diff --git a/.codecov.yml b/.codecov.yml
index 490cadb098e..2fd52ae24ae 100644
--- a/.codecov.yml
+++ b/.codecov.yml
@@ -1,10 +1,49 @@
+codecov:
+  notify:
+    after_n_builds: 3
+
 coverage:
   status:
     project:
-      default:
+      backend:
         target: 80%
         informational: true
+        flags:
+          - backend
+      frontend:
+        target: 80%
+        informational: true
+        flags:
+          - frontend
+      e2e:
+        target: auto
+        informational: true
+        flags:
+          - e2e
     patch:
-      default:
+      backend:
         target: 80%
         informational: true
+        flags:
+          - backend
+      frontend:
+        target: 80%
+        informational: true
+        flags:
+          - frontend
+      e2e:
+        target: auto
+        informational: true
+        flags:
+          - e2e
+
+flags:
+  backend:
+    paths:
+      - openaev-api/src/main/java/
+  frontend:
+    paths:
+      - openaev-front/src/
+  e2e:
+    paths:
+      - openaev-front/src/
diff --git a/.github/actions/api-tests/action.yml b/.github/actions/api-tests/action.yml
new file mode 100644
index 00000000000..956c2d11588
--- /dev/null
+++ b/.github/actions/api-tests/action.yml
@@ -0,0 +1,264 @@
+name: API Tests
+description: >
+  Start service containers (PostgreSQL, Elasticsearch, RabbitMQ, MinIO),
+  download pre-compiled artifacts, and run API tests for a single shard.
+  Requires job-level env vars: EXPLICITLY_SHARDED_TESTS,
+  SPRING_DATASOURCE_URL, SPRING_DATASOURCE_USERNAME,
+  SPRING_DATASOURCE_PASSWORD, MINIO_ENDPOINT, MINIO_PORT, ENGINE_URL,
+  OPENBAS_RABBITMQ_HOSTNAME, GH_TOKEN.
+
+inputs:
+  includes:
+    description: 'Surefire test include patterns (multi-line) or "catchall"'
+    required: true
+  excludes:
+    description: 'Surefire test exclude patterns (multi-line, optional)'
+    required: false
+    default: ''
+  shard:
+    description: Shard number (used for artifact naming)
+    required: true
+  shard-name:
+    description: Shard display name
+    required: true
+
+runs:
+  using: composite
+  steps:
+
+    - name: Start all services (non-blocking)
+      shell: bash
+      run: |
+        docker run -d --name pgsql \
+          -p 5432:5432 \
+          -e POSTGRES_USER=openaev \
+          -e POSTGRES_PASSWORD=openaev \
+          -e POSTGRES_DB=openaev \
+          postgres:17-alpine \
+          -c max_connections=1000
+        docker run -d --name elasticsearch \
+          -p 9200:9200 \
+          -e discovery.type=single-node \
+          -e xpack.security.enabled=false \
+          -e "ES_JAVA_OPTS=-Xms2g -Xmx2g" \
+          docker.elastic.co/elasticsearch/elasticsearch:8.18.3
+        docker run -d --name rabbitmq \
+          -p 5672:5672 \
+          -p 15672:15672 \
+          -e RABBITMQ_DEFAULT_USER=guest \
+          -e RABBITMQ_DEFAULT_PASS=guest \
+          rabbitmq:4.1-management
+        docker run -d --name minio \
+          -p 9000:9000 \
+          -e MINIO_ROOT_USER=minioadmin \
+          -e MINIO_ROOT_PASSWORD=minioadmin \
+          minio/minio:RELEASE.2025-06-13T11-33-47Z server /data
+
+        echo "🔍 Verifying containers started..."
+        for name in pgsql elasticsearch rabbitmq minio; do
+          if ! docker inspect --format='{{.State.Running}}' "$name" 2>/dev/null | grep -q true; then
+            echo "❌ Container '$name' failed to start"
+            docker logs "$name" 2>/dev/null || true
+            exit 1
+          fi
+        done
+        echo "✅ All containers started"
+
+    - name: Set up Java 21
+      uses: actions/setup-java@v5
+      with:
+        java-version: "21"
+        distribution: temurin
+        cache: maven
+
+    - name: Wait for and download compiled artifacts
+      shell: bash
+      run: |
+        echo "⏳ Waiting for backend-compile artifacts (services booting in parallel)..."
+        for i in $(seq 1 120); do
+          HTTP_CODE=$(gh api "repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts" \
+            --include 2>&1 | head -1 | awk '{print $2}' || echo "000")
+          NAMES=$(gh api "repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts" \
+            --jq '[.artifacts[].name]' 2>/dev/null || echo "[]")
+          if [ "$HTTP_CODE" != "200" ] && [ "$HTTP_CODE" != "000" ]; then
+            echo "⚠️ GitHub API returned HTTP $HTTP_CODE (attempt $i/120)"
+          fi
+          if echo "$NAMES" | grep -q '"api-build-output"'; then
+            echo "✅ Artifacts available (after ~$((i * 5))s)"
+            break
+          fi
+          if [ "$i" -eq 120 ]; then
+            echo "❌ Timed out waiting for artifacts (10 min)"
+            exit 1
+          fi
+          echo "  Attempt $i/120 — not ready, retrying in 5s..."
+          sleep 5
+        done
+
+        echo "📥 Downloading backend-compiled..."
+        if ! gh run download "${{ github.run_id }}" -n backend-compiled -D ~/.m2/repository/io/openaev/; then
+          echo "❌ Failed to download backend-compiled artifact"
+          exit 1
+        fi
+        echo "📥 Downloading api-build-output..."
+        if ! gh run download "${{ github.run_id }}" -n api-build-output -D openaev-api/target; then
+          echo "❌ Failed to download api-build-output artifact"
+          exit 1
+        fi
+
+        echo "🔍 Post-download: listing ~/.m2/repository/io/openaev/ (top 3 levels):"
+        find ~/.m2/repository/io/openaev/ -maxdepth 3 -type d 2>/dev/null | head -20 || echo "  directory does not exist"
+        echo "---"
+        echo "🔍 Post-download: listing openaev-api/target/ (top 3 levels):"
+        find openaev-api/target/ -maxdepth 3 -type d 2>/dev/null | head -20 || echo "  directory does not exist"
+        echo "---"
+
+    - name: Verify downloaded artifacts
+      shell: bash
+      run: |
+        echo "🔍 Listing openaev-api/target/ (top 5 levels):"
+        find openaev-api/target/ -maxdepth 5 -type d 2>/dev/null | head -40 || echo "  openaev-api/target/ does not exist"
+        echo "---"
+
+        # ── Fix double-nesting from gh run download ──
+        # upload-artifact@v7 may store paths with the full prefix inside
+        # the zip, so gh run download -D openaev-api/target can produce
+        # openaev-api/target/openaev-api/target/classes/ instead of
+        # openaev-api/target/classes/.  Detect and flatten.
+        if [ -d "openaev-api/target/openaev-api/target" ]; then
+          echo "⚠️ Detected double-nested artifact path — flattening..."
+          cp -rn openaev-api/target/openaev-api/target/* openaev-api/target/ 2>/dev/null || true
+          rm -rf openaev-api/target/openaev-api
+          echo "✅ Flattened double-nested paths"
+        fi
+
+        # Note: use "|| true" after "head" to prevent SIGPIPE from
+        # propagating under bash -eo pipefail (GitHub Actions default).
+        MVN_JARS=$(find ~/.m2/repository/io/openaev/ -name '*.jar' 2>/dev/null | head -5 || true)
+        if [ -z "$MVN_JARS" ]; then
+          echo "❌ No Maven JARs found in ~/.m2/repository/io/openaev/"
+          echo "🔍 Listing ~/.m2/repository/io/openaev/ (top 4 levels):"
+          find ~/.m2/repository/io/openaev/ -maxdepth 4 2>/dev/null | head -30 || true
+          exit 1
+        fi
+        MVN_JAR_COUNT=$(find ~/.m2/repository/io/openaev/ -name '*.jar' 2>/dev/null | wc -l || true)
+        echo "✅ Maven artifacts found ($MVN_JAR_COUNT JARs)"
+
+        if [ ! -d "openaev-api/target/classes" ]; then
+          echo "❌ openaev-api/target/classes/ directory does not exist"
+          echo "🔍 Actual contents of openaev-api/target/:"
+          ls -la openaev-api/target/ 2>/dev/null || echo "  target/ directory does not exist"
+          exit 1
+        fi
+        echo "✅ Compiled classes present"
+
+        TEST_CLASS_COUNT=$(find openaev-api/target/test-classes -name '*Test.class' 2>/dev/null | wc -l || true)
+        echo "  🔍 Found $TEST_CLASS_COUNT *Test.class file(s) in test-classes/"
+        if [ "$TEST_CLASS_COUNT" -eq 0 ]; then
+          echo "❌ No test classes found in openaev-api/target/test-classes/"
+          echo "🔍 Actual contents of openaev-api/target/test-classes/ (top 6 levels):"
+          find openaev-api/target/test-classes -maxdepth 6 2>/dev/null | head -40 || echo "  test-classes/ does not exist"
+          echo "🔍 Sample .class files (any name):"
+          find openaev-api/target/test-classes -name '*.class' 2>/dev/null | head -10 || echo "  none"
+          exit 1
+        fi
+        echo "✅ Test classes found ($TEST_CLASS_COUNT *Test.class files)"
+
+    - name: Wait for services
+      shell: bash
+      run: |
+        echo "⏳ Waiting for PostgreSQL..."
+        for i in $(seq 1 30); do
+          docker exec pgsql pg_isready -U openaev && break
+          sleep 1
+        done
+        docker exec pgsql pg_isready -U openaev || { echo "❌ PostgreSQL failed to start"; exit 1; }
+
+        echo "⏳ Waiting for Elasticsearch..."
+        for i in $(seq 1 30); do
+          curl -sf http://localhost:9200/_cluster/health && break
+          sleep 2
+        done
+        curl -sf http://localhost:9200/_cluster/health || { echo "❌ Elasticsearch failed to start"; exit 1; }
+
+        echo "⏳ Waiting for RabbitMQ..."
+        for i in $(seq 1 30); do
+          docker exec rabbitmq rabbitmq-diagnostics -q check_running 2>/dev/null && break
+          sleep 2
+        done
+        docker exec rabbitmq rabbitmq-diagnostics -q check_running || { echo "❌ RabbitMQ failed to start"; exit 1; }
+
+        echo "⏳ Waiting for MinIO..."
+        for i in $(seq 1 30); do
+          curl -sf http://localhost:9000/minio/health/live && break
+          sleep 1
+        done
+        curl -sf http://localhost:9000/minio/health/live || { echo "❌ MinIO failed to start"; exit 1; }
+
+        echo "✅ All services ready"
+
+    - name: Prepare test suite
+      id: suite
+      shell: bash
+      env:
+        SHARD_INCLUDES: ${{ inputs.includes }}
+        SHARD_EXCLUDES: ${{ inputs.excludes }}
+      run: |
+        if [ "$SHARD_INCLUDES" = "catchall" ]; then
+          echo "$EXPLICITLY_SHARDED_TESTS" > /tmp/surefire-excludes.txt
+          echo "surefire_arg=-Dsurefire.excludesFile=/tmp/surefire-excludes.txt" >> "$GITHUB_OUTPUT"
+          echo "🔄 Catch-all shard: running all tests NOT assigned to shards 1–3"
+          cat /tmp/surefire-excludes.txt
+        else
+          echo "$SHARD_INCLUDES" > /tmp/surefire-includes.txt
+          ARGS="-Dsurefire.includesFile=/tmp/surefire-includes.txt"
+          if [ -n "$SHARD_EXCLUDES" ]; then
+            echo "$SHARD_EXCLUDES" > /tmp/surefire-excludes.txt
+            ARGS="$ARGS -Dsurefire.excludesFile=/tmp/surefire-excludes.txt"
+            echo "📋 Include patterns:"
+            cat /tmp/surefire-includes.txt
+            echo "🚫 Exclude patterns:"
+            cat /tmp/surefire-excludes.txt
+          else
+            echo "📋 Include patterns:"
+            cat /tmp/surefire-includes.txt
+          fi
+          echo "surefire_arg=$ARGS" >> "$GITHUB_OUTPUT"
+        fi
+
+    - name: Run API tests (shard ${{ inputs.shard }} — ${{ inputs.shard-name }})
+      id: run-tests
+      shell: bash
+      # Run the 'test' lifecycle phase so that JaCoCo's prepare-agent
+      # execution (bound to 'initialize' in pom.xml) fires through the
+      # normal lifecycle and properly sets the argLine property BEFORE
+      # Surefire reads it.  Compilation is skipped because the classes
+      # are already downloaded from the backend-compile job.
+      run: >-
+        mvn -B -ntp -pl openaev-api test
+        -Dmaven.compiler.skip=true
+        ${{ steps.suite.outputs.surefire_arg }}
+    - name: Verify JaCoCo exec data
+      if: ${{ !cancelled() }}
+      shell: bash
+      run: |
+        EXEC_FILE="openaev-api/target/jacoco.exec"
+        if [ -f "$EXEC_FILE" ]; then
+          SIZE=$(stat --format=%s "$EXEC_FILE" 2>/dev/null || stat -f%z "$EXEC_FILE" 2>/dev/null)
+          echo "✅ $EXEC_FILE exists ($SIZE bytes)"
+        else
+          echo "❌ $EXEC_FILE not found after test run"
+          echo "   Test step outcome: ${{ steps.run-tests.outcome }}"
+          echo "   Contents of openaev-api/target/:"
+          ls -la openaev-api/target/ 2>/dev/null || echo "   directory does not exist"
+          echo "   Surefire reports:"
+          ls -la openaev-api/target/surefire-reports/ 2>/dev/null || echo "   no surefire-reports/"
+          exit 1
+        fi
+    - name: Upload JaCoCo exec data
+      if: ${{ !cancelled() }}
+      uses: actions/upload-artifact@v7
+      with:
+        name: jacoco-exec-shard-${{ inputs.shard }}
+        path: openaev-api/target/jacoco.exec
+        if-no-files-found: error
diff --git a/.github/actions/backend-compile/action.yml b/.github/actions/backend-compile/action.yml
new file mode 100644
index 00000000000..040fb40e7ad
--- /dev/null
+++ b/.github/actions/backend-compile/action.yml
@@ -0,0 +1,31 @@
+name: Backend Compile
+description: Compile all Maven modules and upload compiled artifacts
+
+runs:
+  using: composite
+  steps:
+    - name: Set up Java 21
+      uses: actions/setup-java@v5
+      with:
+        java-version: "21"
+        distribution: temurin
+        cache: maven
+    - name: Compile and install all modules (skip tests)
+      run: >-
+        mvn -B -ntp -T 1C install -DskipTests
+        -Dspring-boot.repackage.skip=true
+        -Djacoco.skip=true
+      shell: bash
+    - name: Upload compiled Maven artifacts
+      uses: actions/upload-artifact@v7
+      with:
+        name: backend-compiled
+        path: ~/.m2/repository/io/openaev/
+    - name: Upload API build output
+      uses: actions/upload-artifact@v7
+      with:
+        name: api-build-output
+        path: |
+          openaev-api/target/classes/
+          openaev-api/target/test-classes/
+
diff --git a/.github/actions/backend-package-musl/action.yml b/.github/actions/backend-package-musl/action.yml
new file mode 100644
index 00000000000..7c720995145
--- /dev/null
+++ b/.github/actions/backend-package-musl/action.yml
@@ -0,0 +1,81 @@
+name: Backend Package (musl)
+description: >
+  Download pre-compiled artifacts, package the backend fat JAR inside an
+  Alpine/musl container, verify it, and upload the artifact.
+  The calling job MUST set container: maven:3.9.14-eclipse-temurin-21-alpine.
+
+outputs:
+  jar-size:
+    description: Size of the packaged JAR in bytes
+    value: ${{ steps.verify-jar.outputs.jar_size }}
+
+runs:
+  using: composite
+  steps:
+    - name: Install Alpine dependencies
+      run: apk add --no-cache git
+      shell: sh
+    - name: Download frontend build artifact
+      uses: actions/download-artifact@v8
+      with:
+        name: frontend-build
+        path: openaev-front/builder/prod/build
+    - name: Download compiled Maven artifacts
+      uses: actions/download-artifact@v8
+      with:
+        name: backend-compiled
+        path: /root/.m2/repository/io/openaev/
+    - name: Download release assets
+      uses: actions/download-artifact@v8
+      with:
+        name: release-assets
+        path: openaev-api/src/main/resources
+    - name: Verify downloaded artifacts
+      run: |
+        # Verify frontend build
+        if [ ! -d "openaev-front/builder/prod/build" ] || [ -z "$(ls -A openaev-front/builder/prod/build 2>/dev/null)" ]; then
+          echo "❌ Frontend build artifacts missing or empty"
+          exit 1
+        fi
+        echo "✅ Frontend build present"
+
+        # Verify Maven artifacts
+        MVN_JARS=$(find /root/.m2/repository/io/openaev/ -name '*.jar' 2>/dev/null | head -5)
+        if [ -z "$MVN_JARS" ]; then
+          echo "❌ No Maven JARs found in /root/.m2/repository/io/openaev/"
+          exit 1
+        fi
+        echo "✅ Maven artifacts found"
+
+        # Verify release assets
+        if [ ! -d "openaev-api/src/main/resources/catalog" ]; then
+          echo "❌ Release assets (catalog) missing"
+          exit 1
+        fi
+        echo "✅ Release assets present"
+      shell: sh
+    - name: Package backend JAR (musl)
+      run: mvn -B -ntp -q -pl openaev-api package -DskipTests
+      shell: sh
+    - name: Verify packaged JAR (musl)
+      id: verify-jar
+      run: |
+        if [ ! -f "openaev-api/target/openaev-api.jar" ]; then
+          echo "❌ openaev-api.jar (musl) was not produced"
+          ls -la openaev-api/target/ 2>/dev/null || echo "  target/ directory does not exist"
+          exit 1
+        fi
+        JAR_SIZE=$(stat -c%s openaev-api/target/openaev-api.jar 2>/dev/null || wc -c < openaev-api/target/openaev-api.jar)
+        if [ "$JAR_SIZE" -lt 1000 ] 2>/dev/null; then
+          echo "❌ openaev-api.jar (musl) is suspiciously small ($JAR_SIZE bytes)"
+          exit 1
+        fi
+        echo "✅ openaev-api.jar (musl) produced ($JAR_SIZE bytes)"
+        echo "jar_size=$JAR_SIZE" >> "$GITHUB_OUTPUT"
+      shell: sh
+    - name: Upload musl JAR artifact
+      uses: actions/upload-artifact@v7
+      with:
+        name: openaev-api-jar-musl
+        path: openaev-api/target/openaev-api.jar
+
diff --git a/.github/actions/backend-package/action.yml b/.github/actions/backend-package/action.yml
new file mode 100644
index 00000000000..c3a6c81b08d
--- /dev/null
+++ b/.github/actions/backend-package/action.yml
@@ -0,0 +1,84 @@
+name: Backend Package
+description: >
+  Download pre-compiled artifacts, package the backend fat JAR (glibc),
+  verify it, and upload the artifact.
+
+inputs:
+  download-release-assets:
+    description: Whether to download the release-assets artifact
+    required: false
+    default: 'false'
+
+outputs:
+  jar-size:
+    description: Size of the packaged JAR in bytes
+    value: ${{ steps.verify-jar.outputs.jar_size }}
+
+runs:
+  using: composite
+  steps:
+    - name: Download frontend build artifact
+      uses: actions/download-artifact@v8
+      with:
+        name: frontend-build
+        path: openaev-front/builder/prod/build
+    - name: Download compiled Maven artifacts
+      uses: actions/download-artifact@v8
+      with:
+        name: backend-compiled
+        path: ~/.m2/repository/io/openaev/
+    - name: Download release assets (agents, implants, catalog)
+      if: ${{ inputs.download-release-assets == 'true' }}
+      uses: actions/download-artifact@v8
+      with:
+        name: release-assets
+        path: openaev-api/src/main/resources
+    - name: Set up Java 21
+      uses: actions/setup-java@v5
+      with:
+        java-version: "21"
+        distribution: temurin
+        cache: maven
+    - name: Verify downloaded artifacts
+      run: |
+        # Verify frontend build
+        if [ ! -d "openaev-front/builder/prod/build" ] || [ -z "$(ls -A openaev-front/builder/prod/build 2>/dev/null)" ]; then
+          echo "❌ Frontend build artifacts missing or empty"
+          ls -la openaev-front/builder/prod/ 2>/dev/null || echo "  directory does not exist"
+          exit 1
+        fi
+        echo "✅ Frontend build present ($(find openaev-front/builder/prod/build -type f | wc -l) files)"
+
+        # Verify Maven artifacts
+        MVN_JARS=$(find ~/.m2/repository/io/openaev/ -name '*.jar' 2>/dev/null | head -5)
+        if [ -z "$MVN_JARS" ]; then
+          echo "❌ No Maven JARs found in ~/.m2/repository/io/openaev/"
+          exit 1
+        fi
+        echo "✅ Maven artifacts found"
+      shell: bash
+    - name: Package backend JAR
+      run: mvn -B -ntp -q -pl openaev-api package -DskipTests
+      shell: bash
+    - name: Verify packaged JAR
+      id: verify-jar
+      run: |
+        if [ ! -f "openaev-api/target/openaev-api.jar" ]; then
+          echo "❌ openaev-api.jar was not produced"
+          ls -la openaev-api/target/ 2>/dev/null || echo "  target/ directory does not exist"
+          exit 1
+        fi
+        JAR_SIZE=$(stat --format=%s openaev-api/target/openaev-api.jar 2>/dev/null || stat -f%z openaev-api/target/openaev-api.jar 2>/dev/null)
+        if [ "$JAR_SIZE" -lt 1000 ] 2>/dev/null; then
+          echo "❌ openaev-api.jar is suspiciously small ($JAR_SIZE bytes)"
+          exit 1
+        fi
+        echo "✅ openaev-api.jar produced ($JAR_SIZE bytes)"
+        echo "jar_size=$JAR_SIZE" >> "$GITHUB_OUTPUT"
+      shell: bash
+    - name: Upload backend JAR artifact
+      uses: actions/upload-artifact@v7
+      with:
+        name: openaev-api-jar
+        path: openaev-api/target/openaev-api.jar
+
diff --git a/.github/actions/docker-build-push/action.yml b/.github/actions/docker-build-push/action.yml
new file mode 100644
index 00000000000..6227f875aa7
--- /dev/null
+++ b/.github/actions/docker-build-push/action.yml
@@ -0,0 +1,283 @@
+name: Docker Build & Validate (Multi-arch)
+description: >
+  Build multi-arch Docker images (linux/amd64 + linux/arm64) for standard and
+  optionally UBI9 variants.  Uses buildx + QEMU to produce OCI archives
+  containing both platforms, validates the amd64 variant locally, and uploads
+  the archives as artifacts.  This action NEVER pushes to any external
+  registry.  The calling job MUST run actions/checkout before this action.
+
+inputs:
+  tags:
+    description: >
+      Docker image tags (newline or comma-separated). Passed directly to
+      docker/build-push-action.
+    required: true
+  labels:
+    description: Docker image labels (from docker/metadata-action)
+    required: false
+    default: ""
+  build-ubi9:
+    description: >
+      When 'true', also build a UBI9-based Docker image from Dockerfile_ubi9_ga.
+    required: false
+    default: "false"
+  ubi9-tags:
+    description: >
+      Docker image tags for the UBI9 variant (newline or comma-separated).
+      Required when build-ubi9 is 'true'.
+    required: false
+    default: ""
+  ubi9-labels:
+    description: Docker image labels for the UBI9 variant
+    required: false
+    default: ""
+
+outputs:
+  digest:
+    description: Docker image digest (standard image)
+    value: ${{ steps.docker-build.outputs.digest }}
+  ubi9-digest:
+    description: Docker image digest (UBI9 image)
+    value: ${{ steps.docker-build-ubi9.outputs.digest }}
+  image_size_mb:
+    description: Docker image size in MB
+    value: ${{ steps.docker-validate.outputs.image_size_mb }}
+  image_warning:
+    description: Whether image size is suspiciously small
+    value: ${{ steps.docker-validate.outputs.image_warning }}
+  jar_in_image:
+    description: Whether openaev-api.jar was found inside the image
+    value: ${{ steps.docker-validate.outputs.jar_in_image }}
+  java_version:
+    description: Java version inside the image
+    value: ${{ steps.docker-validate.outputs.java_version }}
+  layer_count:
+    description: Number of image layers
+    value: ${{ steps.docker-validate.outputs.layer_count }}
+  ubi9_image_size_mb:
+    description: UBI9 Docker image size in MB
+    value: ${{ steps.docker-validate-ubi9.outputs.image_size_mb }}
+  ubi9_jar_in_image:
+    description: Whether openaev-api.jar was found inside UBI9 image
+    value: ${{ steps.docker-validate-ubi9.outputs.jar_in_image }}
+  ubi9_java_version:
+    description: Java version inside UBI9 image
+    value: ${{ steps.docker-validate-ubi9.outputs.java_version }}
+
+runs:
+  using: composite
+  steps:
+    - name: Validate inputs
+      run: |
+        if [ "${{ inputs.build-ubi9 }}" = "true" ] && [ -z "${{ inputs.ubi9-tags }}" ]; then
+          echo "❌ ubi9-tags is required when build-ubi9 is 'true'"
+          exit 1
+        fi
+      shell: bash
+
+    - name: Download backend JAR artifact
+      uses: actions/download-artifact@v8
+      with:
+        name: openaev-api-jar
+        path: openaev-build
+
+    - name: Verify backend JAR
+      run: |
+        if [ ! -f "openaev-build/openaev-api.jar" ]; then
+          echo "❌ openaev-api.jar not found in openaev-build/"
+          ls -la openaev-build/ 2>/dev/null || echo "  directory does not exist"
+          exit 1
+        fi
+        JAR_SIZE=$(stat --format=%s openaev-build/openaev-api.jar 2>/dev/null || stat -f%z openaev-build/openaev-api.jar 2>/dev/null)
+        if [ "$JAR_SIZE" -lt 1000 ] 2>/dev/null; then
+          echo "❌ openaev-api.jar is suspiciously small ($JAR_SIZE bytes)"
+          exit 1
+        fi
+        echo "✅ openaev-api.jar present for Docker build ($JAR_SIZE bytes)"
+      shell: bash
+
+    - name: Set up QEMU (for arm64 emulation)
+      uses: docker/setup-qemu-action@v4
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v4
+
+    # ── Standard image (multi-arch) ────────────────────────────────
+    - name: Build standard image (multi-arch OCI archive)
+      id: docker-build
+      uses: docker/build-push-action@v7
+      with:
+        context: .
+        file: ./Dockerfile_ga
+        platforms: linux/amd64,linux/arm64
+        push: false
+        outputs: type=oci,dest=openaev-image.tar
+        tags: ${{ inputs.tags }}
+        labels: ${{ inputs.labels }}
+
+    - name: Compress standard OCI archive
+      run: |
+        gzip openaev-image.tar
+        TAR_SIZE=$(stat --format=%s openaev-image.tar.gz 2>/dev/null || stat -f%z openaev-image.tar.gz 2>/dev/null)
+        TAR_SIZE_MB=$(awk "BEGIN {printf \"%.1f\", $TAR_SIZE / 1048576}")
+        echo "✅ Standard multi-arch OCI archive (${TAR_SIZE_MB} MB compressed)"
+      shell: bash
+
+    - name: Validate standard Docker image (amd64)
+      id: docker-validate
+      run: |
+        # Load only the amd64 variant into the local daemon for validation
+        gunzip -k openaev-image.tar.gz
+        skopeo copy --override-os linux --override-arch amd64 \
+          oci-archive:openaev-image.tar \
+          docker-daemon:openaev-validate:amd64
+        rm -f openaev-image.tar
+        IMAGE="openaev-validate:amd64"
+
+        # Verify multi-arch manifest contains both platforms
+        echo "── Multi-arch manifest ──"
+        skopeo inspect --raw oci-archive:openaev-image.tar.gz \
+          | python3 -c "
+        import json, sys
+        idx = json.load(sys.stdin)
+        manifests = idx.get('manifests', [])
+        for m in manifests:
+            p = m.get('platform', {})
+            print(f\"  {p.get('os','?')}/{p.get('architecture','?')}\")
+        " || echo "  (could not inspect manifest)"
+
+        # Check image size
+        IMAGE_SIZE=$(docker image inspect "$IMAGE" --format='{{.Size}}')
+        IMAGE_SIZE_MB=$(awk "BEGIN {printf \"%.1f\", $IMAGE_SIZE / 1048576}")
+        echo "image_size=$IMAGE_SIZE"       >> "$GITHUB_OUTPUT"
+        echo "image_size_mb=$IMAGE_SIZE_MB" >> "$GITHUB_OUTPUT"
+        echo "  Image size: ${IMAGE_SIZE_MB} MB"
+
+        if [ "$IMAGE_SIZE" -lt 209715200 ]; then
+          echo "⚠️ Docker image is only ${IMAGE_SIZE_MB} MB — suspiciously small"
+          echo "image_warning=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "✅ Docker image size looks healthy"
+          echo "image_warning=false" >> "$GITHUB_OUTPUT"
+        fi
+
+        # Verify JAR is inside the image
+        JAR_CHECK_ERR=$(mktemp)
+        JAR_IN_IMAGE=$(docker run --rm --entrypoint ls "$IMAGE" -la /opt/openaev-api.jar 2>"$JAR_CHECK_ERR") || true
+        if [ -z "$JAR_IN_IMAGE" ]; then
+          echo "❌ openaev-api.jar NOT found inside Docker image at /opt/openaev-api.jar"
+          if [ -s "$JAR_CHECK_ERR" ]; then
+            echo "  Error: $(cat "$JAR_CHECK_ERR")"
+          fi
+          echo "  Listing /opt/ contents for diagnostics:"
+          docker run --rm --entrypoint ls "$IMAGE" -la /opt/ 2>/dev/null \
+            | sed 's/^/    /' || echo "    (could not list /opt/)"
+          echo "jar_in_image=false" >> "$GITHUB_OUTPUT"
+        else
+          echo "✅ openaev-api.jar found inside Docker image"
+          echo "  $JAR_IN_IMAGE"
+          echo "jar_in_image=true" >> "$GITHUB_OUTPUT"
+        fi
+        rm -f "$JAR_CHECK_ERR"
+
+        # Verify Java is available
+        JAVA_VERSION=$(docker run --rm --entrypoint java "$IMAGE" -version 2>&1 | head -1) || true
+        if [ -z "$JAVA_VERSION" ]; then
+          echo "❌ Java runtime not found inside Docker image"
+          echo "java_version=NOT_FOUND" >> "$GITHUB_OUTPUT"
+        else
+          echo "  Java: $JAVA_VERSION"
+          echo "java_version=$JAVA_VERSION" >> "$GITHUB_OUTPUT"
+        fi
+
+        # Count layers
+        LAYER_COUNT=$(docker image inspect "$IMAGE" --format='{{len .RootFS.Layers}}')
+        echo "  Layers: $LAYER_COUNT"
+        echo "layer_count=$LAYER_COUNT" >> "$GITHUB_OUTPUT"
+      shell: bash
+
+    - name: Upload standard Docker image artifact
+      uses: actions/upload-artifact@v7
+      with:
+        name: openaev-image
+        path: openaev-image.tar.gz
+        retention-days: 1
+
+    # ── UBI9 image (multi-arch) ───────────────────────────────────
+    - name: Build UBI9 image (multi-arch OCI archive)
+      id: docker-build-ubi9
+      if: ${{ inputs.build-ubi9 == 'true' }}
+      uses: docker/build-push-action@v7
+      with:
+        context: .
+        file: ./Dockerfile_ubi9_ga
+        platforms: linux/amd64,linux/arm64
+        push: false
+        outputs: type=oci,dest=openaev-ubi9-image.tar
+        tags: ${{ inputs.ubi9-tags }}
+        labels: ${{ inputs.ubi9-labels }}
+
+    - name: Compress UBI9 OCI archive
+      if: ${{ inputs.build-ubi9 == 'true' }}
+      run: |
+        gzip openaev-ubi9-image.tar
+        TAR_SIZE=$(stat --format=%s openaev-ubi9-image.tar.gz 2>/dev/null || stat -f%z openaev-ubi9-image.tar.gz 2>/dev/null)
+        TAR_SIZE_MB=$(awk "BEGIN {printf \"%.1f\", $TAR_SIZE / 1048576}")
+        echo "✅ UBI9 multi-arch OCI archive (${TAR_SIZE_MB} MB compressed)"
+      shell: bash
+
+    - name: Validate UBI9 Docker image (amd64)
+      id: docker-validate-ubi9
+      if: ${{ inputs.build-ubi9 == 'true' }}
+      run: |
+        # Load only the amd64 variant into the local daemon for validation
+        gunzip -k openaev-ubi9-image.tar.gz
+        skopeo copy --override-os linux --override-arch amd64 \
+          oci-archive:openaev-ubi9-image.tar \
+          docker-daemon:openaev-ubi9-validate:amd64
+        rm -f openaev-ubi9-image.tar
+        IMAGE="openaev-ubi9-validate:amd64"
+
+        # Check image size
+        IMAGE_SIZE=$(docker image inspect "$IMAGE" --format='{{.Size}}')
+        IMAGE_SIZE_MB=$(awk "BEGIN {printf \"%.1f\", $IMAGE_SIZE / 1048576}")
+        echo "image_size_mb=$IMAGE_SIZE_MB" >> "$GITHUB_OUTPUT"
+        echo "  UBI9 Image size: ${IMAGE_SIZE_MB} MB"
+
+        if [ "$IMAGE_SIZE" -lt 209715200 ]; then
+          echo "⚠️ UBI9 Docker image is only ${IMAGE_SIZE_MB} MB — suspiciously small"
+        else
+          echo "✅ UBI9 Docker image size looks healthy"
+        fi
+
+        # Verify JAR is inside the image
+        JAR_IN_IMAGE=$(docker run --rm --entrypoint ls "$IMAGE" -la /opt/openaev/openaev-api.jar 2>/dev/null) || true
+        if [ -z "$JAR_IN_IMAGE" ]; then
+          echo "❌ openaev-api.jar NOT found inside UBI9 Docker image"
+          echo "  Listing /opt/openaev/ contents:"
+          docker run --rm --entrypoint ls "$IMAGE" -la /opt/openaev/ 2>/dev/null \
+            | sed 's/^/    /' || echo "    (could not list /opt/openaev/)"
+          echo "jar_in_image=false" >> "$GITHUB_OUTPUT"
+          exit 1
+        fi
+        echo "✅ openaev-api.jar found inside UBI9 Docker image"
+        echo "jar_in_image=true" >> "$GITHUB_OUTPUT"
+
+        # Verify Java is available
+        JAVA_VERSION=$(docker run --rm --entrypoint java "$IMAGE" -version 2>&1 | head -1) || true
+        if [ -n "$JAVA_VERSION" ]; then
+          echo "  Java: $JAVA_VERSION"
+          echo "java_version=$JAVA_VERSION" >> "$GITHUB_OUTPUT"
+        else
+          echo "⚠️ Could not determine Java version"
+          echo "java_version=NOT_FOUND" >> "$GITHUB_OUTPUT"
+        fi
+      shell: bash
+
+    - name: Upload UBI9 Docker image artifact
+      if: ${{ inputs.build-ubi9 == 'true' }}
+      uses: actions/upload-artifact@v7
+      with:
+        name: openaev-ubi9-image
+        path: openaev-ubi9-image.tar.gz
+        retention-days: 1
diff --git a/.github/actions/e2e-tests/action.yml b/.github/actions/e2e-tests/action.yml
new file mode 100644
index 00000000000..22d6f0a1f72
--- /dev/null
+++ b/.github/actions/e2e-tests/action.yml
@@ -0,0 +1,226 @@
+name: E2E & API Types
+description: >
+  Start service containers (PostgreSQL, Elasticsearch, RabbitMQ, MinIO),
+  download and run the backend JAR, run Playwright E2E tests, and verify
+  API types are up to date.
+  Requires job-level env vars: SPRING_DATASOURCE_URL,
+  SPRING_DATASOURCE_USERNAME, SPRING_DATASOURCE_PASSWORD,
+  MINIO_ENDPOINT, MINIO_PORT, MINIO_ACCESS_KEY, MINIO_ACCESS_SECRET,
+  ENGINE_URL, OPENBAS_RABBITMQ_HOSTNAME, OPENAEV_ADMIN_EMAIL,
+  OPENAEV_ADMIN_PASSWORD, OPENAEV_ADMIN_TOKEN,
+  OPENAEV_ADMIN_ENCRYPTION_KEY, OPENAEV_ADMIN_ENCRYPTION_SALT,
+  SPRING_PROFILES_ACTIVE, GH_TOKEN.
+
+runs:
+  using: composite
+  steps:
+
+    - name: Start all services (non-blocking)
+      shell: bash
+      run: |
+        docker run -d --name pgsql \
+          -p 5432:5432 \
+          -e POSTGRES_USER=openaev \
+          -e POSTGRES_PASSWORD=openaev \
+          -e POSTGRES_DB=openaev \
+          postgres:17-alpine \
+          -c max_connections=1000
+        docker run -d --name elasticsearch \
+          -p 9200:9200 \
+          -e discovery.type=single-node \
+          -e xpack.security.enabled=false \
+          -e "ES_JAVA_OPTS=-Xms2g -Xmx2g" \
+          docker.elastic.co/elasticsearch/elasticsearch:8.18.3
+        docker run -d --name rabbitmq \
+          -p 5672:5672 \
+          -p 15672:15672 \
+          -e RABBITMQ_DEFAULT_USER=guest \
+          -e RABBITMQ_DEFAULT_PASS=guest \
+          rabbitmq:4.1-management
+        docker run -d --name minio \
+          -p 9000:9000 \
+          -e MINIO_ROOT_USER=minioadmin \
+          -e MINIO_ROOT_PASSWORD=minioadmin \
+          minio/minio:RELEASE.2025-06-13T11-33-47Z server /data
+
+        echo "🔍 Verifying containers started..."
+        for name in pgsql elasticsearch rabbitmq minio; do
+          if ! docker inspect --format='{{.State.Running}}' "$name" 2>/dev/null | grep -q true; then
+            echo "❌ Container '$name' failed to start"
+            docker logs "$name" 2>/dev/null || true
+            exit 1
+          fi
+        done
+        echo "✅ All containers started"
+
+    - name: Set up Java 21
+      uses: actions/setup-java@v5
+      with:
+        java-version: "21"
+        distribution: temurin
+    - name: Set up Node.js 22.11
+      uses: actions/setup-node@v6
+      with:
+        node-version: "22.11.0"
+    - name: Install corepack
+      run: npm install -g corepack
+      shell: bash
+    - name: Get Yarn cache directory
+      id: yarn-cache-dir
+      run: echo "dir=$(yarn config get cacheFolder)" >> "$GITHUB_OUTPUT"
+      shell: bash
+      working-directory: openaev-front
+    - name: Cache Yarn dependencies
+      uses: actions/cache@v5
+      with:
+        path: ${{ steps.yarn-cache-dir.outputs.dir }}
+        key: ${{ runner.os }}-yarn-${{ hashFiles('openaev-front/yarn.lock') }}
+        restore-keys: |
+          ${{ runner.os }}-yarn-
+    - name: Install frontend dependencies
+      run: yarn install --immutable
+      shell: bash
+      working-directory: openaev-front
+    - name: Cache Playwright browsers
+      id: playwright-cache
+      uses: actions/cache@v5
+      with:
+        path: ~/.cache/ms-playwright
+        key: playwright-${{ runner.os }}-${{ hashFiles('openaev-front/yarn.lock') }}
+    - name: Install Playwright browsers (overlaps with artifact wait)
+      if: steps.playwright-cache.outputs.cache-hit != 'true'
+      run: yarn playwright install --with-deps chromium
+      shell: bash
+      working-directory: openaev-front
+    - name: Install Playwright system dependencies (cache hit)
+      if: steps.playwright-cache.outputs.cache-hit == 'true'
+      run: yarn playwright install-deps chromium
+      shell: bash
+      working-directory: openaev-front
+
+    - name: Wait for and download backend JAR artifact
+      shell: bash
+      run: |
+        echo "⏳ Waiting for backend-package artifact (services booting in parallel)..."
+        for i in $(seq 1 180); do
+          HTTP_CODE=$(gh api "repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts" \
+            --include 2>&1 | head -1 | awk '{print $2}' || echo "000")
+          NAMES=$(gh api "repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts" \
+            --jq '[.artifacts[].name]' 2>/dev/null || echo "[]")
+          if [ "$HTTP_CODE" != "200" ] && [ "$HTTP_CODE" != "000" ]; then
+            echo "⚠️ GitHub API returned HTTP $HTTP_CODE (attempt $i/180)"
+          fi
+          if echo "$NAMES" | grep -q '"openaev-api-jar"'; then
+            echo "✅ Artifact available (after ~$((i * 5))s)"
+            break
+          fi
+          if [ "$i" -eq 180 ]; then
+            echo "❌ Timed out waiting for artifact (15 min)"
+            exit 1
+          fi
+          echo "  Attempt $i/180 — not ready, retrying in 5s..."
+          sleep 5
+        done
+
+        echo "📥 Downloading openaev-api-jar..."
+        if ! gh run download "${{ github.run_id }}" -n openaev-api-jar -D openaev-api/target; then
+          echo "❌ Failed to download openaev-api-jar artifact"
+          exit 1
+        fi
+
+    - name: Verify backend JAR
+      shell: bash
+      run: |
+        if [ ! -f "openaev-api/target/openaev-api.jar" ]; then
+          echo "❌ openaev-api.jar not found after download"
+          ls -la openaev-api/target/ 2>/dev/null || echo "  target/ directory does not exist"
+          exit 1
+        fi
+        JAR_SIZE=$(stat --format=%s openaev-api/target/openaev-api.jar 2>/dev/null || stat -f%z openaev-api/target/openaev-api.jar 2>/dev/null)
+        if [ "$JAR_SIZE" -lt 1000 ] 2>/dev/null; then
+          echo "❌ openaev-api.jar is suspiciously small ($JAR_SIZE bytes)"
+          exit 1
+        fi
+        echo "✅ openaev-api.jar present ($JAR_SIZE bytes)"
+
+    - name: Wait for services
+      shell: bash
+      run: |
+        echo "⏳ Waiting for PostgreSQL..."
+        for i in $(seq 1 30); do
+          docker exec pgsql pg_isready -U openaev && break
+          sleep 1
+        done
+        docker exec pgsql pg_isready -U openaev || { echo "❌ PostgreSQL failed to start"; exit 1; }
+
+        echo "⏳ Waiting for Elasticsearch..."
+        for i in $(seq 1 30); do
+          curl -sf http://localhost:9200/_cluster/health && break
+          sleep 2
+        done
+        curl -sf http://localhost:9200/_cluster/health || { echo "❌ Elasticsearch failed to start"; exit 1; }
+
+        echo "⏳ Waiting for RabbitMQ..."
+        for i in $(seq 1 30); do
+          docker exec rabbitmq rabbitmq-diagnostics -q check_running 2>/dev/null && break
+          sleep 2
+        done
+        docker exec rabbitmq rabbitmq-diagnostics -q check_running || { echo "❌ RabbitMQ failed to start"; exit 1; }
+
+        echo "⏳ Waiting for MinIO..."
+        for i in $(seq 1 30); do
+          curl -sf http://localhost:9000/minio/health/live && break
+          sleep 1
+        done
+        curl -sf http://localhost:9000/minio/health/live || { echo "❌ MinIO failed to start"; exit 1; }
+
+        echo "✅ All services ready"
+
+    - name: Start application
+      run: java -jar openaev-api/target/openaev-api.jar &
+      shell: bash
+    - name: Wait for application to be ready
+      shell: bash
+      run: |
+        echo "Waiting for application on port 8080..."
+        timeout 180 bash -c '
+          until curl -sf -o /dev/null -w "%{http_code}" http://localhost:8080 | grep -q "200"; do
+            sleep 2
+          done
+        ' || {
+          echo "❌ Application failed to become ready within 180s"
+          echo "  Last HTTP response:"
+          curl -s -o /dev/null -w "  HTTP %{http_code}\n" http://localhost:8080 2>/dev/null || echo "  (no response)"
+          exit 1
+        }
+        echo "✅ Application is ready (HTTP 200)"
+    - name: Run E2E tests
+      run: yarn test:e2e
+      shell: bash
+      working-directory: openaev-front
+      env:
+        APP_URL: http://localhost:8080
+        E2E_COVERAGE: "true"
+    - name: Verify API types are up to date
+      shell: bash
+      working-directory: openaev-front
+      run: |
+        API_URL=http://localhost:8080 yarn generate-types-from-api
+        if git diff --name-only | grep -q 'src/utils/api-types.d.ts'; then
+          echo "Detected changes in src/utils/api-types.d.ts:";
+          git diff -- src/utils/api-types.d.ts || git diff -- openaev-front/src/utils/api-types.d.ts;
+          echo "⚠️ Forgot to generate types! Please run 'yarn run generate-types-from-api' before committing."; exit 1;
+        fi
+    - name: Upload Playwright report
+      if: ${{ !cancelled() }}
+      uses: actions/upload-artifact@v7
+      with:
+        name: playwright-report
+        path: openaev-front/test-results/
+    - name: Upload E2E coverage report
+      if: ${{ !cancelled() }}
+      uses: actions/upload-artifact@v7
+      with:
+        name: playwright-coverage
+        path: openaev-front/test-results/coverage/
+
diff --git a/.github/actions/frontend-build/action.yml b/.github/actions/frontend-build/action.yml
new file mode 100644
index 00000000000..811b0b373de
--- /dev/null
+++ b/.github/actions/frontend-build/action.yml
@@ -0,0 +1,38 @@
+name: Frontend Build
+description: Install frontend dependencies, build production bundle, and upload artifact
+
+runs:
+  using: composite
+  steps:
+    - name: Set up Node.js 22.11
+      uses: actions/setup-node@v6
+      with:
+        node-version: "22.11.0"
+    - name: Install corepack
+      run: npm install -g corepack
+      shell: bash
+    - name: Get Yarn cache directory
+      id: yarn-cache-dir
+      run: echo "dir=$(yarn config get cacheFolder)" >> "$GITHUB_OUTPUT"
+      shell: bash
+      working-directory: openaev-front
+    - name: Cache Yarn dependencies
+      uses: actions/cache@v5
+      with:
+        path: ${{ steps.yarn-cache-dir.outputs.dir }}
+        key: ${{ runner.os }}-yarn-${{ hashFiles('openaev-front/yarn.lock') }}
+        restore-keys: |
+          ${{ runner.os }}-yarn-
+    - name: Install dependencies
+      run: yarn install --immutable
+      shell: bash
+      working-directory: openaev-front
+    - name: Build frontend
+      run: yarn build
+      shell: bash
+      working-directory: openaev-front
+    - name: Upload frontend build artifact
+      uses: actions/upload-artifact@v7
+      with:
+        name: frontend-build
+        path: openaev-front/builder/prod/build/
diff --git a/.github/actions/frontend-quality/action.yml b/.github/actions/frontend-quality/action.yml
new file mode 100644
index 00000000000..7fc8496bedf
--- /dev/null
+++ b/.github/actions/frontend-quality/action.yml
@@ -0,0 +1,56 @@
+name: Frontend Quality & Unit Tests
+description: >
+  Run TypeScript checks, ESLint, i18n validation, and Vitest unit tests.
+  Uploads coverage report as an artifact.
+
+runs:
+  using: composite
+  steps:
+    - name: Set up Node.js 22.11
+      uses: actions/setup-node@v6
+      with:
+        node-version: "22.11.0"
+    - name: Install corepack
+      run: npm install -g corepack
+      shell: bash
+    - name: Get Yarn cache directory
+      id: yarn-cache-dir
+      run: echo "dir=$(yarn config get cacheFolder)" >> "$GITHUB_OUTPUT"
+      shell: bash
+      working-directory: openaev-front
+    - name: Cache Yarn dependencies
+      uses: actions/cache@v5
+      with:
+        path: ${{ steps.yarn-cache-dir.outputs.dir }}
+        key: ${{ runner.os }}-yarn-${{ hashFiles('openaev-front/yarn.lock') }}
+        restore-keys: |
+          ${{ runner.os }}-yarn-
+    - name: Install dependencies
+      run: yarn install --immutable
+      shell: bash
+      working-directory: openaev-front
+    - name: TypeScript check
+      run: yarn check-ts
+      shell: bash
+      working-directory: openaev-front
+    - name: Run ESLint
+      run: yarn lint
+      shell: bash
+      working-directory: openaev-front
+    - name: Check i18n translations
+      run: yarn i18n-checker
+      shell: bash
+      working-directory: openaev-front
+    - name: Run unit tests
+      run: yarn test -- --coverage
+      shell: bash
+      working-directory: openaev-front
+      env:
+        NODE_OPTIONS: --max_old_space_size=8192
+    - name: Upload frontend coverage report
+      if: ${{ !cancelled() }}
+      uses: actions/upload-artifact@v7
+      with:
+        name: vitest-coverage
+        path: openaev-front/coverage/
+
diff --git a/.github/actions/jfrog-package/action.yml b/.github/actions/jfrog-package/action.yml
new file mode 100644
index 00000000000..cf90498327a
--- /dev/null
+++ b/.github/actions/jfrog-package/action.yml
@@ -0,0 +1,202 @@
+name: JFrog Package
+description: >
+  Download glibc and musl JAR artifacts, package them as tar.gz archives with
+  application.properties, validate archive contents, and either upload to JFrog
+  (production) or save as GitHub artifacts (dry-run).
+
+  When a version is provided, the primary archives are version-named (e.g.
+  openaev-2.4.0.tar.gz) with date-named copies for backward compatibility. This
+  mirrors the logic in release/promote.yml's jfrog-upload job — keep both in
+  sync.
+
+inputs:
+  version:
+    description: >
+      Semver version string (e.g. "2.4.0"). When set, archives are named
+      openaev-VERSION.tar.gz (primary) with openaev-DATE.tar.gz copies for
+      backward compatibility. When empty, only date-based naming is used.
+    required: false
+    default: ""
+  dry-run:
+    description: >
+      When 'true', upload archives as GitHub artifacts instead of JFrog.
+    required: false
+    default: "false"
+  jfrog-user:
+    description: JFrog username (required when dry-run is 'false')
+    required: false
+    default: ""
+  jfrog-token:
+    description: JFrog token (required when dry-run is 'false')
+    required: false
+    default: ""
+
+outputs:
+  date_stamp:
+    description: Date stamp used for archive naming (YYYYMMDD)
+    value: ${{ steps.package.outputs.date_stamp }}
+  version:
+    description: Version used for primary archive naming (empty if date-only)
+    value: ${{ steps.package.outputs.version }}
+  glibc_archive_size_mb:
+    description: Size of glibc archive in MB
+    value: ${{ steps.package.outputs.glibc_archive_size_mb }}
+  musl_archive_size_mb:
+    description: Size of musl archive in MB
+    value: ${{ steps.package.outputs.musl_archive_size_mb }}
+
+runs:
+  using: composite
+  steps:
+    - name: Download glibc JAR
+      uses: actions/download-artifact@v8
+      with:
+        name: openaev-api-jar
+        path: glibc-jar
+
+    - name: Download musl JAR
+      uses: actions/download-artifact@v8
+      with:
+        name: openaev-api-jar-musl
+        path: musl-jar
+
+    - name: Download API build output (for application.properties)
+      uses: actions/download-artifact@v8
+      with:
+        name: api-build-output
+        path: build-output
+
+    - name: Package and validate tar.gz archives
+      id: package
+      run: |
+        set -euo pipefail
+        DATE_STAMP="$(date '+%Y%m%d')"
+        VERSION="${{ inputs.version }}"
+        echo "date_stamp=${DATE_STAMP}" >> "$GITHUB_OUTPUT"
+        echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+
+        for f in glibc-jar/openaev-api.jar musl-jar/openaev-api.jar build-output/classes/application.properties; do
+          if [ ! -f "$f" ]; then
+            echo "❌ Required file missing: $f"
+            exit 1
+          fi
+        done
+        echo "✅ All required files present"
+
+        mkdir -p release-glibc/openaev
+        cp glibc-jar/openaev-api.jar release-glibc/openaev/
+        cp build-output/classes/application.properties release-glibc/openaev/
+
+        mkdir -p release-musl/openaev
+        cp musl-jar/openaev-api.jar release-musl/openaev/
+        cp build-output/classes/application.properties release-musl/openaev/
+
+        # ── Determine primary archive name ──
+        # When version is set: primary is version-named, date is a compat copy.
+        # When version is empty: primary is date-named only.
+        if [ -n "$VERSION" ]; then
+          PRIMARY_LABEL="$VERSION"
+          tar -C release-glibc -zcvf "openaev-${VERSION}.tar.gz" openaev
+          tar -C release-musl  -zcvf "openaev-${VERSION}_musl.tar.gz" openaev
+          # Date-based copies for backward compatibility
+          cp "openaev-${VERSION}.tar.gz"      "openaev-${DATE_STAMP}.tar.gz"
+          cp "openaev-${VERSION}_musl.tar.gz" "openaev-${DATE_STAMP}_musl.tar.gz"
+        else
+          PRIMARY_LABEL="$DATE_STAMP"
+          tar -C release-glibc -zcvf "openaev-${DATE_STAMP}.tar.gz" openaev
+          tar -C release-musl  -zcvf "openaev-${DATE_STAMP}_musl.tar.gz" openaev
+        fi
+
+        for variant in "" "_musl"; do
+          ARCHIVE="openaev-${PRIMARY_LABEL}${variant}.tar.gz"
+          if [ ! -s "$ARCHIVE" ]; then
+            echo "❌ Archive is empty or missing: $ARCHIVE"
+            exit 1
+          fi
+          ARCHIVE_SIZE=$(stat --format=%s "$ARCHIVE")
+          ARCHIVE_SIZE_MB=$(awk "BEGIN {printf \"%.1f\", $ARCHIVE_SIZE / 1048576}")
+          echo "  ${ARCHIVE}: ${ARCHIVE_SIZE_MB} MB"
+
+          CONTENTS=$(tar -tzf "$ARCHIVE")
+          echo "  Contents:"
+          echo "$CONTENTS" | sed 's/^/    /'
+
+          EXPECTED_FILES=("openaev/openaev-api.jar" "openaev/application.properties")
+          for expected in "${EXPECTED_FILES[@]}"; do
+            if ! echo "$CONTENTS" | grep -q "$expected"; then
+              echo "  ❌ Missing expected file in archive: $expected"
+              exit 1
+            fi
+          done
+          echo "  ✅ Archive valid"
+        done
+
+        GLIBC_SIZE=$(stat --format=%s "openaev-${PRIMARY_LABEL}.tar.gz")
+        MUSL_SIZE=$(stat --format=%s "openaev-${PRIMARY_LABEL}_musl.tar.gz")
+        GLIBC_SIZE_MB=$(awk "BEGIN {printf \"%.1f\", $GLIBC_SIZE / 1048576}")
+        MUSL_SIZE_MB=$(awk "BEGIN {printf \"%.1f\", $MUSL_SIZE / 1048576}")
+        echo "glibc_archive_size_mb=${GLIBC_SIZE_MB}" >> "$GITHUB_OUTPUT"
+        echo "musl_archive_size_mb=${MUSL_SIZE_MB}"   >> "$GITHUB_OUTPUT"
+      shell: bash
+
+    - name: Upload to JFrog
+      if: ${{ inputs.dry-run != 'true' }}
+      run: |
+        set -euo pipefail
+        DATE_STAMP="${{ steps.package.outputs.date_stamp }}"
+        VERSION="${{ steps.package.outputs.version }}"
+        JFROG_BASE="https://filigran.jfrog.io/artifactory/openaev"
+
+        upload_to_jfrog() {
+          local LOCAL_FILE="$1"
+          local REMOTE_NAME="$2"
+          HTTP_CODE=$(curl --retry 3 -w "%{http_code}" -o /tmp/jfrog-resp.txt \
+            -u "${{ inputs.jfrog-user }}:${{ inputs.jfrog-token }}" \
+            -T "$LOCAL_FILE" \
+            "${JFROG_BASE}/${REMOTE_NAME}" || true)
+          if [ "$HTTP_CODE" != "201" ] && [ "$HTTP_CODE" != "200" ]; then
+            echo "❌ JFrog upload failed for ${REMOTE_NAME} (HTTP $HTTP_CODE)"
+            cat /tmp/jfrog-resp.txt 2>/dev/null || true
+            exit 1
+          fi
+          echo "✅ Uploaded ${REMOTE_NAME} (HTTP $HTTP_CODE)"
+        }
+
+        if [ -n "$VERSION" ]; then
+          # Upload version-named archives (primary)
+          upload_to_jfrog "openaev-${VERSION}.tar.gz"      "openaev-${VERSION}.tar.gz"
+          upload_to_jfrog "openaev-${VERSION}_musl.tar.gz" "openaev-${VERSION}_musl.tar.gz"
+          # Upload date-named archives (backward compatibility)
+          upload_to_jfrog "openaev-${DATE_STAMP}.tar.gz"      "openaev-${DATE_STAMP}.tar.gz"
+          upload_to_jfrog "openaev-${DATE_STAMP}_musl.tar.gz" "openaev-${DATE_STAMP}_musl.tar.gz"
+        else
+          upload_to_jfrog "openaev-${DATE_STAMP}.tar.gz"      "openaev-${DATE_STAMP}.tar.gz"
+          upload_to_jfrog "openaev-${DATE_STAMP}_musl.tar.gz" "openaev-${DATE_STAMP}_musl.tar.gz"
+        fi
+      shell: bash
+
+    - name: Log simulated JFrog targets (dry-run)
+      if: ${{ inputs.dry-run == 'true' }}
+      run: |
+        DATE_STAMP="${{ steps.package.outputs.date_stamp }}"
+        VERSION="${{ steps.package.outputs.version }}"
+        GLIBC_MB="${{ steps.package.outputs.glibc_archive_size_mb }}"
+        MUSL_MB="${{ steps.package.outputs.musl_archive_size_mb }}"
+        echo ""
+        echo "── JFrog upload targets (NOT uploaded in dry run) ──"
+        if [ -n "$VERSION" ]; then
+          echo "  Primary: openaev-${VERSION}.tar.gz / openaev-${VERSION}_musl.tar.gz (${GLIBC_MB} / ${MUSL_MB} MB)"
+          echo "  Compat:  openaev-${DATE_STAMP}.tar.gz / openaev-${DATE_STAMP}_musl.tar.gz"
+        else
+          echo "  openaev-${DATE_STAMP}.tar.gz (${GLIBC_MB} MB)"
+          echo "  openaev-${DATE_STAMP}_musl.tar.gz (${MUSL_MB} MB)"
+        fi
+      shell: bash
+
+    - name: Upload dry-run archives as GitHub artifacts
+      if: ${{ inputs.dry-run == 'true' }}
+      uses: actions/upload-artifact@v7
+      with:
+        name: jfrog-dry-run-archives
+        path: |
+          openaev-*.tar.gz
diff --git a/.github/actions/spotless-check/action.yml b/.github/actions/spotless-check/action.yml
new file mode 100644
index 00000000000..7a8357da197
--- /dev/null
+++ b/.github/actions/spotless-check/action.yml
@@ -0,0 +1,16 @@
+name: Spotless Check
+description: Check Java code formatting with Spotless (Google Java Format)
+
+runs:
+  using: composite
+  steps:
+    - name: Set up Java 21
+      uses: actions/setup-java@v5
+      with:
+        java-version: "21"
+        distribution: temurin
+        cache: maven
+    - name: Check formatting
+      run: mvn -B -ntp spotless:check
+      shell: bash
+
diff --git a/.github/workflows/_quality-gates.yml b/.github/workflows/_quality-gates.yml
new file mode 100644
index 00000000000..7f20fa6e96b
--- /dev/null
+++ b/.github/workflows/_quality-gates.yml
@@ -0,0 +1,275 @@
+name: "Quality Gates"
+
+# Reusable workflow containing the shared quality gate jobs:
+#   - Frontend quality & unit tests
+#   - API tests (4-shard matrix)
+#   - E2E tests & API types
+#   - Coverage merge, threshold check & optional Codecov upload
+#
+# Used by core-ci.yml and core-release-dry-run.yml to avoid duplication.
+# When adding a new test shard or changing env vars, you only need to
+# update this file.
+
+on:
+  workflow_call:
+    inputs:
+      upload-codecov:
+        description: "Upload coverage reports to Codecov and save artifacts"
+        type: boolean
+        default: true
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+
+  frontend-quality:
+    name: "🧪 Frontend Quality & Unit Tests"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/frontend-quality
+
+  api-tests:
+    name: "🧪 API Tests (${{ matrix.shard_name }})"
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # ── Four workers: main, rest-1, rest-2, everything else ──
+          - shard: 1
+            shard_name: main
+            includes: |-
+              io/openaev/api/**/*Test.java
+              io/openaev/integration/**/*Test.java
+              io/openaev/injects/**/*Test.java
+              io/openaev/opencti/**/*Test.java
+              io/openaev/service/**/*Test.java
+          - shard: 2
+            shard_name: rest-1
+            # Packages a–h: root-level rest tests + sub-packages
+            # starting with letters a through h.
+            # NOTE: Surefire uses Ant-style patterns — [a-h] bracket
+            # expressions are NOT supported; list packages explicitly.
+            includes: |-
+              io/openaev/rest/*Test.java
+              io/openaev/rest/asset_group/**/*Test.java
+              io/openaev/rest/attack_pattern/**/*Test.java
+              io/openaev/rest/custom_dashboard/**/*Test.java
+              io/openaev/rest/dashboard/**/*Test.java
+              io/openaev/rest/exercise/**/*Test.java
+          - shard: 3
+            shard_name: rest-2
+            # Everything under rest/ NOT assigned to shard 2.
+            # New rest sub-packages are automatically picked up here.
+            includes: |-
+              io/openaev/rest/**/*Test.java
+            excludes: |-
+              io/openaev/rest/*Test.java
+              io/openaev/rest/asset_group/**/*Test.java
+              io/openaev/rest/attack_pattern/**/*Test.java
+              io/openaev/rest/custom_dashboard/**/*Test.java
+              io/openaev/rest/dashboard/**/*Test.java
+              io/openaev/rest/exercise/**/*Test.java
+          - shard: 4
+            shard_name: remaining
+            # Catch-all: runs every test NOT assigned to shards 1–3.
+            # Any new test package is executed here automatically.
+            includes: catchall
+    env:
+      # ── Union of all explicitly-assigned shard patterns (shards 1–3) ──
+      # The catch-all shard uses this as an *excludes* list, so any test
+      # added in a brand-new package is automatically executed without
+      # having to touch this workflow file.
+      # When you add a pattern to a shard above, mirror it here.
+      EXPLICITLY_SHARDED_TESTS: |-
+        io/openaev/api/**/*Test.java
+        io/openaev/integration/**/*Test.java
+        io/openaev/injects/**/*Test.java
+        io/openaev/opencti/**/*Test.java
+        io/openaev/service/**/*Test.java
+        io/openaev/rest/**/*Test.java
+      SPRING_DATASOURCE_URL: jdbc:postgresql://localhost:5432/openaev
+      SPRING_DATASOURCE_USERNAME: openaev
+      SPRING_DATASOURCE_PASSWORD: openaev
+      MINIO_ENDPOINT: localhost
+      MINIO_PORT: 9000
+      ENGINE_URL: http://localhost:9200
+      OPENBAS_RABBITMQ_HOSTNAME: localhost
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/api-tests
+        with:
+          includes: ${{ matrix.includes }}
+          excludes: ${{ matrix.excludes }}
+          shard: ${{ matrix.shard }}
+          shard-name: ${{ matrix.shard_name }}
+
+  e2e-tests:
+    name: "🧪 E2E & API Types"
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      SPRING_DATASOURCE_URL: jdbc:postgresql://localhost:5432/openaev
+      SPRING_DATASOURCE_USERNAME: openaev
+      SPRING_DATASOURCE_PASSWORD: openaev
+      MINIO_ENDPOINT: localhost
+      MINIO_PORT: 9000
+      MINIO_ACCESS_KEY: minioadmin
+      MINIO_ACCESS_SECRET: minioadmin
+      ENGINE_URL: http://localhost:9200
+      OPENBAS_RABBITMQ_HOSTNAME: localhost
+      OPENAEV_ADMIN_EMAIL: admin@openaev.io
+      OPENAEV_ADMIN_PASSWORD: admin
+      OPENAEV_ADMIN_TOKEN: 0d17ce9a-f3a8-4c6d-9721-c98dc3dc023f
+      OPENAEV_ADMIN_ENCRYPTION_KEY: ThisIsMyUltraSecureEncryptionKey
+      OPENAEV_ADMIN_ENCRYPTION_SALT: ilikesaltyfoodnomnom
+      SPRING_PROFILES_ACTIVE: ci
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/e2e-tests
+
+  codecov:
+    name: "📊 Coverage Merge & Upload"
+    needs: [ api-tests, frontend-quality, e2e-tests ]
+    # Always run so partial coverage (e.g. backend+frontend) is still
+    # uploaded even when one upstream job fails or is cancelled.
+    if: ${{ !cancelled() }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Java 21
+        uses: actions/setup-java@v5
+        with:
+          java-version: "21"
+          distribution: temurin
+          cache: maven
+
+      # ── Backend coverage: merge JaCoCo shards, report & check ──────
+      - name: Download compiled Maven artifacts
+        if: needs.api-tests.result == 'success' || needs.api-tests.result == 'failure'
+        uses: actions/download-artifact@v8
+        with:
+          name: backend-compiled
+          path: ~/.m2/repository/io/openaev/
+        continue-on-error: true
+
+      - name: Download API build output
+        if: needs.api-tests.result == 'success' || needs.api-tests.result == 'failure'
+        uses: actions/download-artifact@v8
+        with:
+          name: api-build-output
+          path: openaev-api/target
+        continue-on-error: true
+
+      - name: Download all JaCoCo exec shards
+        if: needs.api-tests.result == 'success' || needs.api-tests.result == 'failure'
