Release Notes

A production build carrying Goblin fails (#86): Goblin must never reach production. Declare quarkus-goblin, quarkus-goblin-metrics and quarkus-goblin-opentelemetry with <scope>provided</scope> in Maven — dev mode and @QuarkusTest keep them, the packaged application does not contain them — or as quarkusDev and testImplementation dependencies in Gradle. Until now a production build shipped the inactive extension; it now stops with Goblin must never reach production and the way to fix it. See Does Goblin run in production?. Code compiled from src/main must not use the Goblin API either — it would fail in the packaged application — so a dev or test build now refuses it and names the class: move an AssaultObserver or a custom Assault to src/test/java, or to an indexed module declared provided. The check covers the main classes of the application module and of the other modules of the build it packages. Remote dev mode (mutable-jar) cannot carry Goblin.

Public API defined and frozen for semantic versioning (#85): the public Java API is the io.quarkiverse.goblin package, everything else moved to io.quarkiverse.goblin.internal and is not covered. See Public API and versioning for the contract and the versioning policy.

The extension moves from preview to stable status: its public API — including the Assault SPI — follows semantic versioning (see Public API and versioning).

AssaultEngine.AssaultRecord gains an assaultType() component, the AssaultType of the recorded assault, next to the type() label: an observer can filter assaults without parsing labels such as response-body-truncate. The label is unchanged, and so are the type metric tag and the goblin.assault.type span attribute.

Resilience testing guides (#88): one page per Fault Tolerance pattern — circuit breakers, retries and fallbacks — each with the layer to arm, a Dev UI walkthrough on the sample application, a @QuarkusTest, what to observe in the history and the ft_* metrics, and the pitfalls; and performance baselines, measuring the reference latency from the client and the server before injecting a known delay. The sample application gains a circuit breaker that recovers in 500 ms and an outgoing REST Client call guarded by @Timeout and @Fallback, both covered by the integration tests.

Structured assault logs (#87): every assault, chaos switched on or off, an auto-off scheduled and every configuration change is logged as a single key=value line in the io.quarkiverse.goblin.events category — timestamp, method, assault type, injected value, configuration snapshot — with the same fields in the MDC for JSON logs. Assaults are logged at INFO, the lifecycle at WARN. See Structured logs.

A custom Assault declared without a scope annotation is registered @ApplicationScoped, as the SPI expects, instead of @Dependent.

A REST Client latency cut short by a @Timeout is recorded as the delay actually endured, not the one drawn: the history, the assault event (value=), the goblin.assault.latency_ms span attribute and the goblin.latency.injected.seconds timer no longer report a 2000 ms delay for a call the timeout ended after 400 ms. The layer faults (SERVICE, DATABASE, MESSAGING) already did.

Reactive routes: when the application has quarkus-reactive-routes, the HTTP_IN layer also assaults @Route methods, with no code change: latency, exception, HTTP status, dependency degradation, response body and response header, recorded with the same labels as a REST resource (#64). On the event loop the latency uses a Vert.x timer, so the loop is never blocked; an injected exception is answered by the router’s failure handlers, including @Route(type = FAILURE) methods, which are never assaulted themselves, and a request is assaulted once, by the first @Route it reaches, even when a pass-through route sits in front of a REST resource. A route is also an entry point for the SERVICE and DATABASE layers below it, and an excluded-package route shields its request like an excluded resource. Reactive-route classes are no longer woven by the SERVICE layer, just like JAX-RS resources. The response body is rewritten when a route ends its response in one go, streamed responses are left untouched, and custom Assault beans are not applied to reactive routes. In the Dev UI, the Inbound REST layer and the REST source chip are renamed Inbound HTTP and inbound HTTP, since they cover both.

The goblin feature is only registered in dev and test builds: a production application no longer lists goblin among its installed features, consistent with the chaos wiring that was already left out of a production build.

getStatus reports inactiveReason (manual, auto-off, disabled, test-mode, launch-mode; absent while active) and the Dev UI status bar shows the reason next to Inactive, so a silent dashboard is no longer a mystery.

