0.4.0 — API freeze (pre-1.0 breaking changes)

[alexmond]

The public API of the library modules must be made 1.0-stable before 1.0, because these changes are breaking and can't be made after the semver commitment. From the pre-1.0 deep review.

Blockers

• Replace throws Exception across the public surface with the JhelmException hierarchy (KubeService.java:10-43, every core/action/* method). Narrowing this after 1.0 breaks all callers.
• Stop leaking kubernetes-client types from public API: the ApiClient bean (JhelmKubeAutoConfiguration.java:58) and ApiException on public HelmKubeService/AsyncHelmKubeService methods. Internalize/wrap so the client major version isn't pinned into jhelm's API.
• Stop leaking BouncyCastle PGP types (PGPSecretKey/PGPPublicKeyRingCollection) from SignatureService public methods (SignatureService.java:64,106,158,186). Introduce jhelm-owned key wrappers.

High

• Make result models immutable (Release and model/* are @Data @NoArgsConstructor with public setters used as API value types). Builder + getters, or document as mutable DTOs.
• Introduce a typed ReleaseContext to replace the magic Map<String,Object> releaseInfo ("Name"/"Namespace"/"IsInstall"/…) in Engine.render/TemplateAction.render (Engine.java:182).
• Standardize action-class conventions: return types and not-found semantics (Optional for single lookups, empty List for queries, consistent Release/void for mutations; one not-found convention).
• Remove public setters / non-thread-safe cache from RepoManager (@Setter httpClient/registryManager; HashMap indexCache). Constructor-inject, ConcurrentHashMap, document threading.

Medium / Low

• Adopt an internal package convention (no JPMS, so every public is API today) and document the supported surface; demote static-factory/decorator internals.
• status String → enum on Release; LifecycleListener phase String → enum + typed event.
• TemplateAction.render should inject ChartLoader instead of new ChartLoader() per call.
• RepositoryConfig.Repository snake_case fields → camelCase + @JsonProperty.

Full review context in the 1.0.0 plan. Decisions: plugins disabled-by-default and opt-in REST auth are tracked in 0.6.0.

[alexmond]

API-freeze progress (auto-status)

Blockers

• ⏳ throws Exception off the public surface — KubeService done (refactor(api)!: KubeService throws unchecked domain exceptions (#500) #505), action layer + ChartLoader.load done in refactor(api)!: action layer throws JhelmException, not Exception (#500) #512 (pending review). Remaining: HelmKubeService.listPods/installConfigMap still declare checked ApiException.
• ⬜ kubernetes-client type leak — ApiClient bean + ApiException on public HelmKubeService/AsyncHelmKubeService. Not started.
• ✅ BouncyCastle PGP type leak — done (refactor(api)!: wrap BouncyCastle PGP types behind SigningKey/VerificationKeyring (#500) #506, SigningKey/VerificationKeyring).

The High/Medium/Low items (immutable result models, typed ReleaseContext, action-convention standardization, RepoManager threading, enums, etc.) are still open.

Note: the gotmpl4j-engine concern in #504 ("1.0 depends on an engine still at 0.x") is now moot — gotmpl4j is at 1.1.0; jhelm bump in #510.