+        uses: actions/download-artifact@v8
+        with:
+          pattern: jacoco-exec-shard-*
+          path: jacoco-exec
+        continue-on-error: true
+
+      - name: Merge JaCoCo exec files
+        id: jacoco-merge
+        if: needs.api-tests.result == 'success' || needs.api-tests.result == 'failure'
+        run: |
+          echo "📦 Merging JaCoCo exec files from all shards..."
+          EXEC_FILES=$(find jacoco-exec -name 'jacoco.exec' 2>/dev/null)
+          if [ -z "$EXEC_FILES" ]; then
+            echo "⚠️ No JaCoCo exec files found — all test shards may have failed"
+            echo "  Contents of jacoco-exec/:"
+            ls -laR jacoco-exec/ 2>/dev/null || echo "  directory does not exist"
+            exit 1
+          fi
+          SHARD_COUNT=$(echo "$EXEC_FILES" | wc -l)
+          echo "  Found $SHARD_COUNT shard exec file(s)"
+          cat jacoco-exec/jacoco-exec-shard-*/jacoco.exec > openaev-api/target/jacoco.exec
+          if [ ! -s "openaev-api/target/jacoco.exec" ]; then
+            echo "❌ Merged jacoco.exec is empty"
+            exit 1
+          fi
+          echo "✅ Merged $SHARD_COUNT shard(s) → $(wc -c < openaev-api/target/jacoco.exec) bytes"
+
+      - name: Coverage report & threshold check
+        if: steps.jacoco-merge.outcome == 'success'
+        run: mvn -B -ntp -pl openaev-api jacoco:report jacoco:check || echo "⚠️ Coverage
+          threshold check ⚠️"
+
+      - name: Upload API coverage report
+        if: ${{ !cancelled() && steps.jacoco-merge.outcome == 'success' &&
+          inputs.upload-codecov }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: jacoco-api
+          path: openaev-api/target/site/jacoco/jacoco.xml
+          if-no-files-found: warn
+
+      # ── Download frontend / E2E coverage artifacts ─────────────────
+      - name: Download vitest coverage report
+        if: ${{ inputs.upload-codecov && needs.frontend-quality.result == 'success' }}
+        uses: actions/download-artifact@v8
+        with:
+          name: vitest-coverage
+          path: coverage/frontend
+        continue-on-error: true
+
+      - name: Download playwright coverage report
+        if: ${{ inputs.upload-codecov && needs.e2e-tests.result == 'success' }}
+        uses: actions/download-artifact@v8
+        with:
+          name: playwright-coverage
+          path: coverage/e2e
+        continue-on-error: true
+
+      # ── Detect which reports are available ─────────────────────────
+      - name: Check available coverage files
+        if: ${{ inputs.upload-codecov }}
+        id: check
+        run: |
+          echo "📊 Coverage files found:"
+          find coverage/ -type f 2>/dev/null || echo "  (none)"
+          find openaev-api/target/site/jacoco/ -type f 2>/dev/null || echo "  (no backend coverage)"
+
+          has() { [ -f "$1" ] && echo "true" || echo "false"; }
+
+          echo "has_backend=$(has openaev-api/target/site/jacoco/jacoco.xml)" >> "$GITHUB_OUTPUT"
+          echo "has_frontend=$(has coverage/frontend/lcov.info)"             >> "$GITHUB_OUTPUT"
+          echo "has_e2e=$(has coverage/e2e/lcov.info)"                       >> "$GITHUB_OUTPUT"
+
+      # ── Upload to Codecov ──────────────────────────────────────────
+      - name: Upload backend coverage to Codecov
+        if: ${{ inputs.upload-codecov && steps.check.outputs.has_backend == 'true' }}
+        uses: codecov/codecov-action@v6
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: openaev-api/target/site/jacoco/jacoco.xml
+          flags: backend
+          disable_search: true
+          fail_ci_if_error: false
+
+      - name: Upload frontend coverage to Codecov
+        if: ${{ inputs.upload-codecov && steps.check.outputs.has_frontend == 'true' }}
+        uses: codecov/codecov-action@v6
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: coverage/frontend/lcov.info
+          flags: frontend
+          disable_search: true
+          fail_ci_if_error: false
+
+      - name: Upload E2E coverage to Codecov
+        if: ${{ inputs.upload-codecov && steps.check.outputs.has_e2e == 'true' }}
+        uses: codecov/codecov-action@v6
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: coverage/e2e/lcov.info
+          flags: e2e
+          disable_search: true
+          fail_ci_if_error: false
diff --git a/.github/workflows/core-ci.yml b/.github/workflows/core-ci.yml
new file mode 100644
index 00000000000..39f5065cd6a
--- /dev/null
+++ b/.github/workflows/core-ci.yml
@@ -0,0 +1,339 @@
+name: "[Core] CI"
+
+on:
+  push:
+    branches: [ master, release/current ]
+    tags:
+      - "[0-9]*.[0-9]*.[0-9]*"
+  pull_request:
+    branches: [ master, release/current ]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+
+  spotless-check:
+    name: "🔍 Spotless Check"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/spotless-check
+
+  backend-compile:
+    name: "🔨 Backend Compile"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/backend-compile
+
+  frontend-build:
+    name: "🎨 Frontend Build"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/frontend-build
+
+  # ──────────────────────────────────────────────────────────────────
+  # Quality gates (frontend quality, API tests, E2E tests, coverage)
+  # Defined in _quality-gates.yml to avoid duplication with
+  # core-release-dry-run.yml.
+  # ──────────────────────────────────────────────────────────────────
+  quality-gates:
+    uses: ./.github/workflows/_quality-gates.yml
+    secrets: inherit
+
+  backend-package:
+    name: "📦 Backend Package (glibc)"
+    needs:
+      - frontend-build
+      - backend-compile
+      - prepare-release-assets
+    timeout-minutes: 15
+    # Run even when prepare-release-assets is skipped (PRs).
+    # Note: !cancelled() is required so the `if` is evaluated when a
+    # dependency is skipped (success() alone returns false for skipped
+    # dependencies, which would cascade-skip e2e-tests).  Unlike always(),
+    # !cancelled() still respects manual workflow cancellation.
+    if: >-
+      ${{
+        !cancelled() &&
+        needs.frontend-build.result == 'success' &&
+        needs.backend-compile.result == 'success' &&
+        (needs.prepare-release-assets.result == 'success' || needs.prepare-release-assets.result == 'skipped')
+      }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/backend-package
+        with:
+          download-release-assets: ${{ needs.prepare-release-assets.result == 'success' }}
+
+  # Download agent/implant binaries and patch catalog version
+  prepare-release-assets:
+    name: "📦 Prepare Release Assets"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0 # full history needed for version tags
+
+      - name: Compute versions
+        id: versions
+        run: |
+          if [[ "$GITHUB_REF" == refs/tags/* ]]; then
+            TAG="${GITHUB_REF#refs/tags/}"
+            echo "binary_version=${TAG}"   >> "$GITHUB_OUTPUT"
+            echo "catalog_version=${TAG}"  >> "$GITHUB_OUTPUT"
+          elif [[ "$GITHUB_REF" == refs/heads/release/current ]]; then
+            echo "binary_version=prerelease"  >> "$GITHUB_OUTPUT"
+            echo "catalog_version=prerelease" >> "$GITHUB_OUTPUT"
+          else
+            echo "binary_version=latest"   >> "$GITHUB_OUTPUT"
+            echo "catalog_version=rolling"  >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Download agent & implant binaries
+        run: |
+          BINARY_VERSION="${{ steps.versions.outputs.binary_version }}"
+
+          # Use latest git tag as local filename for non-release builds
+          if [[ "${{ steps.versions.outputs.catalog_version }}" == "rolling" || "${{ steps.versions.outputs.catalog_version }}" == "prerelease" ]]; then
+            LOCAL_VERSION="$(git describe --tags --abbrev=0 2>/dev/null || echo "$BINARY_VERSION")"
+          else
+            LOCAL_VERSION="$BINARY_VERSION"
+          fi
+
+          chmod +x scripts/download-binaries.sh
+          if ! bash scripts/download-binaries.sh "$BINARY_VERSION" "$LOCAL_VERSION"; then
+            echo "❌ download-binaries.sh failed"
+            exit 1
+          fi
+
+          # Verify at least some binaries were downloaded
+          AGENT_COUNT=$(find openaev-api/src/main/resources/agents/ -type f 2>/dev/null | wc -l)
+          IMPLANT_COUNT=$(find openaev-api/src/main/resources/implants/ -type f 2>/dev/null | wc -l)
+          echo "📦 Downloaded $AGENT_COUNT agent(s) and $IMPLANT_COUNT implant(s)"
+          if [ "$AGENT_COUNT" -eq 0 ] && [ "$IMPLANT_COUNT" -eq 0 ]; then
+            echo "⚠️ Warning: No agent or implant binaries were downloaded"
+          fi
+
+      - name: Patch catalog version
+        run: |
+          CATALOG_FILE=openaev-api/src/main/resources/catalog/catalog-integrators.json
+          CATALOG_VERSION="${{ steps.versions.outputs.catalog_version }}"
+
+          if [ ! -f "$CATALOG_FILE" ]; then
+            echo "❌ Catalog file not found: $CATALOG_FILE"
+            ls -la openaev-api/src/main/resources/catalog/ 2>/dev/null || echo "  catalog/ directory does not exist"
+            exit 1
+          fi
+
+          if ! jq --arg ver "$CATALOG_VERSION" \
+            '.contracts[].container_version = $ver | .version = $ver' \
+            "$CATALOG_FILE" > catalog.tmp; then
+            echo "❌ jq failed to patch catalog file (invalid JSON?)"
+            exit 1
+          fi
+
+          if [ ! -s "catalog.tmp" ]; then
+            echo "❌ jq produced empty output"
+            exit 1
+          fi
+
+          # Validate the patched file is still valid JSON
+          if ! jq empty catalog.tmp 2>/dev/null; then
+            echo "❌ Patched catalog file is not valid JSON"
+            exit 1
+          fi
+
+          mv catalog.tmp "$CATALOG_FILE"
+          echo "✅ Catalog version patched to '$CATALOG_VERSION'"
+
+      - name: Upload release assets
+        uses: actions/upload-artifact@v7
+        with:
+          name: release-assets
+          path: |
+            openaev-api/src/main/resources/agents/
+            openaev-api/src/main/resources/implants/
+            openaev-api/src/main/resources/catalog/
+
+  # Alpine/musl JAR build for Alpine-based Docker images
+  backend-package-musl:
+    name: "📦 Backend Package (musl)"
+    needs: [ frontend-build, backend-compile, prepare-release-assets ]
+    runs-on: ubuntu-latest
+    container:
+      image: maven:3.9.14-eclipse-temurin-21-alpine
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/backend-package-musl
+
+  # Build all Docker images locally (standard + UBI9)
+  docker-build:
+    name: "🐳 Docker Build (all images)"
+    needs:
+      - backend-package
+      - prepare-release-assets
+    timeout-minutes: 20
+    if: >-
+      ${{
+       !cancelled() &&
+        needs.backend-package.result == 'success' &&
+        (needs.prepare-release-assets.result == 'success' || needs.prepare-release-assets.result == 'skipped')
+      }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/docker-build-push
+        with:
+          build-ubi9: "true"
+          tags: openaev:ci-${{ github.run_id }}
+          ubi9-tags: openaev-ubi9:ci-${{ github.run_id }}
+
+  # ──────────────────────────────────────────────────────────────────
+  # Final sanity check — download every artifact and Docker image,
+  # verify presence and reasonable sizes.
+  # ──────────────────────────────────────────────────────────────────
+  sanity-check:
+    name: "🩺 Artifact & Image Sanity Check"
+    needs:
+      - frontend-build
+      - backend-compile
+      - backend-package
+      - backend-package-musl
+      - docker-build
+      - prepare-release-assets
+    if: >-
+      ${{
+        !cancelled() &&
+        needs.frontend-build.result == 'success' &&
+        needs.backend-compile.result == 'success' &&
+        needs.backend-package.result == 'success' &&
+        needs.backend-package-musl.result == 'success' &&
+        needs.docker-build.result == 'success'
+      }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Download all artifacts
+        uses: actions/download-artifact@v8
+        with:
+          path: /tmp/artifacts
+
+      - name: Sanity check — artifacts & images
+        run: |
+          set -euo pipefail
+
+          PASS=0
+          FAIL=0
+          WARN=0
+
+          # ── Helper: check a single file ────────────────────────────
+          # Usage: check_file <path> <min_bytes> <label>
+          check_file() {
+            local path="$1" min_bytes="$2" label="$3"
+            if [ ! -f "$path" ]; then
+              echo "❌ MISSING: $label ($path)"
+              FAIL=$((FAIL + 1))
+              return
+            fi
+            local size
+            size=$(stat --format=%s "$path" 2>/dev/null || stat -f%z "$path" 2>/dev/null)
+            local size_human
+            if [ "$size" -ge 1073741824 ]; then
+              size_human="$(awk "BEGIN {printf \"%.2f GB\", $size / 1073741824}")"
+            elif [ "$size" -ge 1048576 ]; then
+              size_human="$(awk "BEGIN {printf \"%.1f MB\", $size / 1048576}")"
+            else
+              size_human="$(awk "BEGIN {printf \"%.1f KB\", $size / 1024}")"
+            fi
+            if [ "$size" -lt "$min_bytes" ]; then
+              echo "⚠️  TOO SMALL: $label — $size_human (expected ≥ $(numfmt --to=iec "$min_bytes"))"
+              WARN=$((WARN + 1))
+            else
+              echo "✅ $label — $size_human"
+              PASS=$((PASS + 1))
+            fi
+          }
+
+          # ── Helper: check a directory has files ────────────────────
+          # Usage: check_dir <path> <min_files> <label>
+          check_dir() {
+            local path="$1" min_files="$2" label="$3"
+            if [ ! -d "$path" ]; then
+              echo "❌ MISSING: $label ($path)"
+              FAIL=$((FAIL + 1))
+              return
+            fi
+            local count
+            count=$(find "$path" -type f | wc -l)
+            if [ "$count" -lt "$min_files" ]; then
+              echo "⚠️  TOO FEW FILES: $label — $count file(s) (expected ≥ $min_files)"
+              WARN=$((WARN + 1))
+            else
+              echo "✅ $label — $count file(s)"
+              PASS=$((PASS + 1))
+            fi
+          }
+
+          echo "══════════════════════════════════════════════════════════"
+          echo "  🩺  Artifact & Image Sanity Check"
+          echo "══════════════════════════════════════════════════════════"
+          echo ""
+
+          # ── 1. Frontend build ──────────────────────────────────────
+          echo "── Frontend ──"
+          check_dir "/tmp/artifacts/frontend-build" 5 "Frontend build bundle"
+          echo ""
+
+          # ── 2. Backend JARs ────────────────────────────────────────
+          echo "── Backend JARs ──"
+          # glibc JAR — expect at least 50 MB for a Spring Boot fat JAR
+          check_file "/tmp/artifacts/openaev-api-jar/openaev-api.jar" 52428800 "Backend JAR (glibc)"
+          # musl JAR
+          check_file "/tmp/artifacts/openaev-api-jar-musl/openaev-api.jar" 52428800 "Backend JAR (musl)"
+          echo ""
+
+          # ── 3. Release assets ──────────────────────────────────────
+          echo "── Release Assets ──"
+          check_dir "/tmp/artifacts/release-assets" 1 "Release assets (agents/implants/catalog)"
+          # Catalog JSON specifically
+          CATALOG=$(find /tmp/artifacts/release-assets -name 'catalog-integrators.json' 2>/dev/null | head -1)
+          if [ -n "$CATALOG" ]; then
+            check_file "$CATALOG" 1024 "Catalog JSON (catalog-integrators.json)"
+          else
+            echo "⚠️  Catalog JSON not found in release-assets"
+            WARN=$((WARN + 1))
+          fi
+          echo ""
+
+          # ── 4. Docker images (OCI archives) ────────────────────────
+          echo "── Docker Images ──"
+          # Standard image — multi-arch OCI archive, expect at least 150 MB compressed
+          check_file "/tmp/artifacts/openaev-image/openaev-image.tar.gz" 157286400 "Standard Docker image (OCI archive)"
+          # UBI9 image
+          check_file "/tmp/artifacts/openaev-ubi9-image/openaev-ubi9-image.tar.gz" 157286400 "UBI9 Docker image (OCI archive)"
+          echo ""
+
+          # ── Summary ────────────────────────────────────────────────
+          echo "══════════════════════════════════════════════════════════"
+          echo "  Summary: ✅ $PASS passed  ⚠️ $WARN warnings  ❌ $FAIL failures"
+          echo "══════════════════════════════════════════════════════════"
+
+          if [ "$FAIL" -gt 0 ]; then
+            echo ""
+            echo "❌ Sanity check FAILED — $FAIL critical artifact(s) missing"
+            exit 1
+          fi
+
+          if [ "$WARN" -gt 0 ]; then
+            echo ""
+            echo "⚠️ Sanity check passed with $WARN warning(s) — some artifacts are smaller than expected"
+          fi
diff --git a/.github/workflows/core-release-dry-run.yml b/.github/workflows/core-release-dry-run.yml
new file mode 100644
index 00000000000..d3d25824f01
--- /dev/null
+++ b/.github/workflows/core-release-dry-run.yml
@@ -0,0 +1,404 @@
+name: "[Core] Release Dry Run"
+
+# Manual-only workflow that simulates a full release pipeline without
+# pushing to Docker Hub or JFrog. Artifacts are pushed to GHCR (GitHub
+# Container Registry) so you can inspect them, and every build artifact
+# is validated for size, count, and correctness.
+#
+# This workflow runs the SAME quality gates as core-ci.yml (frontend
+# quality checks, API tests, E2E tests, coverage) so it truly validates
+# that a release would succeed end-to-end.
+#
+# Shared build and test steps live in .github/actions/ and are reused by
+# core-ci.yml, so any change to the build/test pipeline is automatically
+# tested here too.
+
+on:
+  workflow_dispatch:
+    inputs:
+      simulated_version:
+        description: >
+          Semver tag to simulate (e.g. "2.4.0"). Used for Docker tags, catalog
+          patching, and binary downloads.
+        required: true
+        type: string
+        default: "0.0.0-dryrun"
+      skip_binary_download:
+        description: >
+          Skip downloading agent/implant binaries from JFrog (useful when JFrog
+          is unreachable or you only want to test the build + Docker pipeline).
+        required: false
+        type: boolean
+        default: true
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  actions: read # poll for artifacts in api-tests/e2e-tests
+
+env:
+  SIMULATED_VERSION: ${{ inputs.simulated_version || '0.0.0-dryrun' }}
+
+jobs:
+
+  # ──────────────────────────────────────────────────────────────────
+  # 1. Quick sanity: spotless + compile + frontend
+  #    All three use the SAME composite actions as core-ci.yml
+  # ──────────────────────────────────────────────────────────────────
+  spotless-check:
+    name: "🔍 Spotless Check"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/spotless-check
+
+  backend-compile:
+    name: "🔨 Backend Compile"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/backend-compile
+
+  frontend-build:
+    name: "🎨 Frontend Build"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/frontend-build
+
+  # ──────────────────────────────────────────────────────────────────
+  # 2. Quality gates (shared with core-ci.yml via _quality-gates.yml)
+  # ──────────────────────────────────────────────────────────────────
+  quality-gates:
+    uses: ./.github/workflows/_quality-gates.yml
+    secrets: inherit
+    with:
+      upload-codecov: false
+
+  # ──────────────────────────────────────────────────────────────────
+  # 3. Prepare release assets (optional binary download + catalog patch)
+  # ──────────────────────────────────────────────────────────────────
+  prepare-release-assets:
+    name: "📦 Prepare Release Assets"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Download agent & implant binaries
+        if: ${{ inputs.skip_binary_download == false }}
+        run: |
+          chmod +x scripts/download-binaries.sh
+          if ! bash scripts/download-binaries.sh "$SIMULATED_VERSION" "$SIMULATED_VERSION"; then
+            echo "⚠️ download-binaries.sh failed — continuing (dry run)"
+          fi
+
+      - name: Create placeholder binaries (when download skipped)
+        if: ${{ inputs.skip_binary_download != false }}
+        run: |
+          echo "ℹ️ Binary download skipped — creating placeholder files"
+          RESOURCES="openaev-api/src/main/resources"
+          mkdir -p "${RESOURCES}/agents/openaev-agent/linux/arm64"
+          mkdir -p "${RESOURCES}/agents/openaev-agent/linux/x86_64"
+          mkdir -p "${RESOURCES}/implants/openaev-implant/linux/arm64"
+          mkdir -p "${RESOURCES}/implants/openaev-implant/linux/x86_64"
+          # Create small placeholder files so downstream validation can count them
+          for dir in \
+            "${RESOURCES}/agents/openaev-agent/linux/arm64" \
+            "${RESOURCES}/agents/openaev-agent/linux/x86_64" \
+            "${RESOURCES}/implants/openaev-implant/linux/arm64" \
+            "${RESOURCES}/implants/openaev-implant/linux/x86_64"; do
+            echo "placeholder-${SIMULATED_VERSION}" > "${dir}/placeholder-${SIMULATED_VERSION}"
+          done
+
+      - name: Patch catalog version
+        run: |
+          CATALOG_FILE=openaev-api/src/main/resources/catalog/catalog-integrators.json
+          if [ ! -f "$CATALOG_FILE" ]; then
+            echo "⚠️ Catalog file not found — skipping patch"
+            exit 0
+          fi
+          jq --arg ver "$SIMULATED_VERSION" \
+            '.contracts[].container_version = $ver | .version = $ver' \
+            "$CATALOG_FILE" > catalog.tmp
+          jq empty catalog.tmp
+          mv catalog.tmp "$CATALOG_FILE"
+          echo "✅ Catalog version patched to '$SIMULATED_VERSION'"
+
+      - name: Upload release assets
+        uses: actions/upload-artifact@v7
+        with:
+          name: release-assets
+          path: |
+            openaev-api/src/main/resources/agents/
+            openaev-api/src/main/resources/implants/
+            openaev-api/src/main/resources/catalog/
+
+  # ──────────────────────────────────────────────────────────────────
+  # 3. Package backend JAR (glibc)
+  #    Uses the SAME composite action as core-ci.yml, then adds
+  #    extended dry-run validation on top.
+  # ──────────────────────────────────────────────────────────────────
+  backend-package:
+    name: "📦 Backend Package (glibc)"
+    needs: [ frontend-build, backend-compile, prepare-release-assets ]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/backend-package
+        with:
+          download-release-assets: "true"
+
+      # ── Extended validation (dry-run only) ──
+      - name: Extended JAR validation (dry run)
+        id: jar-validate
+        run: |
+          JAR="openaev-api/target/openaev-api.jar"
+          JAR_SIZE=$(stat --format=%s "$JAR")
+          JAR_SIZE_MB=$(awk "BEGIN {printf \"%.1f\", $JAR_SIZE / 1048576}")
+          echo "jar_size=$JAR_SIZE"       >> "$GITHUB_OUTPUT"
+          echo "jar_size_mb=$JAR_SIZE_MB" >> "$GITHUB_OUTPUT"
+
+          # Sanity: JAR should be at least 50 MB for a Spring Boot fat JAR
+          if [ "$JAR_SIZE" -lt 52428800 ]; then
+            echo "⚠️ JAR is only ${JAR_SIZE_MB} MB — suspiciously small for a fat JAR"
+            echo "jar_warning=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "✅ JAR size looks healthy: ${JAR_SIZE_MB} MB"
+            echo "jar_warning=false" >> "$GITHUB_OUTPUT"
+          fi
+
+          # List what's inside the JAR
+          echo ""
+          echo "── JAR contents summary ──"
+          JAR_ENTRIES=$(unzip -l "$JAR" | tail -1 | awk '{print $2}')
+          echo "  Total entries: $JAR_ENTRIES"
+          echo "jar_entries=$JAR_ENTRIES" >> "$GITHUB_OUTPUT"
+
+          # Check that frontend assets are bundled
+          FRONTEND_FILES=$(unzip -l "$JAR" | grep -c 'BOOT-INF/classes/static/' || true)
+          echo "  Frontend static files: $FRONTEND_FILES"
+          echo "frontend_files=$FRONTEND_FILES" >> "$GITHUB_OUTPUT"
+          if [ "$FRONTEND_FILES" -eq 0 ]; then
+            echo "⚠️ No frontend static files found in JAR!"
+            echo "frontend_warning=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "✅ Frontend assets present"
+            echo "frontend_warning=false" >> "$GITHUB_OUTPUT"
+          fi
+    outputs:
+      jar_size: ${{ steps.jar-validate.outputs.jar_size }}
+      jar_size_mb: ${{ steps.jar-validate.outputs.jar_size_mb }}
+      jar_entries: ${{ steps.jar-validate.outputs.jar_entries }}
+      jar_warning: ${{ steps.jar-validate.outputs.jar_warning }}
+      frontend_files: ${{ steps.jar-validate.outputs.frontend_files }}
+      frontend_warning: ${{ steps.jar-validate.outputs.frontend_warning }}
+
+  # ──────────────────────────────────────────────────────────────────
+  # 4. Package backend JAR (musl/Alpine)
+  #    Uses the SAME composite action as core-ci.yml, then adds
+  #    extended dry-run validation on top.
+  # ──────────────────────────────────────────────────────────────────
+  backend-package-musl:
+    name: "📦 Backend Package (musl)"
+    needs: [ frontend-build, backend-compile, prepare-release-assets ]
+    runs-on: ubuntu-latest
+    container:
+      image: maven:3.9.14-eclipse-temurin-21-alpine
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/backend-package-musl
+
+      # ── Extended validation (dry-run only) ──
+      - name: Extended JAR validation (dry run)
+        id: jar-validate-musl
+        run: |
+          JAR="openaev-api/target/openaev-api.jar"
+          JAR_SIZE=$(stat -c%s "$JAR" 2>/dev/null || wc -c < "$JAR")
+          JAR_SIZE_MB=$(awk "BEGIN {printf \"%.1f\", $JAR_SIZE / 1048576}")
+          echo "jar_size_musl=$JAR_SIZE"       >> "$GITHUB_OUTPUT"
+          echo "jar_size_musl_mb=$JAR_SIZE_MB" >> "$GITHUB_OUTPUT"
+
+          if [ "$JAR_SIZE" -lt 52428800 ]; then
+            echo "⚠️ musl JAR is only ${JAR_SIZE_MB} MB — suspiciously small"
+            echo "jar_musl_warning=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "✅ musl JAR size looks healthy: ${JAR_SIZE_MB} MB"
+            echo "jar_musl_warning=false" >> "$GITHUB_OUTPUT"
+          fi
+    outputs:
+      jar_size_musl: ${{ steps.jar-validate-musl.outputs.jar_size_musl }}
+      jar_size_musl_mb: ${{ steps.jar-validate-musl.outputs.jar_size_musl_mb }}
+      jar_musl_warning: ${{ steps.jar-validate-musl.outputs.jar_musl_warning }}
+
+  # ──────────────────────────────────────────────────────────────────
+  # 5. Docker build (all images) — mirrors core-ci.yml exactly
+  #    Builds standard + UBI9 images locally, validates them, and
+  #    saves as tar artifacts for the release repo to consume.
+  # ──────────────────────────────────────────────────────────────────
+  docker-build:
+    name: "🐳 Docker Build (all images)"
+    needs:
+      - backend-package
+      - prepare-release-assets
+    timeout-minutes: 20
+    if: >-
+      ${{
+        !cancelled() &&
+        needs.backend-package.result == 'success' &&
+        (needs.prepare-release-assets.result == 'success' || needs.prepare-release-assets.result == 'skipped')
+      }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/docker-build-push
+        with:
+          build-ubi9: "true"
+          tags: openaev:ci-${{ github.run_id }}
+          ubi9-tags: openaev-ubi9:ci-${{ github.run_id }}
+
+  # ──────────────────────────────────────────────────────────────────
+  # 6. Validation summary
+  # ──────────────────────────────────────────────────────────────────
+  summary:
+    name: "📋 Release Dry Run Summary"
+    needs: [ backend-package, backend-package-musl, docker-build, quality-gates ]
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generate summary report
+        env:
+          # glibc JAR
+          JAR_SIZE_MB: ${{ needs.backend-package.outputs.jar_size_mb }}
+          JAR_ENTRIES: ${{ needs.backend-package.outputs.jar_entries }}
+          JAR_WARNING: ${{ needs.backend-package.outputs.jar_warning }}
+          FRONTEND_FILES: ${{ needs.backend-package.outputs.frontend_files }}
+          FRONTEND_WARNING: ${{ needs.backend-package.outputs.frontend_warning }}
+          # musl JAR
+          JAR_SIZE_MUSL_MB: ${{ needs.backend-package-musl.outputs.jar_size_musl_mb }}
+          JAR_MUSL_WARNING: ${{ needs.backend-package-musl.outputs.jar_musl_warning }}
+        run: |
+          set -euo pipefail
+          WARNINGS=0
+          ERRORS=0
+
+          status_icon() {
+            if [ "$1" = "true" ]; then
+              WARNINGS=$((WARNINGS + 1))
+              echo "⚠️"
+            else
+              echo "✅"
+            fi
+          }
+
+          # Build summary markdown
+          {
+            echo "# 🚀 Release Dry Run Summary"
+            echo ""
+            echo "**Simulated version:** \`${SIMULATED_VERSION}\`"
+            echo "**Branch:** \`${GITHUB_REF_NAME}\`"
+            echo "**Commit:** \`${GITHUB_SHA:0:7}\`"
+            echo "**Date:** $(date -u '+%Y-%m-%d %H:%M:%S UTC')"
+            echo ""
+
+            echo "## 📦 Backend JAR (glibc)"
+            echo ""
+            echo "| Metric | Value | Status |"
+            echo "|--------|-------|--------|"
+            echo "| JAR size | ${JAR_SIZE_MB:-N/A} MB | $(status_icon "${JAR_WARNING:-true}") |"
+            echo "| JAR entries | ${JAR_ENTRIES:-N/A} | — |"
+            echo "| Frontend files in JAR | ${FRONTEND_FILES:-N/A} | $(status_icon "${FRONTEND_WARNING:-true}") |"
+            echo ""
+
+            echo "## 📦 Backend JAR (musl/Alpine)"
+            echo ""
+            echo "| Metric | Value | Status |"
+            echo "|--------|-------|--------|"
+            echo "| JAR size | ${JAR_SIZE_MUSL_MB:-N/A} MB | $(status_icon "${JAR_MUSL_WARNING:-true}") |"
+            echo ""
+
+            # Compare glibc vs musl JAR sizes (should be roughly equal)
+            if [ -n "$JAR_SIZE_MB" ] && [ -n "$JAR_SIZE_MUSL_MB" ]; then
+              DIFF=$(awk "BEGIN {d = $JAR_SIZE_MB - $JAR_SIZE_MUSL_MB; print (d<0 ? -d : d)}")
+              PCT=$(awk "BEGIN {printf \"%.1f\", ($DIFF / $JAR_SIZE_MB) * 100}")
+              echo "> **JAR size delta (glibc vs musl):** ${DIFF} MB (${PCT}%)"
+              if awk "BEGIN {exit !($DIFF > 10)}" 2>/dev/null; then
+                echo "> ⚠️ Large size difference between glibc and musl JARs!"
+                WARNINGS=$((WARNINGS + 1))
+              else
+                echo "> ✅ Size difference is within acceptable range"
+              fi
+              echo ""
+            fi
+
+            echo "## 🐳 Docker Build"
+            echo ""
+            echo "| Image | Result |"
+            echo "|-------|--------|"
+            echo "| Standard (glibc) | $([ "${{ needs.docker-build.result }}" = "success" ] && echo "✅ Built" || echo "❌ ${{ needs.docker-build.result }}") |"
+            echo "| UBI9 | $([ "${{ needs.docker-build.result }}" = "success" ] && echo "✅ Built" || echo "❌ ${{ needs.docker-build.result }}") |"
+            echo ""
+            echo "> Docker images are saved as tar artifacts for the release repo to consume."
+            echo ""
+
+            echo "## 🧪 Quality Gates"
+            echo ""
+            echo "| Gate | Result |"
+            echo "|------|--------|"
+            echo "| Frontend Quality (check-ts, lint, i18n, unit tests) | $([ "${{ needs.frontend-quality.result }}" = "success" ] && echo "✅ Passed" || echo "❌ ${{ needs.frontend-quality.result }}") |"
+            echo "| API Tests (4 shards) | $([ "${{ needs.api-tests.result }}" = "success" ] && echo "✅ Passed" || echo "❌ ${{ needs.api-tests.result }}") |"
+            echo "| E2E Tests & API Types | $([ "${{ needs.e2e-tests.result }}" = "success" ] && echo "✅ Passed" || echo "❌ ${{ needs.e2e-tests.result }}") |"
+            echo "| Coverage Merge & Check | $([ "${{ needs.codecov.result }}" = "success" ] && echo "✅ Passed" || echo "⚠️ ${{ needs.codecov.result }}") |"
+            echo ""
+
+            echo "---"
+            echo ""
+
+            echo "## 🏁 Overall Result"
+            echo ""
+            if [ "$ERRORS" -gt 0 ]; then
+              echo "### ❌ FAILED — $ERRORS error(s), $WARNINGS warning(s)"
+              echo ""
+              echo "This release would likely **fail** in production. Review the errors above."
+            elif [ "$WARNINGS" -gt 0 ]; then
+              echo "### ⚠️ PASSED WITH WARNINGS — $WARNINGS warning(s)"
+              echo ""
+              echo "The release would probably succeed but some artifacts look unusual. Review the warnings above."
+            else
+              echo "### ✅ PASSED — No issues detected"
+              echo ""
+              echo "All artifacts look healthy. The release pipeline should work correctly for version \`${SIMULATED_VERSION}\`."
+            fi
+            echo ""
+            echo "---"
+            echo "*This is a dry run. Nothing was pushed to any external registry.*"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Fail if critical errors detected
+        run: |
+          ERRORS=0
+
+          # Check that upstream jobs succeeded
+          for job_result in \
+            "${{ needs.backend-package.result }}" \
+            "${{ needs.backend-package-musl.result }}" \
+            "${{ needs.docker-build.result }}" \
+            "${{ needs.quality-gates.result }}"; do
+            if [ "$job_result" = "failure" ]; then
+              echo "❌ CRITICAL: One or more upstream jobs failed"
+              ERRORS=$((ERRORS + 1))
+              break
+            fi
+          done
+
+          if [ "$ERRORS" -gt 0 ]; then
+            echo ""
+            echo "❌ Dry run FAILED with $ERRORS critical error(s)"
+            exit 1
+          fi
+
+          echo "✅ Dry run completed successfully"
diff --git a/.github/workflows/nightly-ci.yml b/.github/workflows/nightly-ci.yml
new file mode 100644
index 00000000000..a3683d7074f
--- /dev/null
+++ b/.github/workflows/nightly-ci.yml
@@ -0,0 +1,684 @@
+name: "[Core] Nightly CI"
+
+on:
+  schedule:
+    - cron: "0 3 * * *" # Every day at 3:00 AM UTC
+  workflow_dispatch: {} # Manual trigger for on-demand runs
+
+concurrency:
+  group: nightly-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+
+  # ────────────────────────────────────────────────────────────────────
+  # Build stages (Linux only — artifacts are OS-independent)
+  # ────────────────────────────────────────────────────────────────────
+
+  backend-compile:
+    name: Backend Compile
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/backend-compile
+
+  frontend-build:
+    name: Frontend Build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/frontend-build
+
+  # ────────────────────────────────────────────────────────────────────
+  # Backend API tests — full suite (no sharding)
+  # Two parallel variants: Elasticsearch vs OpenSearch
+  # Services use classic GitHub Actions service containers.
+  # MinIO requires a custom command (server /data) and is started manually.
+  # ────────────────────────────────────────────────────────────────────
+
+  api-tests-elasticsearch:
+    name: API Tests (Elasticsearch)
+    runs-on: ubuntu-latest
+    services:
+      pgsql:
+        image: postgres:17-alpine
+        ports:
+          - 5432:5432
+        env:
+          POSTGRES_USER: openaev
+          POSTGRES_PASSWORD: openaev
+          POSTGRES_DB: openaev
+          POSTGRES_INITDB_ARGS: "-c max_connections=1000"
+        options: >-
+          --health-cmd "pg_isready -U openaev" --health-interval 10s
+          --health-timeout 5s --health-retries 5
+      elasticsearch:
+        image: docker.elastic.co/elasticsearch/elasticsearch:8.18.3
+        ports:
+          - 9200:9200
+        env:
+          discovery.type: single-node
+          xpack.security.enabled: "false"
+          ES_JAVA_OPTS: "-Xms2g -Xmx2g"
+        options: >-
+          --health-cmd "curl -sf http://localhost:9200/_cluster/health || exit
+          1" --health-interval 15s --health-timeout 10s --health-retries 20
+          --health-start-period 30s
+      rabbitmq:
+        image: rabbitmq:4.1-management
+        ports:
+          - 5672:5672
+        env:
+          RABBITMQ_DEFAULT_USER: guest
+          RABBITMQ_DEFAULT_PASS: guest
+        options: >-
+          --health-cmd "rabbitmq-diagnostics -q check_running" --health-interval
+          15s --health-timeout 10s --health-retries 15 --health-start-period 20s
+    env:
+      SPRING_DATASOURCE_URL: jdbc:postgresql://localhost:5432/openaev
+      SPRING_DATASOURCE_USERNAME: openaev
+      SPRING_DATASOURCE_PASSWORD: openaev
+      MINIO_ENDPOINT: localhost
+      MINIO_PORT: 9000
+      ENGINE_URL: http://localhost:9200
+      OPENBAS_RABBITMQ_HOSTNAME: localhost
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Java 21
+        uses: actions/setup-java@v5
+        with:
+          java-version: "21"
+          distribution: temurin
+          cache: maven
+
+      - name: Start MinIO
+        run: |
+          docker run -d --name minio \
+            -p 9000:9000 \
+            -e MINIO_ROOT_USER=minioadmin \
+            -e MINIO_ROOT_PASSWORD=minioadmin \
+            minio/minio:RELEASE.2025-06-13T11-33-47Z server /data
+
+          echo "⏳ Waiting for MinIO..."
+          for i in $(seq 1 30); do
+            curl -sf http://localhost:9000/minio/health/live && break
+            sleep 1
+          done
+          curl -sf http://localhost:9000/minio/health/live || { echo "❌ MinIO failed to start"; exit 1; }
+          echo "✅ MinIO ready"
+
+      - name: Build all modules (skip tests)
+        run: mvn -B -ntp clean install -DskipTests
+
+      - name: Run API tests (Elasticsearch)
+        run: mvn -B -ntp -pl openaev-api verify
+
+      - name: Upload JaCoCo exec data
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: jacoco-exec-elasticsearch
+          path: openaev-api/target/jacoco.exec
+          if-no-files-found: warn
+
+  api-tests-opensearch:
+    name: API Tests (OpenSearch)
+    runs-on: ubuntu-latest
+    services:
+      pgsql:
+        image: postgres:17-alpine
+        ports:
+          - 5432:5432
+        env:
+          POSTGRES_USER: openaev
+          POSTGRES_PASSWORD: openaev
+          POSTGRES_DB: openaev
+          POSTGRES_INITDB_ARGS: "-c max_connections=1000"
+        options: >-
+          --health-cmd "pg_isready -U openaev" --health-interval 10s
+          --health-timeout 5s --health-retries 5
+      opensearch:
+        image: opensearchproject/opensearch:3.3.2
+        ports:
+          - 9200:9200
+        env:
+          discovery.type: single-node
+          DISABLE_SECURITY_PLUGIN: "true"
+          OPENSEARCH_JAVA_OPTS: "-Xms2g -Xmx2g"
+        options: >-
+          --health-cmd "curl -sf http://localhost:9200/_cluster/health || exit
+          1" --health-interval 15s --health-timeout 10s --health-retries 20
+          --health-start-period 30s
+      rabbitmq:
+        image: rabbitmq:4.1-management
+        ports:
+          - 5672:5672
+        env:
+          RABBITMQ_DEFAULT_USER: guest
+          RABBITMQ_DEFAULT_PASS: guest
+        options: >-
+          --health-cmd "rabbitmq-diagnostics -q check_running" --health-interval
+          15s --health-timeout 10s --health-retries 15 --health-start-period 20s
+    env:
+      SPRING_DATASOURCE_URL: jdbc:postgresql://localhost:5432/openaev
+      SPRING_DATASOURCE_USERNAME: openaev
+      SPRING_DATASOURCE_PASSWORD: openaev
+      MINIO_ENDPOINT: localhost
+      MINIO_PORT: 9000
+      ENGINE_URL: http://localhost:9200
+      ENGINE_ENGINESELECTOR: opensearch
+      OPENBAS_RABBITMQ_HOSTNAME: localhost
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Java 21
+        uses: actions/setup-java@v5
+        with:
+          java-version: "21"
+          distribution: temurin
+          cache: maven
+
+      - name: Start MinIO
+        run: |
+          docker run -d --name minio \
+            -p 9000:9000 \
+            -e MINIO_ROOT_USER=minioadmin \
+            -e MINIO_ROOT_PASSWORD=minioadmin \
+            minio/minio:RELEASE.2025-06-13T11-33-47Z server /data
+
+          echo "⏳ Waiting for MinIO..."
+          for i in $(seq 1 30); do
+            curl -sf http://localhost:9000/minio/health/live && break
+            sleep 1
+          done
+          curl -sf http://localhost:9000/minio/health/live || { echo "❌ MinIO failed to start"; exit 1; }
+          echo "✅ MinIO ready"
+
+      - name: Build all modules (skip tests)
+        run: mvn -B -ntp clean install -DskipTests
+
+      - name: Run API tests (OpenSearch)
+        run: mvn -B -ntp -pl openaev-api verify
+
+      - name: Upload JaCoCo exec data
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: jacoco-exec-opensearch
+          path: openaev-api/target/jacoco.exec
+          if-no-files-found: warn
+
+  # ────────────────────────────────────────────────────────────────────
+  # Backend package (needed for E2E tests)
+  # ────────────────────────────────────────────────────────────────────
+
+  backend-package:
+    name: Backend Package
+    needs: [ frontend-build, backend-compile ]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/backend-package
+
+  # ────────────────────────────────────────────────────────────────────
+  # E2E tests — browser × engine matrix (Linux x64, services managed by GitHub)
+  # Search engine and MinIO use docker run (services: doesn't support
+  # custom commands or conditional images).
+  # ────────────────────────────────────────────────────────────────────
+
+  e2e-tests:
+    name: "E2E (${{ matrix.engine.name }} / ${{ matrix.browser }})"
+    needs: [ backend-package ]
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        browser: [ chromium, firefox, webkit, edge ]
+        engine:
+          - name: elasticsearch
+            image: docker.elastic.co/elasticsearch/elasticsearch:8.18.3
+          - name: opensearch
+            image: opensearchproject/opensearch:3.3.2
+    services:
+      pgsql:
+        image: postgres:17-alpine
+        ports:
+          - 5432:5432
+        env:
+          POSTGRES_USER: openaev
+          POSTGRES_PASSWORD: openaev
+          POSTGRES_DB: openaev
+          POSTGRES_INITDB_ARGS: "-c max_connections=1000"
+        options: >-
+          --health-cmd "pg_isready -U openaev" --health-interval 10s
+          --health-timeout 5s --health-retries 5
+      rabbitmq:
+        image: rabbitmq:4.1-management
+        ports:
+          - 5672:5672
+        env:
+          RABBITMQ_DEFAULT_USER: guest
+          RABBITMQ_DEFAULT_PASS: guest
+        options: >-
+          --health-cmd "rabbitmq-diagnostics -q check_running" --health-interval
+          15s --health-timeout 10s --health-retries 15 --health-start-period 20s
+    env:
+      SPRING_DATASOURCE_URL: jdbc:postgresql://localhost:5432/openaev
+      SPRING_DATASOURCE_USERNAME: openaev
+      SPRING_DATASOURCE_PASSWORD: openaev
+      MINIO_ENDPOINT: localhost
+      MINIO_PORT: 9000
+      MINIO_ACCESS_KEY: minioadmin
+      MINIO_ACCESS_SECRET: minioadmin
+      ENGINE_URL: http://localhost:9200
+      ENGINE_ENGINESELECTOR: ${{ matrix.engine.name == 'opensearch' && 'opensearch' || 'elk' }}
+      OPENBAS_RABBITMQ_HOSTNAME: localhost
+      OPENAEV_ADMIN_EMAIL: admin@openaev.io
+      OPENAEV_ADMIN_PASSWORD: admin
+      OPENAEV_ADMIN_TOKEN: 0d17ce9a-f3a8-4c6d-9721-c98dc3dc023f
+      OPENAEV_ADMIN_ENCRYPTION_KEY: ThisIsMyUltraSecureEncryptionKey
+      OPENAEV_ADMIN_ENCRYPTION_SALT: ilikesaltyfoodnomnom
+      SPRING_PROFILES_ACTIVE: ci
+    steps:
+      - uses: actions/checkout@v6
+
+      # Search engine — conditional per matrix (services: can't vary by matrix)
+      - name: Start ${{ matrix.engine.name }}
+        run: |
+          if [ "${{ matrix.engine.name }}" = "elasticsearch" ]; then
+            docker run -d --name search -p 9200:9200 \
+              -e discovery.type=single-node \
+              -e xpack.security.enabled=false \
+              -e "ES_JAVA_OPTS=-Xms2g -Xmx2g" \
+              ${{ matrix.engine.image }}
+          else
+            docker run -d --name search -p 9200:9200 \
+              -e discovery.type=single-node \
+              -e DISABLE_SECURITY_PLUGIN=true \
+              -e "OPENSEARCH_JAVA_OPTS=-Xms2g -Xmx2g" \
+              ${{ matrix.engine.image }}
+          fi
+          for i in $(seq 1 60); do
+            curl -sf http://localhost:9200/_cluster/health && break
+            sleep 2
+          done
+          curl -sf http://localhost:9200/_cluster/health || { echo "❌ ${{ matrix.engine.name }} failed"; exit 1; }
+
+      # MinIO needs "server /data" — not supported by services: block
+      - name: Start MinIO
+        run: |
+          docker run -d --name minio \
+            -p 9000:9000 \
+            -e MINIO_ROOT_USER=minioadmin \
+            -e MINIO_ROOT_PASSWORD=minioadmin \
+            minio/minio:RELEASE.2025-06-13T11-33-47Z server /data
+          for i in $(seq 1 30); do
+            curl -sf http://localhost:9000/minio/health/live && break
+            sleep 1
+          done
+          curl -sf http://localhost:9000/minio/health/live || { echo "❌ MinIO failed"; exit 1; }
+
+      - name: Set up Java 21
+        uses: actions/setup-java@v5
+        with:
+          java-version: "21"
+          distribution: temurin
+
+      - name: Set up Node.js 22.11
+        uses: actions/setup-node@v6
+        with:
+          node-version: "22.11.0"
+
+      - name: Install corepack
+        run: npm install -g corepack
+
+      - name: Get Yarn cache directory
+        id: yarn-cache-dir
+        run: echo "dir=$(yarn config get cacheFolder)" >> "$GITHUB_OUTPUT"
+        working-directory: openaev-front
+
+      - name: Cache Yarn dependencies
+        uses: actions/cache@v5
+        with:
+          path: ${{ steps.yarn-cache-dir.outputs.dir }}
+          key: ${{ runner.os }}-yarn-${{ hashFiles('openaev-front/yarn.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-yarn-
+
+      - name: Install frontend dependencies & Playwright
+        working-directory: openaev-front
+        run: |
+          yarn install --immutable
+          # playwright install uses 'msedge' while test --project uses 'edge'
+          INSTALL_BROWSER=${{ matrix.browser }}
+          if [ "$INSTALL_BROWSER" = "edge" ]; then INSTALL_BROWSER="msedge"; fi
+          yarn playwright install --with-deps "$INSTALL_BROWSER"
+          # Setup project always uses chromium
+          if [ "${{ matrix.browser }}" != "chromium" ]; then
+            yarn playwright install --with-deps chromium
+          fi
+
+      - name: Download backend JAR
+        uses: actions/download-artifact@v8
+        with:
+          name: openaev-api-jar
+          path: openaev-api/target
+
+      - name: Start application
+        run: |
+          nohup java -jar openaev-api/target/openaev-api.jar \
+            > "${{ runner.temp }}/app.log" 2>&1 &
+          echo $! > "${{ runner.temp }}/app.pid"
+          echo "🚀 Application started (PID $(cat "${{ runner.temp }}/app.pid"))"
+
+      - name: Wait for application
+        run: |
+          PID=$(cat "${{ runner.temp }}/app.pid" 2>/dev/null || echo "unknown")
+          echo "⏳ Waiting for application (PID $PID) on port 8080..."
+          for i in $(seq 1 90); do
+            # Fail fast if the process has exited
+            if [ "$PID" != "unknown" ] && ! kill -0 "$PID" 2>/dev/null; then
+              echo "❌ Application process (PID $PID) exited prematurely"
+              break
+            fi
+            if curl -sf http://localhost:8080 > /dev/null 2>&1; then
+              echo "✅ Application is up after $((i * 2))s"
+              exit 0
+            fi
+            sleep 2
+          done
+
+          echo ""
+          echo "╔══════════════════════════════════════════════════╗"
+          echo "║         APPLICATION FAILED TO START              ║"
+          echo "╚══════════════════════════════════════════════════╝"
+
+          echo ""
+          echo "── Process status ──"
+          if [ "$PID" != "unknown" ]; then
+            ps -p "$PID" -o pid,stat,etime,rss,args 2>/dev/null || echo "  Process $PID is NOT running"
+          fi
+
+          echo ""
+          echo "── Port 8080 check ──"
+          ss -tlnp | grep ':8080' || echo "  Nothing listening on port 8080"
+
+          echo ""
+          echo "── Service connectivity ──"
+          echo -n "  PostgreSQL (5432): "; curl -sf http://localhost:5432 2>&1 | head -1 || pg_isready -h localhost -p 5432 2>&1 || echo "unreachable"
+          echo -n "  Elasticsearch/OpenSearch (9200): "; curl -sf http://localhost:9200 | head -1 || echo "unreachable"
+          echo -n "  MinIO (9000): "; curl -sf http://localhost:9000/minio/health/live && echo "ok" || echo "unreachable"
+          echo -n "  RabbitMQ (5672): "; nc -z localhost 5672 2>&1 && echo "ok" || echo "unreachable"
+
+          echo ""
+          echo "── Disk space ──"
+          df -h / | head -5
+
+          echo ""
+          echo "── Application log (last 200 lines) ──"
+          tail -200 "${{ runner.temp }}/app.log" 2>/dev/null || echo "  (no log file found)"
+
+          exit 1
+
+      - name: Upload application log
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: app-log-${{ matrix.engine.name }}-${{ matrix.browser }}
+          path: ${{ runner.temp }}/app.log
+          if-no-files-found: warn
+
+      - name: Run E2E tests (${{ matrix.engine.name }} / ${{ matrix.browser }})
+        working-directory: openaev-front
+        run: >-
+          yarn playwright test --config playwright.nightly.config.ts
+          --project=setup --project=${{ matrix.browser }} --workers=1
+          --retries=2
+        env:
+          APP_URL: http://localhost:8080
+          E2E_COVERAGE: "true"
+
+      - name: Verify API types are up to date
+        if: matrix.browser == 'chromium' && matrix.engine.name == 'elasticsearch'
+        working-directory: openaev-front
+        run: |
+          API_URL=http://localhost:8080 yarn generate-types-from-api
+          if git diff --name-only | grep -q './src/utils/api-types.d.ts'; then
+            git diff ./src/utils/api-types.d.ts
+            echo "⚠️ Forgot to generate types! Run 'yarn generate-types-from-api' before committing."; exit 1
+          fi
+
+      - name: Upload Playwright report
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: playwright-report-${{ matrix.engine.name }}-${{ matrix.browser }}
+          path: openaev-front/test-results/
+
+  # ────────────────────────────────────────────────────────────────────
+  # E2E tests — Linux ARM, browser × engine matrix
+  # Playwright supports chromium and firefox on arm64 Linux.
+  # ────────────────────────────────────────────────────────────────────
+
+  e2e-tests-arm:
+    name: "E2E (arm / ${{ matrix.engine.name }} / ${{ matrix.browser }})"
+    needs: [ backend-package ]
+    runs-on: ubuntu-24.04-arm
+    strategy:
+      fail-fast: false
+      matrix:
+        browser: [ chromium, firefox ]
+        engine:
+          - name: elasticsearch
+            image: docker.elastic.co/elasticsearch/elasticsearch:8.18.3
+          - name: opensearch
+            image: opensearchproject/opensearch:3.3.2
+    services:
+      pgsql:
+        image: postgres:17-alpine
+        ports:
+          - 5432:5432
+        env:
+          POSTGRES_USER: openaev
+          POSTGRES_PASSWORD: openaev
+          POSTGRES_DB: openaev
+          POSTGRES_INITDB_ARGS: "-c max_connections=1000"
+        options: >-
+          --health-cmd "pg_isready -U openaev" --health-interval 10s
+          --health-timeout 5s --health-retries 5
+      rabbitmq:
+        image: rabbitmq:4.1-management
+        ports:
+          - 5672:5672
+        env:
+          RABBITMQ_DEFAULT_USER: guest
+          RABBITMQ_DEFAULT_PASS: guest
+        options: >-
+          --health-cmd "rabbitmq-diagnostics -q check_running" --health-interval
+          15s --health-timeout 10s --health-retries 15 --health-start-period 20s
+    env:
+      SPRING_DATASOURCE_URL: jdbc:postgresql://localhost:5432/openaev
+      SPRING_DATASOURCE_USERNAME: openaev
+      SPRING_DATASOURCE_PASSWORD: openaev
+      MINIO_ENDPOINT: localhost
+      MINIO_PORT: 9000
+      MINIO_ACCESS_KEY: minioadmin
+      MINIO_ACCESS_SECRET: minioadmin
+      ENGINE_URL: http://localhost:9200
+      ENGINE_ENGINESELECTOR: ${{ matrix.engine.name == 'opensearch' && 'opensearch' || 'elk' }}
+      OPENBAS_RABBITMQ_HOSTNAME: localhost
+      OPENAEV_ADMIN_EMAIL: admin@openaev.io
+      OPENAEV_ADMIN_PASSWORD: admin
+      OPENAEV_ADMIN_TOKEN: 0d17ce9a-f3a8-4c6d-9721-c98dc3dc023f
+      OPENAEV_ADMIN_ENCRYPTION_KEY: ThisIsMyUltraSecureEncryptionKey
+      OPENAEV_ADMIN_ENCRYPTION_SALT: ilikesaltyfoodnomnom
+      SPRING_PROFILES_ACTIVE: ci
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Start ${{ matrix.engine.name }}
+        run: |
+          if [ "${{ matrix.engine.name }}" = "elasticsearch" ]; then
+            docker run -d --name search -p 9200:9200 \
+              -e discovery.type=single-node \
+              -e xpack.security.enabled=false \
+              -e "ES_JAVA_OPTS=-Xms2g -Xmx2g" \
+              ${{ matrix.engine.image }}
+          else
+            docker run -d --name search -p 9200:9200 \
+              -e discovery.type=single-node \
+              -e DISABLE_SECURITY_PLUGIN=true \
+              -e "OPENSEARCH_JAVA_OPTS=-Xms2g -Xmx2g" \
+              ${{ matrix.engine.image }}
+          fi
+          for i in $(seq 1 60); do
+            curl -sf http://localhost:9200/_cluster/health && break
+            sleep 2
+          done
+          curl -sf http://localhost:9200/_cluster/health || { echo "❌ ${{ matrix.engine.name }} failed"; exit 1; }
+
+      - name: Start MinIO
+        run: |
+          docker run -d --name minio \
+            -p 9000:9000 \
+            -e MINIO_ROOT_USER=minioadmin \
+            -e MINIO_ROOT_PASSWORD=minioadmin \
+            minio/minio:RELEASE.2025-06-13T11-33-47Z server /data
+          for i in $(seq 1 30); do
+            curl -sf http://localhost:9000/minio/health/live && break
+            sleep 1
+          done
+          curl -sf http://localhost:9000/minio/health/live || { echo "❌ MinIO failed"; exit 1; }
+
+      - name: Set up Java 21
+        uses: actions/setup-java@v5
+        with:
+          java-version: "21"
+          distribution: temurin
+
+      - name: Set up Node.js 22.11
+        uses: actions/setup-node@v6
+        with:
+          node-version: "22.11.0"
+
+      - name: Install corepack
+        run: npm install -g corepack
+
+      - name: Get Yarn cache directory
+        id: yarn-cache-dir
+        run: echo "dir=$(yarn config get cacheFolder)" >> "$GITHUB_OUTPUT"
+        working-directory: openaev-front
+
+      - name: Cache Yarn dependencies
+        uses: actions/cache@v5
+        with:
+          path: ${{ steps.yarn-cache-dir.outputs.dir }}
+          key: ${{ runner.os }}-yarn-${{ hashFiles('openaev-front/yarn.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-yarn-
+
+      - name: Install frontend dependencies & Playwright
+        working-directory: openaev-front
+        run: |
+          yarn install --immutable
+          # playwright install uses 'msedge' while test --project uses 'edge'
+          INSTALL_BROWSER=${{ matrix.browser }}
+          if [ "$INSTALL_BROWSER" = "edge" ]; then INSTALL_BROWSER="msedge"; fi
+          yarn playwright install --with-deps "$INSTALL_BROWSER"
+          if [ "${{ matrix.browser }}" != "chromium" ]; then
+            yarn playwright install --with-deps chromium
+          fi
+
+      - name: Download backend JAR
+        uses: actions/download-artifact@v8
+        with:
+          name: openaev-api-jar
+          path: openaev-api/target
+
+      - name: Start application
+        run: |
+          nohup java -jar openaev-api/target/openaev-api.jar \
+            > "${{ runner.temp }}/app.log" 2>&1 &
+          echo $! > "${{ runner.temp }}/app.pid"
+          echo "🚀 Application started (PID $(cat "${{ runner.temp }}/app.pid"))"
+
+      - name: Wait for application
+        run: |
+          PID=$(cat "${{ runner.temp }}/app.pid" 2>/dev/null || echo "unknown")
+          echo "⏳ Waiting for application (PID $PID) on port 8080..."
+          for i in $(seq 1 90); do
+            # Fail fast if the process has exited
+            if [ "$PID" != "unknown" ] && ! kill -0 "$PID" 2>/dev/null; then
+              echo "❌ Application process (PID $PID) exited prematurely"
+              break
+            fi
+            if curl -sf http://localhost:8080 > /dev/null 2>&1; then
+              echo "✅ Application is up after $((i * 2))s"
+              exit 0
+            fi
+            sleep 2
+          done
+
+          echo ""
+          echo "╔══════════════════════════════════════════════════╗"
+          echo "║         APPLICATION FAILED TO START              ║"
+          echo "╚══════════════════════════════════════════════════╝"
+
+          echo ""
+          echo "── Process status ──"
+          if [ "$PID" != "unknown" ]; then
+            ps -p "$PID" -o pid,stat,etime,rss,args 2>/dev/null || echo "  Process $PID is NOT running"
+          fi
+
+          echo ""
+          echo "── Port 8080 check ──"
+          ss -tlnp | grep ':8080' || echo "  Nothing listening on port 8080"
+
+          echo ""
+          echo "── Service connectivity ──"
+          echo -n "  PostgreSQL (5432): "; curl -sf http://localhost:5432 2>&1 | head -1 || pg_isready -h localhost -p 5432 2>&1 || echo "unreachable"
+          echo -n "  Elasticsearch/OpenSearch (9200): "; curl -sf http://localhost:9200 | head -1 || echo "unreachable"
+          echo -n "  MinIO (9000): "; curl -sf http://localhost:9000/minio/health/live && echo "ok" || echo "unreachable"
+          echo -n "  RabbitMQ (5672): "; nc -z localhost 5672 2>&1 && echo "ok" || echo "unreachable"
+
+          echo ""
+          echo "── Disk space ──"
+          df -h / | head -5
+
+          echo ""
+          echo "── Application log (last 200 lines) ──"
+          tail -200 "${{ runner.temp }}/app.log" 2>/dev/null || echo "  (no log file found)"
+
+          exit 1
+
+      - name: Upload application log
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: app-log-arm-${{ matrix.engine.name }}-${{ matrix.browser }}
+          path: ${{ runner.temp }}/app.log
+          if-no-files-found: warn
+
+      - name: Run E2E tests (${{ matrix.engine.name }} / ${{ matrix.browser }})
+        working-directory: openaev-front
+        run: >-
+          yarn playwright test --config playwright.nightly.config.ts
+          --project=setup --project=${{ matrix.browser }} --workers=1
+          --retries=2
+        env:
+          APP_URL: http://localhost:8080
+          E2E_COVERAGE: "true"
+
+      - name: Upload Playwright report
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: playwright-report-arm-${{ matrix.engine.name }}-${{ matrix.browser }}
+          path: openaev-front/test-results/
+
+
diff --git a/Dockerfile_ubi9_ga b/Dockerfile_ubi9_ga
new file mode 100644
index 00000000000..0d91c4b9593
--- /dev/null
+++ b/Dockerfile_ubi9_ga
@@ -0,0 +1,14 @@
+FROM registry.access.redhat.com/ubi9/openjdk-21-runtime AS app
+
+USER root
+
+RUN set -eux; \
+    curl -L -o /usr/bin/tini https://github.com/krallin/tini/releases/download/v0.19.0/tini; \
+    echo "93dcc18adc78c65a028a84799ecf8ad40c936fdfc5f2a57b1acda5a8117fa82c /usr/bin/tini" | sha256sum -c -; \
+    chmod +x /usr/bin/tini;
+
+WORKDIR /opt/openaev
+COPY openaev-build/openaev-api.jar ./
+
+ENTRYPOINT ["/usr/bin/tini", "--"]
+CMD ["java", "-jar", "openaev-api.jar"]
diff --git a/openaev-api/pom.xml b/openaev-api/pom.xml
index d132df391ec..bb24b134210 100644
--- a/openaev-api/pom.xml
+++ b/openaev-api/pom.xml
@@ -6,7 +6,7 @@
     <parent>
         <groupId>io.openaev</groupId>
         <artifactId>openaev-platform</artifactId>
-        <version>2.3.3</version>
+        <version>2.3.4</version>
     </parent>
 