AssaultObserver gains onConfigChange(AssaultConfigChange): observers see every configuration change, once per published change (a whole applyConfig included), with the configuration before and after it as read-only snapshots, in dev and test mode — enough to record the exact attack an application went through and replay it after a fix (#71). The method has a default no-op, so existing observers are unaffected.

The Chaos Dashboard and History pages show an animated goblin in their bottom-right corner while chaos is active, and hide it when chaos is off (a still image for reduced motion).

Saved scenarios: save the current assault configuration as a named scenario under .goblin/scenarios/, then load or delete it from the new Scenarios section of the Dev UI, through JSON-RPC (listScenarios, saveScenario, loadScenario, deleteScenario) or Dev MCP, where listScenarios is enabled by default and the three others are opt-in (#49).

Agent playbook and resilience inventory: two Dev MCP resources, enabled by default, for an AI agent driving Goblin (#72). quarkus-goblin_agentPlaybook is the playbook shipped with the extension: safety rules, what each layer means for MicroProfile Fault Tolerance, how to observe an experiment including a circuit breaker’s state through the ft_* metrics, the experiment loop and the report; the Agent playbook page includes the same text, with a RESILIENCE.md template for the application’s own promises. quarkus-goblin_resilienceInventory lists, indexed at build time, every application method guarded by @Timeout, @Retry, @CircuitBreaker, @Fallback, @Bulkhead or @RateLimit, with the effective parameters and the Goblin layers that reach it inside Fault Tolerance. The post-assault assertions (#50) were dropped in favour of this: Goblin provides the signals, the agent or the human concludes.

Deactivating chaos from the Dev UI (master toggle, Disable all kill switch, setActive(false) through JSON-RPC) is no longer undone by the next dev-mode live reload: a deactivation now survives the file save that follows it, and an explicit activation survives the next reload too. Like the auto-off, the decision belongs to the dev session and is kept in a JVM-wide system property, deliberately outside .goblin-state.json, so a new process still takes the active flag from quarkus.goblin.enabled. A test application started by continuous testing keeps its own decision.

The HTTP status and dependency degradation assaults no longer answer a plain-text body declared as application/json: the abort now carries an explicit content type matching the resource contract — application/json with a parseable {"message":"…​","code":<status>} body on JSON resources (a JSON @Produces, or no @Produces and a POJO, collection or map return type), text/plain with the raw message otherwise (#69). Clients switching on the 503 content type may observe text/plain where they previously (incorrectly) saw application/json.

The auto-off is held by the engine instead of the browser: chaos switches itself off at the deadline even when the Dev UI is closed, and a pending auto-off survives a dev-mode live reload. The delay is bounded to 24 hours, and deactivating chaos (master toggle or kill switch) cancels it, while a configuration reset leaves it pending.

New JSON-RPC methods startAutoOff(minutes) and cancelAutoOff(); getStatus exposes the time left in autoOffRemainingMs.

A profile other than NONE also turns the response body assault off and resets the messages of the assaults it enables (INTERMITTENT answers Internal Server Error (Goblin chaos)). The client-side assaults and the armed layers stay untouched.

An application producing an anonymous, local or non-static inner class (for example a MeterFilter returned by a producer method) no longer fails to start: the SERVICE layer only weaves its binding onto classes that can be CDI beans, and never onto constructors.

DATABASE exceptions no longer corrupt the Agroal pool: the fault now fires before a connection is checked out, instead of from the acquire interceptor, which left the connection enlisted in the transaction while back in the pool ("Closing connection in incorrect state CHECKED_IN", ever-growing agroal_active_count).

A request whose entry point sits in an exclude-packages package is no longer assaulted on the SERVICE, DATABASE, MESSAGING or HTTP_OUT layers: the layer used to be resolved before the targeting rules were checked.

Once the auto-off has fired, chaos stays off across live reloads until it is switched on again, and clicking the master toggle just as the deadline elapses no longer switches chaos back on.

A test application started by continuous testing keeps its own auto-off instead of sharing the one of the dev-mode application.

The Dev UI dashboard survives transport errors and out-of-order status replies, and always reports an auto-disable.

