Audited virdx/mono and virdx/infra_k8s release/build paths and converted the design into draft mono PR #323.
Added state-based independent release planning for vxdata-schemas, vxdata-sdk, and vxdata-api, including schemas-to-SDK propagation, deterministic OpenAPI contract detection, API rebuild decisions, and eight planner tests.
Split the SDK Conda recipe from the schemas package, added rolling GitHub App-authored release PR automation, and added post-merge package publishing in dependency order.
Made API requests use the exact release merge SHA and fail closed when the Tekton bridge is unavailable. API tagging and the infra_k8s digest PR are deliberately deferred to a trusted callback after verified image publication.
Removed duplicate manual schemas/SDK release workflows and added documentation, Nx metadata, OpenAPI snapshot checks, and PR gates.
Validated focused tests, package builds, release dry-run, OpenAPI determinism, actionlint/YAML, and a second-agent blocking review.
Lessons Learned: Pitfalls
A local inherited MPLBACKEND=module://matplotlib_inline.backend_inline caused unrelated vxa-sdk test collection failures; MPLBACKEND=Agg proved the suite itself passes.
A first review caught that component src paths alone miss packaging metadata and Docker runtime inputs. Release planners need to track the full artifact input boundary, not just application source.
GitHub workflow_dispatch on a credentialed workflow is unsafe without a trusted-ref guard because dispatch can select another ref. The final workflow removes dispatch and narrows App-token permissions.
Tekton webhook acceptance is not image build success; creating an API tag immediately after enqueue would produce false releases.
Lessons Learned: Improvements
Document the required Tekton webhook/callback contract, GitHub App permissions, and cross-repository infra_k8s token setup before enabling the workflows.
Add a reusable infrastructure pattern for exact-SHA build submission, verified completion callbacks, digest extraction, and rolling staging PR updates.
Record that release-state baselines should use the commit that last changed the state file; this excludes mechanical version edits while preserving detection of later package metadata changes.