     <artifactId>openaev-api</artifactId>
@@ -49,7 +49,7 @@
         <dependency>
             <groupId>io.openaev</groupId>
             <artifactId>openaev-framework</artifactId>
-            <version>2.3.3</version>
+            <version>2.3.4</version>
         </dependency>
         <dependency>
             <groupId>co.elastic.clients</groupId>
diff --git a/openaev-api/src/main/java/io/openaev/api/payload/PayloadApiExporter.java b/openaev-api/src/main/java/io/openaev/api/payload/PayloadApiExporter.java
index 5976f38888b..e86e6d7d980 100644
--- a/openaev-api/src/main/java/io/openaev/api/payload/PayloadApiExporter.java
+++ b/openaev-api/src/main/java/io/openaev/api/payload/PayloadApiExporter.java
@@ -38,8 +38,8 @@ public class PayloadApiExporter extends RestBehavior {
   @AccessControl(actionPerformed = Action.READ, resourceType = ResourceType.PAYLOAD)
   public ResponseEntity<byte[]> export(@PathVariable @NotBlank final String payloadId)
       throws IOException {
-    Map<String, Boolean> opts = new HashMap<>();
-    opts.put("exclude from payload export", false);
+    Map<String, IncludeOptions.IncludeMode> opts = new HashMap<>();
+    opts.put("exclude from payload export", IncludeOptions.IncludeMode.FALSE);
     IncludeOptions includeOptions = IncludeOptions.of(opts);
 