Multi-layer chaos assaults with per-request layer resolution (DATABASE → MESSAGING → SERVICE → HTTP_IN, HTTP_OUT rolled per outgoing call), one check-box per layer in the Dev UI, and service-layer assaults on business beans via a CDI interceptor that runs inside the Fault Tolerance machinery — so @Retry, @Fallback, @Timeout and @CircuitBreaker are exercised for real. The DATABASE layer fails or delays JDBC connection acquisition through an Agroal pool interceptor (JDBC, Hibernate ORM, Panache); the MESSAGING layer faults @Incoming consumers outside Fault Tolerance, each consumed message resolving its own layer (#54).

The source of each recorded assault, already tagged in the metrics and traces since 0.2.1 (server, rest-client, webclient), gains the service, database and messaging values, and is now also exposed in the history, the counters and the Markdown report; the Dev UI status bar counts the assaults per source.

The Markdown report describes the armed chaos layers and the client-side assaults.

Chaos no longer activates in test mode by default: set quarkus.goblin.test.enabled=true to assault your @QuarkusTest suite (or call AssaultEngine.setActive(true) from a test). Adding the extension therefore never slows down nor breaks an existing test suite.

The quarkus-goblin-metrics module now depends on the Micrometer API only (quarkus-micrometer): add the registry of your choice, e.g. quarkus-micrometer-registry-prometheus, to expose /q/metrics.

Java API: the targeting rules moved from GoblinConfig.TargetConfig to GoblinTargetingConfig (the property names are unchanged), and AssaultEngine.setStaticConfig is removed.

Every configuration key except the quarkus.goblin.target.include-packages / exclude-packages / exclude-annotations targeting rules is now read at runtime and can be overridden when the application starts. The targeting rules stay fixed at build time and are applied by a single implementation shared by every layer.

No chaos wiring in production builds: the service and messaging interceptor bindings, the database hook and the Dev UI JSON-RPC are only registered in dev and test.

Configuration changes (profile switch, reset, import) are published atomically, and each assault hook reads one consistent snapshot per request. A Dev UI import is staged and applied at once: a rejected payload changes nothing, and values of the wrong type are converted or skipped with a warning.

The assault history records the latency actually endured, including a delay cut short by @Timeout, on every layer.

A blocking latency is never applied on a Vert.x event-loop thread (the WebClient latency uses a timer), and latency values are bounded to 0-300000 ms.

The Dev UI keeps its toggles and forms in sync with the server (changes made from another tab or a JSON-RPC client appear within 2 seconds) and validates response header names before saving.

The Dev UI state file is written as structured JSON; files written by earlier versions are still read.

Quarkus 3.38 and every later version are accepted by the build (including the ecosystem CI snapshot).

A decision left on a worker thread by a failed HTTP request no longer leaks into a later message consumer or scheduled job.

The Dev UI "client" counter counted nothing: assaults are now counted per source.

Saving response header rules with an invalid name no longer erases every rule.

A corrupted or legacy .goblin-state.json no longer prevents the application from starting.

Assault metrics and latency histograms via Micrometer / Prometheus, in the optional quarkus-goblin-metrics module (#51).

Assault tracing via OpenTelemetry — one goblin.assault span per assault with goblin.assault.* attributes, linked to the parent request span, in the optional quarkus-goblin-opentelemetry module (#47).

The chaos engine is initialised in dev and test mode only: a packaged production application no longer reads .goblin-state.json nor activates chaos at startup, and no longer fails with a NullPointerException. In test mode the state file is ignored.

Predefined assault profiles (#35).

Turn the Assault History into a chaos testing console (#37).

Client-side assaults for outgoing REST Client calls (#38).

Client-side assaults for outgoing Vert.x WebClient calls via GoblinWebClient.enable(…​) (#31).

Response body injection assault (#40).

Response header injection assault (#42).

Chaos Dashboard overhaul with live controls and server-driven quick picks (#41).

The enabled flag now always comes from the property, never from persisted state (#39).

Dev UI dashboard with per-assault-type toggles (#10).

Factual markdown report export from the assault history (#13).

Adopt -dev naming for the dev-only extension modules (#14).

Migrate docs to the Antora structure for Quarkiverse publication (#6).

Add the Goblin icon to the extension list (#12).

Server-side assaults: latency, exception, HTTP status and dependency degradation (#1).