coverage:** {current_cov}%
-**Decrease:** {decrease}%
-
-## AI Analysis
-
-{analysis}
-
----
-*This issue was automatically generated by the nightly build workflow.*
-*Labels: `test-coverage`, `nightly-build`*
-"""
-    }
-
-def main():
-    log_info("Starting AI coverage analysis...")
-    
-    # Get environment variables
-    repo = os.environ.get('GITHUB_REPOSITORY', '')
-    github_token = os.environ.get('GITHUB_TOKEN', '')
-    
-    if not repo or not github_token:
-        log_error("GITHUB_REPOSITORY and GITHUB_TOKEN environment variables are required")
-        return 1
-    
-    # Load coverage comparison report
-    report_path = Path('coverage-comparison.json')
-    if not report_path.exists():
-        log_error("coverage-comparison.json not found")
-        return 1
-    
-    with open(report_path, 'r') as f:
-        report = json.load(f)
-    
-    total_decreases = report.get('total_decreases', 0)
-    if total_decreases == 0:
-        log_success("No coverage decreases detected. No issues to create.")
-        return 0
-    
-    log_info(f"Analyzing {total_decreases} files with coverage decreases...")
-    
-    all_decreases = report.get('backend_decreases', []) + report.get('frontend_decreases', [])
-    
-    issues_created = 0
-    issues_updated = 0
-    
-    for file_info in all_decreases:
-        file_path = file_info['file']
-        log_info(f"Analyzing {file_path}...")
-        
-        # Generate AI analysis
-        issue_data = analyze_coverage_gap(file_info, github_token)
-        if not issue_data:
-            log_error(f"Failed to generate analysis for {file_path}")
-            continue
-        
-        # Check for existing issue
-        existing_issue = search_existing_issues(repo, github_token, file_path)
-        
-        if existing_issue:
-            log_info(f"Found existing issue #{existing_issue}, updating...")
-            update_body = f"""## Updated Coverage Analysis
-
-{issue_data['body']}
-"""
-            if update_issue(repo, github_token, existing_issue, update_body):
-                log_success(f"Updated issue #{existing_issue}")
-                issues_updated += 1
-        else:
-            log_info("Creating new issue...")
-            issue_number = create_issue(repo, github_token, issue_data['title'], issue_data['body'])
-            if issue_number:
-                log_success(f"Created issue #{issue_number}")
-                issues_created += 1
-    
-    log_success(f"AI coverage analysis complete: {issues_created} issues created, {issues_updated} issues updated")
-    return 0
-
-if __name__ == '__main__':
-    sys.exit(main())