     Payload payload =
diff --git a/openaev-api/src/main/java/io/openaev/api/payload/PayloadApiImporter.java b/openaev-api/src/main/java/io/openaev/api/payload/PayloadApiImporter.java
index 1b854fd9cb0..2e26401242d 100644
--- a/openaev-api/src/main/java/io/openaev/api/payload/PayloadApiImporter.java
+++ b/openaev-api/src/main/java/io/openaev/api/payload/PayloadApiImporter.java
@@ -1,11 +1,11 @@
 package io.openaev.api.payload;
 
-import static java.util.Collections.emptyList;
-
 import io.openaev.aop.AccessControl;
 import io.openaev.database.model.Action;
 import io.openaev.database.model.Payload;
 import io.openaev.database.model.ResourceType;
+import io.openaev.jsonapi.IncludeOptions;
+import io.openaev.jsonapi.IncludeOptions.IncludeMode;
 import io.openaev.jsonapi.JsonApiDocument;
 import io.openaev.jsonapi.ResourceObject;
 import io.openaev.jsonapi.ZipJsonApi;
@@ -16,7 +16,7 @@
 import io.openaev.service.ZipJsonService;
 import io.swagger.v3.oas.annotations.Operation;
 import jakarta.validation.constraints.NotNull;
-import java.util.Set;
+import java.util.Map;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.http.MediaType;
@@ -34,6 +34,15 @@
 @RequiredArgsConstructor
 public class PayloadApiImporter extends RestBehavior {
 
+  /**
+   * Import options that configure the collector relationship on detection remediations to only
+   * include collectors that already exist in the target database. If a collector is not found by
+   * its business key, the entire detection remediation is skipped.
+   */
+  private static final IncludeOptions IMPORT_OPTIONS =
+      IncludeOptions.of(
+          Map.of("detection_remediation_collector_type", IncludeMode.IF_EXISTS_IN_DB));
+
   private final ZipJsonApi<Payload> zipJsonApi;
   private final ImportService importService;
   private final PayloadService payloadService;
@@ -51,35 +60,13 @@ public ResponseEntity<JsonApiDocument<ResourceObject>> importJson(
       @RequestPart("file") @NotNull MultipartFile file) throws Exception {
     try {
       ZipJsonService.ImportOutput<Payload> response =
-          zipJsonApi.handleImport(file, "payload_name", null, this::sanitize);
-      // TODO next chunk 4558 - complete arg
-      payloadService.synchroniseInjectorContractBasedOnPayload(
-          response.persistedData(), emptyList(), Set.of(), Set.of());
+          zipJsonApi.handleImport(file, "payload_name", IMPORT_OPTIONS, null);
+      payloadService.updateInjectorContractsForPayload(response.persistedData());
       return ResponseEntity.ok(response.jsonApiDocument());
     } catch (Exception ex) {
       log.warn("Fallback to old import due to {}", ex.getMessage(), ex);
-      // Fall back to the legacy importer
       importService.handleFileImport(file, null, null);
       return ResponseEntity.ok().build();
     }
   }
-
-  /**
-   * Removes detection remediations whose collector does not exist in the target database. During
-   * import, the collector is resolved by its business key (type). If not found, the collector field
-   * is null and the remediation must be dropped to avoid constraint violations.
-   */
-  private Payload sanitize(Payload payload) {
-    payload
-        .getDetectionRemediations()
-        .removeIf(
-            dr -> {
-              if (dr.getCollectorType() == null) {
-                log.warn("Skipping detection remediation — collector not found in target database");
-                return true;
-              }
-              return false;
-            });
-    return payload;
-  }
 }
diff --git a/openaev-api/src/main/java/io/openaev/healthcheck/utils/HealthCheckUtils.java b/openaev-api/src/main/java/io/openaev/healthcheck/utils/HealthCheckUtils.java
index 661b20c77e2..caad792e515 100644
--- a/openaev-api/src/main/java/io/openaev/healthcheck/utils/HealthCheckUtils.java
+++ b/openaev-api/src/main/java/io/openaev/healthcheck/utils/HealthCheckUtils.java
@@ -202,7 +202,9 @@ public List<HealthCheck> runInjectsChecksFor(
   public List<HealthCheck> runMissingContentChecks(@NotNull final Scenario scenario) {
     List<HealthCheck> result = new ArrayList<>();
     boolean atLeastOneInjectIsNotReady =
-        scenario.getInjects().stream().anyMatch(inject -> !runContentChecks(inject).isEmpty());
+        scenario.getInjects().stream()
+            .filter(Inject::isEnabled)
+            .anyMatch(inject -> !inject.isReady());
 
     if (atLeastOneInjectIsNotReady) {
       result.add(
diff --git a/openaev-api/src/main/java/io/openaev/rest/inject/service/InjectService.java b/openaev-api/src/main/java/io/openaev/rest/inject/service/InjectService.java
index 1e99ccf3624..fdb21e6f99e 100644
--- a/openaev-api/src/main/java/io/openaev/rest/inject/service/InjectService.java
+++ b/openaev-api/src/main/java/io/openaev/rest/inject/service/InjectService.java
@@ -81,6 +81,9 @@
 import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.tuple.Triple;
 import org.hibernate.Hibernate;
+import org.jetbrains.annotations.NotNull;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Lazy;
 import org.springframework.data.domain.Page;
 import org.springframework.data.domain.Pageable;
 import org.springframework.data.jpa.domain.Specification;
@@ -123,6 +126,13 @@ public class InjectService {
   private final InjectUtils injectUtils;
   private final ThreatArsenalService threatArsenalService;
 
+  private InjectStatusService injectStatusService;
+
+  @Autowired
+  public void setInjectStatusService(@Lazy InjectStatusService injectStatusService) {
+    this.injectStatusService = injectStatusService;
+  }
+
   private final LicenseCacheManager licenseCacheManager;
   @Resource protected ObjectMapper mapper;
 
@@ -875,6 +885,7 @@ public void resetInjectByExerciseId(String simulationId) {
     List<Inject> injects = injectRepository.findAllInjectBySimulationId(simulationId);
     if (injects.isEmpty()) return;
     injects.forEach(Inject::clean);
+    injectStatusService.deleteAllInjectStatusByInjects(injects);
     injectRepository.saveAll(injects);
   }
 
diff --git a/openaev-api/src/main/java/io/openaev/rest/payload/PayloadApi.java b/openaev-api/src/main/java/io/openaev/rest/payload/PayloadApi.java
index d1c39957615..e7f8635ac59 100644
--- a/openaev-api/src/main/java/io/openaev/rest/payload/PayloadApi.java
+++ b/openaev-api/src/main/java/io/openaev/rest/payload/PayloadApi.java
@@ -7,8 +7,6 @@
 import io.openaev.database.raw.RawDocument;
 import io.openaev.database.repository.InjectorContractRepository;
 import io.openaev.database.repository.PayloadRepository;
-import io.openaev.database.specification.SpecificationUtils;
-import io.openaev.helper.StreamHelper;
 import io.openaev.rest.collector.service.CollectorService;
 import io.openaev.rest.document.DocumentService;
 import io.openaev.rest.helper.RestBehavior;
@@ -22,22 +20,13 @@
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.responses.ApiResponse;
 import io.swagger.v3.oas.annotations.responses.ApiResponses;
-import jakarta.servlet.ServletOutputStream;
-import jakarta.servlet.http.HttpServletResponse;
 import jakarta.transaction.Transactional;
 import jakarta.validation.Valid;
 import jakarta.validation.constraints.NotBlank;
-import jakarta.validation.constraints.NotNull;
-import java.io.IOException;
 import java.util.List;
 import lombok.RequiredArgsConstructor;
 import org.springframework.data.domain.Page;
-import org.springframework.data.jpa.domain.Specification;
-import org.springframework.http.HttpHeaders;
-import org.springframework.http.HttpStatus;
-import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.*;
-import org.springframework.web.multipart.MultipartFile;
 
 @RestController
 @RequiredArgsConstructor
@@ -53,7 +42,6 @@ public class PayloadApi extends RestBehavior {
   private final PayloadCreationService payloadCreationService;
   private final PayloadUpdateService payloadUpdateService;
   private final PayloadUpsertService payloadUpsertService;
-  private final PayloadExportService payloadExportService;
   private final DocumentService documentService;
   private final CollectorService collectorsService;
   private final UserService userService;
diff --git a/openaev-api/src/main/java/io/openaev/rest/payload/service/PayloadExportService.java b/openaev-api/src/main/java/io/openaev/rest/payload/service/PayloadExportService.java
deleted file mode 100644
index cd5a0c8fcf0..00000000000
--- a/openaev-api/src/main/java/io/openaev/rest/payload/service/PayloadExportService.java
+++ /dev/null
@@ -1,139 +0,0 @@
-package io.openaev.rest.payload.service;
-
-import static io.openaev.service.ImportService.*;
-import static java.time.Instant.now;
-
-import com.fasterxml.jackson.databind.ObjectMapper;
-import io.openaev.database.model.Document;
-import io.openaev.database.model.Payload;
-import io.openaev.database.repository.DocumentRepository;
-import io.openaev.rest.exception.ElementNotFoundException;
-import io.openaev.rest.payload.exports.PayloadFileExport;
-import io.openaev.service.FileService;
-import jakarta.annotation.Resource;
-import java.io.ByteArrayOutputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.util.List;
-import java.util.Optional;
-import java.util.zip.ZipEntry;
-import lombok.extern.slf4j.Slf4j;
-import net.lingala.zip4j.io.outputstream.ZipOutputStream;
-import net.lingala.zip4j.model.ZipParameters;
-import net.lingala.zip4j.model.enums.EncryptionMethod;
-import org.springframework.stereotype.Service;
-
-@Service
-@Slf4j
-public class PayloadExportService {
-  @Resource protected ObjectMapper mapper;
-  @Resource private DocumentRepository documentRepository;
-  @Resource private FileService fileService;
-
-  public static final String ZIP_PASSWORD = "infected";
-
-  public String getZipFileName() {
-    return ("payloads_" + now().toString()) + ".zip";
-  }
-
-  public byte[] exportPayloadsToZip(List<Payload> payloads) throws IOException {
-    ByteArrayOutputStream parentOutputStream = new ByteArrayOutputStream();
-    try (java.util.zip.ZipOutputStream parentZip =
-        new java.util.zip.ZipOutputStream(parentOutputStream)) {
-      for (Payload payload : payloads) {
-        ByteArrayOutputStream payloadZipStream = new ByteArrayOutputStream();
-        try (java.util.zip.ZipOutputStream payloadZip =
-            new java.util.zip.ZipOutputStream(payloadZipStream)) {
-          // 1. Add payload.json
-          ZipEntry payloadJsonEntry = new ZipEntry("payload.json");
-          payloadJsonEntry.setComment(EXPORT_ENTRY_PAYLOAD);
-          payloadZip.putNextEntry(payloadJsonEntry);
-          PayloadFileExport payloadExport =
-              PayloadFileExport.fromPayload(payload, mapper.copy(), this.documentRepository);
-          byte[] payloadJsonBytes =
-              payloadExport
-                  .getObjectMapper()
-                  .writerWithDefaultPrettyPrinter()
-                  .writeValueAsBytes(payloadExport);
-          payloadZip.write(payloadJsonBytes);
-          payloadZip.closeEntry();
-
-          // 2. Add attachments.zip **if attachments exist**
-          Optional<Document> optDoc = payload.getAttachedDocument();
-          if (optDoc.isPresent()) {
-            Document doc =
-                documentRepository
-                    .findById(optDoc.get().getId())
-                    .orElseThrow(ElementNotFoundException::new);
-            Optional<InputStream> docStream = fileService.getFile(doc);
-            if (docStream.isPresent()) {
-              ByteArrayOutputStream encryptedZipStream = new ByteArrayOutputStream();
-              try (ZipOutputStream encryptedZip =
-                  new ZipOutputStream(encryptedZipStream, ZIP_PASSWORD.toCharArray())) {
-                ZipParameters params = new ZipParameters();
-                params.setEncryptFiles(true);
-                params.setEncryptionMethod(EncryptionMethod.ZIP_STANDARD);
-                params.setFileNameInZip(doc.getTarget());
-                encryptedZip.putNextEntry(params);
-                byte[] fileBytes = docStream.get().readAllBytes();
-                encryptedZip.write(fileBytes);
-                encryptedZip.closeEntry();
-              }
-              byte[] attachmentsZipBytes = encryptedZipStream.toByteArray();
-              // Add attachments.zip
-              ZipEntry attachmentsEntry = new ZipEntry("attachments.zip");
-              attachmentsEntry.setComment(EXPORT_ENTRY_ENCRYPTED_ATTACHMENT);
-              payloadZip.putNextEntry(attachmentsEntry);
-              payloadZip.write(attachmentsZipBytes);
-              payloadZip.closeEntry();
-            }
-          }
-
-          // 3. Add arguments_attachments.zip
-          List<String> argumentsAttachmentsIds = payload.getArgumentsDocumentsIds();
-          List<Document> argumentsAttachments =
-              argumentsAttachmentsIds.stream()
-                  .map(
-                      s ->
-                          documentRepository.findById(s).orElseThrow(ElementNotFoundException::new))
-                  .toList();
-
-          if (!argumentsAttachments.isEmpty()) {
-            ByteArrayOutputStream encryptedZipStream = new ByteArrayOutputStream();
-            try (ZipOutputStream encryptedZip =
-                new ZipOutputStream(encryptedZipStream, ZIP_PASSWORD.toCharArray())) {
-              for (Document doc : argumentsAttachments) {
-                Optional<InputStream> docStream = fileService.getFile(doc);
-                if (docStream.isPresent()) {
-                  ZipParameters params = new ZipParameters();
-                  params.setEncryptFiles(true);
-                  params.setEncryptionMethod(EncryptionMethod.ZIP_STANDARD);
-                  params.setFileNameInZip(doc.getTarget());
-                  encryptedZip.putNextEntry(params);
-                  byte[] fileBytes = docStream.get().readAllBytes();
-                  encryptedZip.write(fileBytes);
-                  encryptedZip.closeEntry();
-                }
-              }
-            }
-            byte[] argumentsAttachmentsZipBytes = encryptedZipStream.toByteArray();
-            ZipEntry argumentsAttachmentsEntry = new ZipEntry("arguments_attachments.zip");
-            argumentsAttachmentsEntry.setComment(EXPORT_ENTRY_ENCRYPTED_ARGUMENT_ATTACHMENT);
-            payloadZip.putNextEntry(argumentsAttachmentsEntry);
-            payloadZip.write(argumentsAttachmentsZipBytes);
-            payloadZip.closeEntry();
-          }
-        }
-
-        // Add payload zip to parent zip
-        String entryName = payload.getName() + ".zip";
-        ZipEntry payloadZipEntry = new ZipEntry(entryName);
-        payloadZipEntry.setComment(EXPORT_ENTRY_PAYLOAD_ARCHIVE);
-        parentZip.putNextEntry(payloadZipEntry);
-        parentZip.write(payloadZipStream.toByteArray());
-        parentZip.closeEntry();
-      }
-    }
-    return parentOutputStream.toByteArray();
-  }
-}
diff --git a/openaev-api/src/main/java/io/openaev/service/ImportService.java b/openaev-api/src/main/java/io/openaev/service/ImportService.java
index c4e1f2c33bb..07ea2d35fa4 100644
--- a/openaev-api/src/main/java/io/openaev/service/ImportService.java
+++ b/openaev-api/src/main/java/io/openaev/service/ImportService.java
@@ -1,6 +1,5 @@
 package io.openaev.service;
 
-import static io.openaev.rest.payload.service.PayloadExportService.ZIP_PASSWORD;
 import static java.io.File.createTempFile;
 import static java.time.Instant.now;
 
@@ -33,15 +32,12 @@
 
 @Service
 public class ImportService {
+  public static final String ZIP_PASSWORD = "infected";
 
   public static final String EXPORT_ENTRY_EXERCISE = "Exercise";
   public static final String EXPORT_ENTRY_SCENARIO = "Scenario";
   public static final String EXPORT_ENTRY_ATTACHMENT = "Attachment";
-  public static final String EXPORT_ENTRY_ENCRYPTED_ATTACHMENT = "EncryptedAttachment";
-  public static final String EXPORT_ENTRY_ENCRYPTED_ARGUMENT_ATTACHMENT =
-      "EncryptedArgumentAttachment";
   public static final String EXPORT_ENTRY_PAYLOAD_ARCHIVE = "PayloadArchive";
-  public static final String EXPORT_ENTRY_PAYLOAD = "Payload";
 
   private final Map<Integer, Importer> dataImporters = new HashMap<>();
 
diff --git a/openaev-api/src/test/java/io/openaev/api/payload/PayloadApiImporterTest.java b/openaev-api/src/test/java/io/openaev/api/payload/PayloadApiImporterTest.java
index 99de3062952..87a30d8dcf6 100644
--- a/openaev-api/src/test/java/io/openaev/api/payload/PayloadApiImporterTest.java
+++ b/openaev-api/src/test/java/io/openaev/api/payload/PayloadApiImporterTest.java
@@ -7,7 +7,6 @@
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
-import static org.junit.jupiter.api.Assertions.assertSame;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.multipart;
@@ -16,8 +15,6 @@
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import io.openaev.IntegrationTest;
-import io.openaev.database.model.Collector;
-import io.openaev.database.model.DetectionRemediation;
 import io.openaev.database.model.InjectorContract;
 import io.openaev.database.model.Payload;
 import io.openaev.database.repository.CollectorRepository;
@@ -37,7 +34,6 @@
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.mock.web.MockMultipartFile;
-import org.springframework.test.util.ReflectionTestUtils;
 import org.springframework.test.web.servlet.MockMvc;
 import org.springframework.transaction.annotation.Transactional;
 
@@ -518,32 +514,111 @@ void importPayloadWithNullArrayFields() throws Exception {
   }
 
   @Test
-  @DisplayName("Given mixed collector references should sanitize unknown detection remediations")
-  void given_mixedCollectorReferences_should_sanitizeUnknownDetectionRemediations() {
-    // Arrange
+  @DisplayName("Given unknown collector should skip detection remediations during import")
+  void given_unknownCollector_should_skipDetectionRemediations() throws Exception {
+    // -- PREPARE --
+    String unknownCollectorResourceId = UUID.randomUUID().toString();
+    String remediationId = UUID.randomUUID().toString();
+
+    ResourceObject unknownCollectorResource =
+        buildCollectorResource(unknownCollectorResourceId, "non_existing_collector_type");
+
+    ResourceObject remediation =
+        DetectionRemediationFixture.buildDetectionRemediationResource(
+            remediationId, "{\"rule\":\"test\"}", "collectors", unknownCollectorResourceId);
+
+    JsonApiDocument<ResourceObject> document =
+        new JsonApiDocument<>(
+            new ResourceObject(
+                null,
+                "command",
+                buildDefaultPayloadAttributes(),
+                Map.of(
+                    "payload_detection_remediations",
+                    new Relationship(
+                        List.of(new ResourceIdentifier(remediationId, "detection_remediations"))))),
+            List.of(remediation, unknownCollectorResource));
+
+    MockMultipartFile zipFile = buildZipFile(document);
+
+    // -- EXECUTE --
+    String response = performImport(zipFile);
+
+    // -- ASSERT --
+    JsonNode json = objectMapper.readTree(response);
+    String payloadId = json.at("/data/attributes/payload_id").asText();
+    assertNotNull(payloadId);
+
+    Payload payloadPersisted = payloadRepository.findById(payloadId).orElseThrow();
+    assertTrue(
+        payloadPersisted.getDetectionRemediations().isEmpty(),
+        "Detection remediations with unknown collector should be skipped");
+  }
+
+  @Test
+  @DisplayName(
+      "Given mixed known and unknown collectors should keep only known detection remediations")
+  void given_mixedCollectors_should_keepOnlyKnownDetectionRemediations() throws Exception {
+    // -- PREPARE --
     var existingCollector = collectorRepository.findAll().iterator().next();
 
-    DetectionRemediation validRemediation = new DetectionRemediation();
-    Collector collector = new Collector();
-    collector.setId(existingCollector.getId());
-    collector.setType(existingCollector.getType());
-    collector.setName(existingCollector.getName());
-    validRemediation.setCollectorType(collector.getCollectorType());
+    String knownCollectorResourceId = UUID.randomUUID().toString();
+    String unknownCollectorResourceId = UUID.randomUUID().toString();
+    String knownRemediationId = UUID.randomUUID().toString();
+    String unknownRemediationId = UUID.randomUUID().toString();
 
-    DetectionRemediation unknownCollectorRemediation = new DetectionRemediation();
-    unknownCollectorRemediation.setCollectorType(null);
+    ResourceObject knownCollectorResource =
+        buildCollectorResource(knownCollectorResourceId, existingCollector.getType());
+    ResourceObject unknownCollectorResource =
+        buildCollectorResource(unknownCollectorResourceId, "non_existing_collector_type");
 
-    Payload payload = new Payload();
-    payload.setDetectionRemediations(List.of(validRemediation, unknownCollectorRemediation));
+    ResourceObject knownRemediation =
+        DetectionRemediationFixture.buildDetectionRemediationResource(
+            knownRemediationId, "{\"rule\":\"valid\"}", "collectors", knownCollectorResourceId);
+    ResourceObject unknownRemediation =
+        DetectionRemediationFixture.buildDetectionRemediationResource(
+            unknownRemediationId,
+            "{\"rule\":\"invalid\"}",
+            "collectors",
+            unknownCollectorResourceId);
 
-    PayloadApiImporter importer = new PayloadApiImporter(null, null, null);
+    JsonApiDocument<ResourceObject> document =
+        new JsonApiDocument<>(
+            new ResourceObject(
+                null,
+                "command",
+                buildDefaultPayloadAttributes(),
+                Map.of(
+                    "payload_detection_remediations",
+                    new Relationship(
+                        List.of(
+                            new ResourceIdentifier(knownRemediationId, "detection_remediations"),
+                            new ResourceIdentifier(
+                                unknownRemediationId, "detection_remediations"))))),
+            List.of(
+                knownRemediation,
+                unknownRemediation,
+                knownCollectorResource,
+                unknownCollectorResource));
 
-    // Act
-    Payload sanitizedPayload = ReflectionTestUtils.invokeMethod(importer, "sanitize", payload);
+    MockMultipartFile zipFile = buildZipFile(document);
 
-    // Assert
-    assertSame(payload, sanitizedPayload);
-    assertEquals(0, sanitizedPayload.getDetectionRemediations().size());
+    // -- EXECUTE --
+    String response = performImport(zipFile);
+
+    // -- ASSERT --
+    JsonNode json = objectMapper.readTree(response);
+    String payloadId = json.at("/data/attributes/payload_id").asText();
+    assertNotNull(payloadId);
+
+    Payload payloadPersisted = payloadRepository.findById(payloadId).orElseThrow();
+    assertEquals(
+        1,
+        payloadPersisted.getDetectionRemediations().size(),
+        "Only detection remediations with known collector should be kept");
+    assertEquals(
+        existingCollector.getType(),
+        payloadPersisted.getDetectionRemediations().getFirst().getCollector().getType());
   }
 
   @Test
diff --git a/openaev-api/src/test/java/io/openaev/rest/exercise/ExerciseApiStatusTest.java b/openaev-api/src/test/java/io/openaev/rest/exercise/ExerciseApiStatusTest.java
index d2f068b3665..f525613d914 100644
--- a/openaev-api/src/test/java/io/openaev/rest/exercise/ExerciseApiStatusTest.java
+++ b/openaev-api/src/test/java/io/openaev/rest/exercise/ExerciseApiStatusTest.java
@@ -5,6 +5,7 @@
 import static io.openaev.utils.fixtures.InjectFixture.getInjectForEmailContract;
 import static java.time.Instant.now;
 import static java.time.temporal.ChronoUnit.MINUTES;
+import static org.assertj.core.api.AssertionsForInterfaceTypes.assertThat;
 import static org.junit.jupiter.api.Assertions.*;
 import static org.junit.jupiter.api.TestInstance.Lifecycle.PER_CLASS;
 import static org.mockito.Mockito.CALLS_REAL_METHODS;
@@ -22,7 +23,11 @@
 import io.openaev.helper.InjectHelper;
 import io.openaev.injectors.email.model.EmailContent;
 import io.openaev.rest.exercise.form.ExerciseUpdateStatusInput;
+import io.openaev.rest.exercise.service.ExerciseService;
 import io.openaev.utils.fixtures.*;
+import io.openaev.utils.fixtures.composers.ExerciseComposer;
+import io.openaev.utils.fixtures.composers.InjectComposer;
+import io.openaev.utils.fixtures.composers.InjectStatusComposer;
 import io.openaev.utils.mockUser.WithMockUser;
 import jakarta.annotation.Resource;
 import jakarta.servlet.ServletException;
@@ -83,6 +88,10 @@ public class ExerciseApiStatusTest extends IntegrationTest {
   @Autowired private InjectHelper injectHelper;
   @Autowired private InjectorContractFixture injectorContractFixture;
   @Resource protected ObjectMapper mapper;
+  @Autowired private ExerciseService exerciseService;
+  @Autowired private ExerciseComposer exerciseComposer;
+  @Autowired private InjectComposer injectComposer;
+  @Autowired private InjectStatusComposer injectStatusComposer;
 
   @BeforeEach
   void beforeAll() {
@@ -231,13 +240,25 @@ void manualStartExerciseTest() throws Exception {
   @WithMockUser(isAdmin = true)
   void rescheduledExerciseTest() throws Exception {
     // --PREPARE--
+    ExerciseComposer.Composer exerciseWrapper =
+        exerciseComposer
+            .forExercise(ExerciseFixture.createCanceledAttackExercise(REFERENCE_TIME))
+            .withInject(
+                injectComposer
+                    .forInject(InjectFixture.getDefaultInject())
+                    .withInjectStatus(
+                        injectStatusComposer.forInjectStatus(
+                            InjectStatusFixture.createSuccessStatus())))
+            .persist();
     ExerciseUpdateStatusInput input = new ExerciseUpdateStatusInput();
     input.setStatus(ExerciseStatus.SCHEDULED);
 
+    entityManager.flush();
+    entityManager.clear();
     // --EXECUTE--
     String response =
         mvc.perform(
-                put(EXERCISE_URI + "/" + CANCELED_EXERCISE.getId() + "/status")
+                put(EXERCISE_URI + "/" + exerciseWrapper.get().getId() + "/status")
                     .content(asJsonString(input))
                     .contentType(MediaType.APPLICATION_JSON)
                     .accept(MediaType.APPLICATION_JSON)
@@ -246,13 +267,18 @@ void rescheduledExerciseTest() throws Exception {
             .andReturn()
             .getResponse()
             .getContentAsString();
-
+    entityManager.flush();
+    entityManager.clear();
     // --ASSERT--
     assertNull(JsonPath.read(response, "$.exercise_start_date"));
     assertNull(JsonPath.read(response, "$.exercise_end_date"));
     assertEquals(
         List.of(ExerciseStatus.RUNNING.name()),
         JsonPath.read(response, "$.exercise_next_possible_status"));
+
+    List<Inject> resetInjects =
+        exerciseService.exercise(exerciseWrapper.get().getId()).getInjects();
+    assertThat(resetInjects).allSatisfy(inject -> assertThat(inject.getStatus()).isEmpty());
   }
 
   @DisplayName("Check an exercise from finished to scheduled")
@@ -260,13 +286,25 @@ void rescheduledExerciseTest() throws Exception {
   @WithMockUser(isAdmin = true)
   void rescheduledExerciseFromFinishedStateTest() throws Exception {
     // --PREPARE--
+    ExerciseComposer.Composer exerciseWrapper =
+        exerciseComposer
+            .forExercise(ExerciseFixture.createFinishedAttackExercise(REFERENCE_TIME))
+            .withInject(
+                injectComposer
+                    .forInject(InjectFixture.getDefaultInject())
+                    .withInjectStatus(
+                        injectStatusComposer.forInjectStatus(
+                            InjectStatusFixture.createSuccessStatus())))
+            .persist();
+    entityManager.flush();
+    entityManager.clear();
     ExerciseUpdateStatusInput input = new ExerciseUpdateStatusInput();
     input.setStatus(ExerciseStatus.SCHEDULED);
 
     // --EXECUTE--
     String response =
         mvc.perform(
-                put(EXERCISE_URI + "/" + FINISHED_EXERCISE.getId() + "/status")
+                put(EXERCISE_URI + "/" + exerciseWrapper.get().getId() + "/status")
                     .content(asJsonString(input))
                     .contentType(MediaType.APPLICATION_JSON)
                     .accept(MediaType.APPLICATION_JSON)
@@ -275,6 +313,8 @@ void rescheduledExerciseFromFinishedStateTest() throws Exception {
             .andReturn()
             .getResponse()
             .getContentAsString();
+    entityManager.flush();
+    entityManager.clear();
 
     // --ASSERT--
     assertNull(JsonPath.read(response, "$.exercise_start_date"));
@@ -282,6 +322,10 @@ void rescheduledExerciseFromFinishedStateTest() throws Exception {
     assertEquals(
         List.of(ExerciseStatus.RUNNING.name()),
         JsonPath.read(response, "$.exercise_next_possible_status"));
+
+    List<Inject> resetInjects =
+        exerciseService.exercise(exerciseWrapper.get().getId()).getInjects();
+    assertThat(resetInjects).allSatisfy(inject -> assertThat(inject.getStatus()).isEmpty());
   }
 
   @DisplayName("Check an exercise from pause to running")
diff --git a/openaev-api/src/test/java/io/openaev/service/ScenarioServiceTest.java b/openaev-api/src/test/java/io/openaev/service/ScenarioServiceTest.java
index 7bddaae76fa..1bb4fb6ae4c 100644
--- a/openaev-api/src/test/java/io/openaev/service/ScenarioServiceTest.java
+++ b/openaev-api/src/test/java/io/openaev/service/ScenarioServiceTest.java
@@ -470,6 +470,30 @@ public void testRunChecksForMissingContentIssue() {
     assertEquals(HealthCheck.Status.WARNING, healthCheckToVerify.getStatus());
   }
 
+  @Test
+  @Transactional
+  public void given_disabledInject_should_notReturnMissingContent() {
+    // Arrange
+    Inject inject = new Inject();
+    inject.setEnabled(false);
+    Scenario scenario = new Scenario();
+    scenario.setInjects(new HashSet<>(List.of(inject)));
+    this.scenarioRepository.save(scenario);
+
+    // Act
+    when(this.injectService.runChecks(any())).thenReturn(List.of());
+    List<HealthCheck> healthchecks = scenarioService.runChecks(scenario.getId());
+
+    // Assert
+    boolean hasMissingContent =
+        healthchecks.stream()
+            .anyMatch(
+                hc ->
+                    HealthCheck.Type.INJECT.equals(hc.getType())
+                        && HealthCheck.Detail.NOT_READY.equals(hc.getDetail()));
+    assertFalse(hasMissingContent, "Disabled inject should not trigger MISSING_CONTENT check");
+  }
+
   @Test
   @Transactional
   public void testRunChecksForTeamsIssue() {
diff --git a/openaev-framework/pom.xml b/openaev-framework/pom.xml
index cc3d56bc4ed..293f26e809f 100644
--- a/openaev-framework/pom.xml
+++ b/openaev-framework/pom.xml
@@ -6,7 +6,7 @@
     <parent>
         <groupId>io.openaev</groupId>
         <artifactId>openaev-platform</artifactId>
-        <version>2.3.3</version>
+        <version>2.3.4</version>
     </parent>
 
     <artifactId>openaev-framework</artifactId>
@@ -17,7 +17,7 @@
         <dependency>
             <groupId>io.openaev</groupId>
             <artifactId>openaev-model</artifactId>
-            <version>2.3.3</version>
+            <version>2.3.4</version>
         </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
diff --git a/openaev-front/package.json b/openaev-front/package.json
index 8a98f9fcb49..2376490019d 100644
--- a/openaev-front/package.json
+++ b/openaev-front/package.json
@@ -1,6 +1,6 @@
 {
   "name": "openaev-front",
-  "version": "2.3.3",
+  "version": "2.3.4",
   "type": "module",
   "private": true,
   "license": "Apache-2.0",
@@ -21,9 +21,9 @@
     "control": "yarn audit --groups dependencies --summary",
     "check-ts": "tsc",
     "generate-types-from-api": "swagger-typescript-api generate --no-client --path=${API_URL:-http://localhost:8080}/api-docs --output=src/utils --name=api-types.d.ts --sort-types",
-    "test": "vitest run",
-    "test:e2e": "yarn playwright test",
-    "test:e2e:ui": "yarn playwright test --ui",
+    "test": "vitest run --coverage",
+    "test:e2e": "yarn playwright test --workers=1 --retries=2",
+    "test:e2e:ui": "yarn playwright test --ui --workers=1",
     "test:e2e:coverage": "E2E_COVERAGE=true yarn playwright test && yarn show-report-e2e",
     "generate-test-e2e": "yarn playwright codegen http://localhost:3001/",
     "show-report-e2e": "start \"\" test-results/report.html && start \"\" test-results/coverage/index.html"
@@ -120,6 +120,7 @@
     "@types/react-syntax-highlighter": "15",
     "@typescript-eslint/utils": "8.57.0",
     "@vitejs/plugin-react": "6.0.1",
+    "@vitest/coverage-v8": "4.1.2",
     "@vitest/eslint-plugin": "1.6.12",
     "chokidar": "5.0.0",
     "cross-env": "10.1.0",
@@ -135,8 +136,8 @@
     "express": "5.2.1",
     "fs-extra": "11.3.4",
     "globals": "17.4.0",
+    "happy-dom": "^18.0.1",
     "i18n-auto-translation": "2.2.3",
-    "jsdom": "29.0.1",
     "monocart-coverage-reports": "2.12.9",
     "monocart-reporter": "2.10.1",
     "swagger-typescript-api": "13.6.3",
diff --git a/openaev-front/playwright.config.ts b/openaev-front/playwright.config.ts
index 171a4366675..4b9195601d2 100644
--- a/openaev-front/playwright.config.ts
+++ b/openaev-front/playwright.config.ts
@@ -1,9 +1,11 @@
 // imports to not let tools report them as unused
-import 'monocart-reporter';
 import 'monocart-coverage-reports';
+import 'monocart-reporter';
 
 import { defineConfig, devices } from '@playwright/test';
 
+import coverageOptions from './tests_e2e/conf/mcr.config';
+
 /**
  * See https://playwright.dev/docs/test-configuration.
  */
@@ -24,10 +26,12 @@ export default defineConfig({
       name: `OpenAEV Report`,
       outputFile: './test-results/report.html',
       // global coverage report options
-      coverage: {
-        entryFilter: () => true,
-        sourceFilter: (sourcePath: string) => sourcePath.startsWith('src'),
-      },
+      coverage: coverageOptions,
+      /*
+      onEnd: async (reportData) => {
+        // teams integration with webhook
+        await teamsWebhook(reportData);
+      } */
     }],
   ],
   /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
diff --git a/openaev-front/playwright.nightly.config.ts b/openaev-front/playwright.nightly.config.ts
new file mode 100644
index 00000000000..4d65b8dad29
--- /dev/null
+++ b/openaev-front/playwright.nightly.config.ts
@@ -0,0 +1,83 @@
+/**
+ * Playwright configuration for nightly CI runs.
+ *
+ * Extends the base configuration with all desktop browser projects.
+ * Used by the nightly-ci workflow via:
+ *   yarn playwright test --config playwright.nightly.config.ts --project=<browser>
+ */
+// eslint-disable-next-line import/no-extraneous-dependencies
+import { defineConfig, devices } from '@playwright/test';
+
+import baseConfig from './playwright.config';
+
+export default defineConfig({
+  ...baseConfig,
+  projects: [
+    {
+      name: 'setup',
+      testMatch: /.*\.setup\.ts/,
+    },
+    {
+      name: 'chromium',
+      use: {
+        ...devices['Desktop Chrome'],
+        storageState: 'tests_e2e/.auth/user.json',
+        viewport: {
+          width: 1920,
+          height: 1080,
+        },
+      },
+      dependencies: ['setup'],
+    },
+    {
+      name: 'firefox',
+      use: {
+        ...devices['Desktop Firefox'],
+        storageState: 'tests_e2e/.auth/user.json',
+        viewport: {
+          width: 1920,
+          height: 1080,
+        },
+      },
+      dependencies: ['setup'],
+    },
+    {
+      name: 'webkit',
+      use: {
+        ...devices['Desktop Safari'],
+        storageState: 'tests_e2e/.auth/user.json',
+        viewport: {
+          width: 1920,
+          height: 1080,
+        },
+      },
+      dependencies: ['setup'],
+    },
+    {
+      name: 'chrome',
+      use: {
+        ...devices['Desktop Chrome'],
+        channel: 'chrome',
+        storageState: 'tests_e2e/.auth/user.json',
+        viewport: {
+          width: 1920,
+          height: 1080,
+        },
+      },
+      dependencies: ['setup'],
+    },
+    {
+      name: 'edge',
+      use: {
+        ...devices['Desktop Edge'],
+        channel: 'msedge',
+        storageState: 'tests_e2e/.auth/user.json',
+        viewport: {
+          width: 1920,
+          height: 1080,
+        },
+      },
+      dependencies: ['setup'],
+    },
+  ],
+});
diff --git a/openaev-front/src/actions/payloads/payload-actions.ts b/openaev-front/src/actions/payloads/payload-actions.ts
index 0a5be880d2e..5572f1fb218 100644
--- a/openaev-front/src/actions/payloads/payload-actions.ts
+++ b/openaev-front/src/actions/payloads/payload-actions.ts
@@ -46,7 +46,7 @@ export const fetchCollectorsForPayload = (payloadId: string) => (dispatch: Dispa
 
 // -- EXPORT --
 export const exportPayload = (id: string) => {
-  return simplePostCall(`${PAYLOAD_URI}/${id}/export`, {
+  return simpleCall(`${PAYLOAD_URI}/${id}/export`, {
     params: { include: true },
     headers: { Accept: 'application/zip' },
     responseType: 'blob',
diff --git a/openaev-front/src/admin/components/common/injects/InjectPopover.tsx b/openaev-front/src/admin/components/common/injects/InjectPopover.tsx
index d190380c477..23f8729948d 100644
--- a/openaev-front/src/admin/components/common/injects/InjectPopover.tsx
+++ b/openaev-front/src/admin/components/common/injects/InjectPopover.tsx
@@ -39,6 +39,7 @@ interface Props {
   inject: InjectPopoverType;
   setSelectedInjectId: (injectId: Inject['inject_id']) => void;
   isDisabled?: boolean;
+  isUpdateDisabled?: boolean;
   canBeTested?: boolean;
   canDone?: boolean;
   canTriggerNow?: boolean;
@@ -57,6 +58,7 @@ const InjectPopover: FunctionComponent<Props> = ({
   inject,
   setSelectedInjectId,
   isDisabled = false,
+  isUpdateDisabled = true,
   canBeTested = false,
   canDone = false,
   canTriggerNow = false,
@@ -218,7 +220,7 @@ const InjectPopover: FunctionComponent<Props> = ({
   entries.push({
     label: 'Update',
     action: () => handleOpenEditContent(),
-    disabled: isDisabled,
+    disabled: isDisabled || isUpdateDisabled,
     userRight: permissions.canManage,
   });
   entries.push({
diff --git a/openaev-front/src/admin/components/common/injects/Injects.tsx b/openaev-front/src/admin/components/common/injects/Injects.tsx
index c2f5e951b86..b08a68e52a5 100644
--- a/openaev-front/src/admin/components/common/injects/Injects.tsx
+++ b/openaev-front/src/admin/components/common/injects/Injects.tsx
@@ -197,17 +197,19 @@ const Injects: FunctionComponent<Props> = ({
       label: 'Status',
       isSortable: false,
       value: (inject: InjectOutputType, _: InjectorContractConverted['convertedContent']) => {
-        let injectLabel = inject.inject_enabled
-          ? t('Enabled')
-          : t('Disabled');
+        let injectLabel;
         let injectTooltip = '';
-        if (!inject.inject_ready) {
+        if (!inject.inject_enabled) {
+          injectLabel = t('Disabled');
+        } else if (!inject.inject_ready) {
           injectLabel = t('Missing content');
           injectTooltip = inject.inject_healthchecks
             ? `${t('Missing content')} : ${inject.inject_healthchecks.filter(healthcheck => 'MANDATORY_CONTENT' === healthcheck.detail)
               .map(healthcheck => t(`healthcheck.description.${healthcheck.type}.${healthcheck.detail}`))
               .join(', ')}`
             : '';
+        } else {
+          injectLabel = t('Enabled');
         }
         return (
           <ItemBoolean
diff --git a/openaev-front/src/admin/components/common/injects/UpdateInject.tsx b/openaev-front/src/admin/components/common/injects/UpdateInject.tsx
index d3e2c8ea65e..256d9a431eb 100644
--- a/openaev-front/src/admin/components/common/injects/UpdateInject.tsx
+++ b/openaev-front/src/admin/components/common/injects/UpdateInject.tsx
@@ -197,7 +197,8 @@ const UpdateInject: React.FC<Props> = ({
             <InjectForm
               handleClose={handleClose}
               disabled={
-                !injectorContractContent
+                !inject.inject_enabled
+                || !injectorContractContent
                 || permissions.readOnly
                 || (inherited_context === INHERITED_CONTEXT.NONE
                   && ability.cannot(ACTIONS.MANAGE, SUBJECTS.RESOURCE, injectId))
@@ -240,8 +241,9 @@ const UpdateInject: React.FC<Props> = ({
               onUpdateInject={massUpdateInject}
               injects={injects}
               isDisabled={
-                !permissions.canManage
-                && ability.cannot(ACTIONS.MANAGE, SUBJECTS.RESOURCE, injectId)
+                !inject.inject_enabled
+                || (!permissions.canManage
+                  && ability.cannot(ACTIONS.MANAGE, SUBJECTS.RESOURCE, injectId))
               }
             />
           )}
diff --git a/openaev-front/src/admin/components/common/injects/expectations/InjectAddExpectation.tsx b/openaev-front/src/admin/components/common/injects/expectations/InjectAddExpectation.tsx
index 137bc35226a..c8a9c76be36 100644
--- a/openaev-front/src/admin/components/common/injects/expectations/InjectAddExpectation.tsx
+++ b/openaev-front/src/admin/components/common/injects/expectations/InjectAddExpectation.tsx
@@ -19,11 +19,13 @@ const useStyles = makeStyles()(theme => ({
 interface InjectAddExpectationProps {
   predefinedExpectations: ExpectationInput[];
   handleAddExpectation: (data: ExpectationInput) => void;
+  disabled?: boolean;
 }
 
 const InjectAddExpectation: FunctionComponent<InjectAddExpectationProps> = ({
   predefinedExpectations,
   handleAddExpectation,
+  disabled,
 }) => {
   // Standard hooks
   const { classes } = useStyles();
@@ -52,6 +54,7 @@ const InjectAddExpectation: FunctionComponent<InjectAddExpectationProps> = ({
         divider={true}
         onClick={handleOpen}
         color="primary"
+        disabled={disabled}
       >
         <ListItemIcon color="primary">
           <ControlPointOutlined color="primary" />
diff --git a/openaev-front/src/admin/components/common/injects/expectations/InjectExpectations.tsx b/openaev-front/src/admin/components/common/injects/expectations/InjectExpectations.tsx
index c8545cae735..c6ad173e830 100644
--- a/openaev-front/src/admin/components/common/injects/expectations/InjectExpectations.tsx
+++ b/openaev-front/src/admin/components/common/injects/expectations/InjectExpectations.tsx
@@ -35,6 +35,7 @@ const InjectExpectations: FunctionComponent<InjectExpectationsProps> = ({
   handleExpectations,
   injectId,
   injectorContractId,
+  readOnly,
 }) => {
   // Standard hooks
   const { classes } = useStyles();
@@ -147,6 +148,7 @@ const InjectExpectations: FunctionComponent<InjectExpectationsProps> = ({
       { userCanAddExpectations && predefinedExpectations?.length !== 0
         && (
           <InjectAddExpectation
+            disabled={readOnly}
             handleAddExpectation={handleAddExpectation}
             predefinedExpectations={predefinedExpectations}
           />
diff --git a/openaev-front/src/admin/components/common/injects/form/InjectContentForm.tsx b/openaev-front/src/admin/components/common/injects/form/InjectContentForm.tsx
index ec24afcb4eb..df3720a35d9 100644
--- a/openaev-front/src/admin/components/common/injects/form/InjectContentForm.tsx
+++ b/openaev-front/src/admin/components/common/injects/form/InjectContentForm.tsx
@@ -54,8 +54,13 @@ const InjectContentForm = ({
   const ability = useContext(AbilityContext);
 
   const renderTitle = (title: string, required: boolean = false, err: boolean = false) => {
+    const getTitleColor = () => {
+      if (err) return 'error';
+      if (readOnly) return 'text.disabled';
+      return 'textPrimary';
+    };
     return (
-      <Typography variant="h5" color={err ? 'error' : 'textPrimary'}>
+      <Typography variant="h5" color={getTitleColor()}>
         {title}
         {required ? '*' : '' }
       </Typography>
diff --git a/openaev-front/src/admin/components/common/injects/form/InjectForm.tsx b/openaev-front/src/admin/components/common/injects/form/InjectForm.tsx
index 0ebb7d22685..97acf29be97 100644
--- a/openaev-front/src/admin/components/common/injects/form/InjectForm.tsx
+++ b/openaev-front/src/admin/components/common/injects/form/InjectForm.tsx
@@ -507,9 +507,9 @@ const InjectForm = ({
         {!isAtomic && (
           <div className={`${classes.triggerBox} ${isSubmitting || disabled || permissions.readOnly ? classes.triggerBoxColorDisabled : classes.triggerBoxColor}`}>
             <div className={`${classes.triggerText} ${isSubmitting || disabled || permissions.readOnly ? classes.triggerTextColorDisabled : classes.triggerTextColor}`}>{t('Trigger after')}</div>
-            <TextFieldController name="inject_depends_duration_days" label={t('Days')} type="number" disabled={permissions.readOnly} />
-            <TextFieldController name="inject_depends_duration_hours" label={t('Hours')} type="number" disabled={permissions.readOnly} />
-            <TextFieldController name="inject_depends_duration_minutes" label={t('Minutes')} type="number" disabled={permissions.readOnly} />
+            <TextFieldController name="inject_depends_duration_days" label={t('Days')} type="number" disabled={permissions.readOnly || disabled} />
+            <TextFieldController name="inject_depends_duration_hours" label={t('Hours')} type="number" disabled={permissions.readOnly || disabled} />
+            <TextFieldController name="inject_depends_duration_minutes" label={t('Minutes')} type="number" disabled={permissions.readOnly || disabled} />
           </div>
         )}
 
diff --git a/openaev-front/src/admin/components/common/injects/form/teams/InjectTeamsList.tsx b/openaev-front/src/admin/components/common/injects/form/teams/InjectTeamsList.tsx
index caae7cc03d5..a7068dd8aca 100644
--- a/openaev-front/src/admin/components/common/injects/form/teams/InjectTeamsList.tsx
+++ b/openaev-front/src/admin/components/common/injects/form/teams/InjectTeamsList.tsx
@@ -1,5 +1,5 @@
 import { GroupsOutlined } from '@mui/icons-material';
-import { FormHelperText, List, ListItem, ListItemIcon, ListItemText, Tooltip } from '@mui/material';
+import { FormHelperText, List, ListItem, ListItemIcon, ListItemText, Tooltip, Typography } from '@mui/material';
 import { type FunctionComponent, useContext, useEffect, useState } from 'react';
 import { useFormContext, useWatch } from 'react-hook-form';
 import { makeStyles } from 'tss-react/mui';
@@ -63,6 +63,8 @@ const InjectTeamsList: FunctionComponent<Props> = ({ readOnly = false, hideEnabl
     setValue('inject_teams', updatedTeamIds, { shouldValidate: true });
   };
 
+  const textColor = readOnly ? 'text.disabled' : 'text.primary';
+
   const teamListItem = (team: TeamOutput, userEnabled: number) => (
     <ListItem
       key={team.team_id}
@@ -76,20 +78,20 @@ const InjectTeamsList: FunctionComponent<Props> = ({ readOnly = false, hideEnabl
       )}
     >
       <ListItemIcon>
-        <GroupsOutlined />
+        <GroupsOutlined color={readOnly ? 'disabled' : 'inherit'} />
       </ListItemIcon>
       <ListItemText
         primary={(
           <div className={classes.column}>
-            <div className={classes.bodyItem}>
+            <Typography color={textColor} className={classes.bodyItem}>
               {team.team_name}
-            </div>
-            <Tooltip title={t('Number of users')} className={classes.bodyItem}>
-              <span data-testid="user-count">{team.team_users_number}</span>
+            </Typography>
+            <Tooltip color={textColor} title={t('Number of users')} className={classes.bodyItem}>
+              <Typography>{team.team_users_number}</Typography>
             </Tooltip>
             {!hideEnabledUsersNumber && (
-              <Tooltip title={t('Number of enable user')} className={classes.bodyItem}>
-                <span data-testid="enable-user-count">{userEnabled}</span>
+              <Tooltip color={textColor} title={t('Number of enable user')} className={classes.bodyItem}>
+                <Typography>{userEnabled}</Typography>
               </Tooltip>
             )}
             <div className={classes.bodyItem}>
diff --git a/openaev-front/src/admin/components/settings/groups/GroupManageRoles.tsx b/openaev-front/src/admin/components/settings/groups/GroupManageRoles.tsx
index 052035af8a0..a951b4a1382 100644
--- a/openaev-front/src/admin/components/settings/groups/GroupManageRoles.tsx
+++ b/openaev-front/src/admin/components/settings/groups/GroupManageRoles.tsx
@@ -11,6 +11,7 @@ import { useAppDispatch } from '../../../../utils/hooks';
 
 interface GroupManageRolesProps {
   initialState: string[];
+  groupName: string;
   open: boolean;
   onClose: () => void;
   onSubmit: (roleIds: string[]) => void;
@@ -19,6 +20,7 @@ interface GroupManageRolesProps {
 const GroupManageRoles: FC<GroupManageRolesProps> = (
   {
     initialState,
+    groupName,
     open,
     onClose,
     onSubmit,
@@ -63,11 +65,13 @@ const GroupManageRoles: FC<GroupManageRolesProps> = (
     handleClose();
   };
 
+  const title = t('Manage roles for group: {groupName}', { groupName });
+
   return (
     <Drawer
       open={open}
       handleClose={onClose}
-      title={t('Manage the roles of this group')}
+      title={title}
     >
       <Box>
         {roles.map(role => (
diff --git a/openaev-front/src/admin/components/settings/groups/GroupManageUsers.tsx b/openaev-front/src/admin/components/settings/groups/GroupManageUsers.tsx
index 07d3257553a..fe93db328fb 100644
--- a/openaev-front/src/admin/components/settings/groups/GroupManageUsers.tsx
+++ b/openaev-front/src/admin/components/settings/groups/GroupManageUsers.tsx
@@ -16,6 +16,7 @@ import { resolveUserName } from '../../../../utils/String';
 
 interface Props {
   initialState: string[];
+  groupName: string;
   open: boolean;
   onClose: () => void;
   onSubmit: (userIds: string[]) => void;
@@ -25,6 +26,7 @@ interface Props {
 
 const GroupManageUsers: FunctionComponent<Props> = ({
   initialState = [],
+  groupName,
   open,
   onClose,
   onSubmit,
@@ -91,11 +93,13 @@ const GroupManageUsers: FunctionComponent<Props> = ({
     handleClose();
   };
 
+  const title = t('Manage users for group: {groupName}', { groupName });
+
   return (
     <Drawer
       open={open}
       handleClose={handleClose}
-      title={t('Manage the users of this group')}
+      title={title}
       variant="full"
     >
       <Box sx={{ marginTop: 2 }}>
diff --git a/openaev-front/src/admin/components/settings/groups/GroupPopover.jsx b/openaev-front/src/admin/components/settings/groups/GroupPopover.jsx
index a61d3435401..0c263367ad2 100644
--- a/openaev-front/src/admin/components/settings/groups/GroupPopover.jsx
+++ b/openaev-front/src/admin/components/settings/groups/GroupPopover.jsx
@@ -219,12 +219,14 @@ class GroupPopoverComponent extends Component {
         </Drawer>
         <GroupManageUsers
           initialState={this.state.usersIds}
+          groupName={group.group_name}
           open={this.state.openUsers}
           onClose={this.handleCloseUsers.bind(this)}
           onSubmit={this.submitUpdateUsers.bind(this)}
         />
         <GroupManageRoles
           initialState={this.state.rolesIds}
+          groupName={group.group_name}
           open={this.state.openRoles}
           onClose={this.handleCloseRoles.bind(this)}
           onSubmit={this.submitUpdateRoles.bind(this)}
diff --git a/openaev-front/src/admin/components/settings/groups/grants/GroupManageGrants.tsx b/openaev-front/src/admin/components/settings/groups/grants/GroupManageGrants.tsx
index e975b460dc9..6568725574a 100644
--- a/openaev-front/src/admin/components/settings/groups/grants/GroupManageGrants.tsx
+++ b/openaev-front/src/admin/components/settings/groups/grants/GroupManageGrants.tsx
@@ -24,11 +24,13 @@ const GroupManageGrants: FunctionComponent<GroupManageGrantsProps> = ({
 }) => {
   const { t } = useFormatter();
 
+  const title = t('Manage grants for group: {groupName}', { groupName: group.group_name });
+
   return (
     <Drawer
       open={openGrants}
       handleClose={handleCloseGrants}
-      title={t('Manage grants')}
+      title={title}
     >
       <TabbedView
         tabs={[
diff --git a/openaev-front/src/utils/api-types.d.ts b/openaev-front/src/utils/api-types.d.ts
index d742f582397..9b2d5835aaa 100644
--- a/openaev-front/src/utils/api-types.d.ts
+++ b/openaev-front/src/utils/api-types.d.ts
@@ -5868,14 +5868,6 @@ export type PayloadCreateInput = BasePayloadCreateInput &
     | BasePayloadCreateInputPayloadTypeMapping<"NetworkTraffic", NetworkTraffic>
   );
 
-export interface PayloadExportRequestInput {
-  payloads?: PayloadExportTarget[];
-}
-
-export interface PayloadExportTarget {
-  payload_id?: string;
-}
-
 export interface PayloadInput {
   command_content?: string | null;
   command_executor?: string | null;
diff --git a/openaev-front/src/utils/lang/de.json b/openaev-front/src/utils/lang/de.json
index fac953cada5..44379e30045 100644
--- a/openaev-front/src/utils/lang/de.json
+++ b/openaev-front/src/utils/lang/de.json
@@ -1237,6 +1237,9 @@
   "Manage the roles of this group": "Verwalten Sie die Rollen dieser Gruppe",
   "Manage the users of this group": "Verwalten Sie die Benutzer dieser Gruppe",
   "Manage users": "Verwalten Sie die Benutzer",
+  "Manage users for group: {groupName}": "Benutzer für Gruppe verwalten: {groupName}",
+  "Manage roles for group: {groupName}": "Rollen für Gruppe verwalten: {groupName}",
+  "Manage grants for group: {groupName}": "Zuschüsse für die Gruppe verwalten: {groupName}",
   "Manage your enterprise edition license": "Verwalten Sie Ihre Enterprise-Edition-Lizenz",
   "MANAGE_ASSESSMENT": "Verwalten der Bewertung",
   "MANAGE_ASSETS": "Verwalten von Vermögenswerten",
diff --git a/openaev-front/src/utils/lang/en.json b/openaev-front/src/utils/lang/en.json
index 6439d96cfef..ba4bcbca67c 100644
--- a/openaev-front/src/utils/lang/en.json
+++ b/openaev-front/src/utils/lang/en.json
@@ -1237,6 +1237,9 @@
   "Manage the roles of this group": "Manage the roles of this group",
   "Manage the users of this group": "Manage the users of this group",
   "Manage users": "Manage users",
+  "Manage users for group: {groupName}": "Manage users for group: {groupName}",
+  "Manage roles for group: {groupName}": "Manage roles for group: {groupName}",
+  "Manage grants for group: {groupName}": "Manage grants for group: {groupName}",
   "Manage your enterprise edition license": "Manage your enterprise edition license",
   "MANAGE_ASSESSMENT": "Manage assessment",
   "MANAGE_ASSETS": "Manage assets",
diff --git a/openaev-front/src/utils/lang/es.json b/openaev-front/src/utils/lang/es.json
index e10ab5a935d..aee706bbd09 100644
--- a/openaev-front/src/utils/lang/es.json
+++ b/openaev-front/src/utils/lang/es.json
@@ -1238,6 +1238,9 @@
   "Manage the roles of this group": "Gestionar los roles de este grupo",
   "Manage the users of this group": "Gestionar los usuarios de este grupo",
   "Manage users": "Gestionar usuarios",
+  "Manage users for group: {groupName}": "Gestionar los usuarios para grupo: {groupName}",
+  "Manage roles for group: {groupName}": "Gestionar los roles para el grupo: {groupName}",
+  "Manage grants for group: {groupName}": "Gestionar las subvenciones para el grupo: {groupName}",
   "Manage your enterprise edition license": "Gestionar la licencia de la edición empresarial",
   "MANAGE_ASSESSMENT": "Gestionar la evaluación",
   "MANAGE_ASSETS": "Gestionar activos",
diff --git a/openaev-front/src/utils/lang/fr.json b/openaev-front/src/utils/lang/fr.json
index b394c1c97cb..512b60d1c92 100644
--- a/openaev-front/src/utils/lang/fr.json
+++ b/openaev-front/src/utils/lang/fr.json
@@ -1237,6 +1237,9 @@
   "Manage the roles of this group": "Gérer les rôles de ce groupe",
   "Manage the users of this group": "Gérer les utilisateurs de ce groupe",
   "Manage users": "Gérer les utilisateurs",
+  "Manage users for group: {groupName}": "Gérer les utilisateurs du groupe: {groupName}",
+  "Manage roles for group: {groupName}": "Gérer les rôles du groupe: {groupName}",
+  "Manage grants for group: {groupName}": "Gérer les permissions du groupe: {groupName}",
   "Manage your enterprise edition license": "Gérer votre licence d'édition entreprise",
   "MANAGE_ASSESSMENT": "Gérer les évaluations",
   "MANAGE_ASSETS": "Gérer les actifs",
diff --git a/openaev-front/src/utils/lang/it.json b/openaev-front/src/utils/lang/it.json
index 9b7872b5198..80f487c878f 100644
--- a/openaev-front/src/utils/lang/it.json
+++ b/openaev-front/src/utils/lang/it.json
@@ -1238,6 +1238,9 @@
   "Manage the roles of this group": "Gestire i ruoli di questo gruppo",
   "Manage the users of this group": "Gestire gli utenti di questo gruppo",
   "Manage users": "Gestire gli utenti",
+  "Manage users for group: {groupName}": "Gestire gli utenti per il gruppo: {groupName}",
+  "Manage roles for group: {groupName}": "Gestire i ruoli per il gruppo: {groupName}",
+  "Manage grants for group: {groupName}": "Gestire le sovvenzioni per il gruppo: {groupName}",
   "Manage your enterprise edition license": "Gestire la licenza dell'edizione enterprise",
   "MANAGE_ASSESSMENT": "Gestire la valutazione",
   "MANAGE_ASSETS": "Gestire gli asset",
diff --git a/openaev-front/src/utils/lang/ja.json b/openaev-front/src/utils/lang/ja.json
index 686b581a4aa..070f983bd51 100644
--- a/openaev-front/src/utils/lang/ja.json
+++ b/openaev-front/src/utils/lang/ja.json
@@ -1238,6 +1238,9 @@
   "Manage the roles of this group": "このグループの役割を管理する",
   "Manage the users of this group": "このグループのユーザーを管理する",
   "Manage users": "ユーザーの管理",
+  "Manage users for group: {groupName}": "グループ {groupName} のユーザーを管理します。",
+  "Manage roles for group: {groupName}": "グループの役割を管理します: {groupName}",
+  "Manage grants for group: {groupName}": "グループ{groupName}の助成金を管理します。",
   "Manage your enterprise edition license": "エンタープライズ版ライセンスの管理",
   "MANAGE_ASSESSMENT": "評価の管理",
   "MANAGE_ASSETS": "資産の管理",
diff --git a/openaev-front/src/utils/lang/ko.json b/openaev-front/src/utils/lang/ko.json
index 6c5240eabd9..3e52292b77a 100644
--- a/openaev-front/src/utils/lang/ko.json
+++ b/openaev-front/src/utils/lang/ko.json
@@ -1238,6 +1238,9 @@
   "Manage the roles of this group": "이 그룹의 역할 관리",
   "Manage the users of this group": "이 그룹의 사용자 관리",
   "Manage users": "사용자 관리",
+  "Manage users for group: {groupName}": "그룹 {groupName}의 사용자 관리",
+  "Manage roles for group: {groupName}": "그룹 {groupName}의 역할 관리",
+  "Manage grants for group: {groupName}": "그룹 {groupName}에 대한 보조금 관리",
   "Manage your enterprise edition license": "엔터프라이즈 에디션 라이선스 관리",
   "MANAGE_ASSESSMENT": "평가 관리",
   "MANAGE_ASSETS": "자산 관리",
diff --git a/openaev-front/src/utils/lang/ru.json b/openaev-front/src/utils/lang/ru.json
index 05c4958699e..4cd770523ae 100644
--- a/openaev-front/src/utils/lang/ru.json
+++ b/openaev-front/src/utils/lang/ru.json
@@ -1238,6 +1238,9 @@
   "Manage the roles of this group": "Управление ролями этой группы",
   "Manage the users of this group": "Управление пользователями этой группы",
   "Manage users": "Управление пользователями",
+  "Manage users for group: {groupName}": "Управление пользователями для группы: {groupName}",
+  "Manage roles for group: {groupName}": "Управление ролями для группы: {groupName}",
+  "Manage grants for group: {groupName}": "Управление грантами для группы: {groupName}",
   "Manage your enterprise edition license": "Управление лицензией корпоративной версии",
   "MANAGE_ASSESSMENT": "Управление оценкой",
   "MANAGE_ASSETS": "Управление активами",
diff --git a/openaev-front/src/utils/lang/zh.json b/openaev-front/src/utils/lang/zh.json
index 84131a5c145..afc91d454d7 100644
--- a/openaev-front/src/utils/lang/zh.json
+++ b/openaev-front/src/utils/lang/zh.json
@@ -1238,6 +1238,9 @@
   "Manage the roles of this group": "管理该组的角色",
   "Manage the users of this group": "管理组内用户",
   "Manage users": "管理用户",
+  "Manage users for group: {groupName}": "管理组 {groupName} 的用户",
+  "Manage roles for group: {groupName}": "管理组角色：{groupName}",
+  "Manage grants for group: {groupName}": "管理组 {groupName} 的授权",
   "Manage your enterprise edition license": "管理您的企业版许可证",
   "MANAGE_ASSESSMENT": "管理评估",
   "MANAGE_ASSETS": "管理资产",
diff --git a/openaev-front/tests_e2e/conf/mcr.config.ts b/openaev-front/tests_e2e/conf/mcr.config.ts
index b29bebc6c14..cac7d0a9060 100644
--- a/openaev-front/tests_e2e/conf/mcr.config.ts
+++ b/openaev-front/tests_e2e/conf/mcr.config.ts
@@ -9,6 +9,7 @@ const coverageOptions: CoverageReportOptions = {
     'console-details',
     'v8',
     'lcovonly',
+    'json-summary',
   ],
 
   entryFilter: {
diff --git a/openaev-front/tests_e2e/fixtures/baseFixtures.ts b/openaev-front/tests_e2e/fixtures/baseFixtures.ts
index 97b82bcaddf..a3002d39f58 100644
--- a/openaev-front/tests_e2e/fixtures/baseFixtures.ts
+++ b/openaev-front/tests_e2e/fixtures/baseFixtures.ts
@@ -1,7 +1,5 @@
 import { type Page, test as testBase } from '@playwright/test';
-import MCR from 'monocart-coverage-reports';
-
-import coverageOptions from '../conf/mcr.config';
+import { addCoverageReport } from 'monocart-reporter';
 
 // fixtures
 const test = testBase.extend<{ autoTestFixture: string }>({
@@ -30,8 +28,7 @@ const test = testBase.extend<{ autoTestFixture: string }>({
         const cssCoverage = await page.coverage.stopCSSCoverage();
         return [...jsCoverage, ...cssCoverage];
       }));
-      const mcr = MCR(coverageOptions);
-      await mcr.add(coverageList.flat());
+      await addCoverageReport(coverageList.flat(), test.info());
     }
   }, {
     scope: 'test',
diff --git a/openaev-front/tests_e2e/tests/login/login.spec.ts b/openaev-front/tests_e2e/tests/login/login.spec.ts
new file mode 100644
index 00000000000..8e2e11a7632
--- /dev/null
+++ b/openaev-front/tests_e2e/tests/login/login.spec.ts
@@ -0,0 +1,21 @@
+import { expect } from '@playwright/test';
+
+import { test } from '../../fixtures/baseFixtures';
+import LoginPage from '../../model/login.page';
+import appUrl from '../../utils/url';
+
+test.describe('Login page', () => {
+  test.use({
+    storageState: {
+      cookies: [],
+      origins: [],
+    },
+  });
+
+  test('should display the sign in button', async ({ page }) => {
+    await page.goto(appUrl());
+
+    const loginPage = new LoginPage(page);
+    await expect(loginPage.getSignInButton()).toBeVisible();
+  });
+});
diff --git a/openaev-front/vitest.config.ts b/openaev-front/vitest.config.ts
index ef04fa02610..d5f40650cf6 100644
--- a/openaev-front/vitest.config.ts
+++ b/openaev-front/vitest.config.ts
@@ -2,15 +2,25 @@
 // @ts-nocheck
 // ts nocheck because there is an "Excessive stack depth comparing types" it seems that there is a problem with the React plugin and the defineConfig type
 import react from '@vitejs/plugin-react';
-// import jsdom to not let tools report them as unused
-// eslint-disable-next-line @typescript-eslint/no-unused-vars
-import jsdom from 'jsdom';
 import { defineConfig } from 'vitest/config';
 
 export default defineConfig({
   plugins: [react()],
   test: {
-    environment: 'jsdom',
+    // happy-dom is fully ESM-native and Node 24 compatible, replacing jsdom
+    // which had a CJS/ESM conflict with its bundled parse5 dependency.
+    environment: 'happy-dom',
     include: ['src/__tests__/**/**/*.test.{ts,tsx}'],
+    coverage: {
+      provider: 'v8',
+      reporter: ['text', 'lcov', 'json-summary'],
+      reportsDirectory: './coverage',
+      include: ['src/**/*.{ts,tsx}'],
+      exclude: [
+        'src/__tests__/**',
+        'src/**/*.d.ts',
+        'src/index.tsx',
+      ],
+    },
   },
 });
diff --git a/openaev-front/yarn.lock b/openaev-front/yarn.lock
index d3a6aa54710..ceb326f120e 100644
--- a/openaev-front/yarn.lock
+++ b/openaev-front/yarn.lock
@@ -45,39 +45,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@asamuzakjp/css-color@npm:^5.0.1":
-  version: 5.0.1
-  resolution: "@asamuzakjp/css-color@npm:5.0.1"
-  dependencies:
-    "@csstools/css-calc": "npm:^3.1.1"
-    "@csstools/css-color-parser": "npm:^4.0.2"
-    "@csstools/css-parser-algorithms": "npm:^4.0.0"
-    "@csstools/css-tokenizer": "npm:^4.0.0"
-    lru-cache: "npm:^11.2.6"
-  checksum: 10c0/3e8d74a3b7f3005a325cb8e7f3da1aa32aeac4cd9ce387826dc25b16eaab4dc0e4a6faded8ccc1895959141f4a4a70e8bc38723347b89667b7b224990d16683c
-  languageName: node
-  linkType: hard
-
-"@asamuzakjp/dom-selector@npm:^7.0.3":
-  version: 7.0.4
-  resolution: "@asamuzakjp/dom-selector@npm:7.0.4"
-  dependencies:
-    "@asamuzakjp/nwsapi": "npm:^2.3.9"
-    bidi-js: "npm:^1.0.3"
-    css-tree: "npm:^3.2.1"
-    is-potential-custom-element-name: "npm:^1.0.1"
-    lru-cache: "npm:^11.2.7"
-  checksum: 10c0/6539422595ed445f182eda78554fd339ff06f6d5add0520ee7cc9715baeb361454c11ffe21a6e7461907182153f88852866c4ea12158b9c9202ccc44767bc749
-  languageName: node
-  linkType: hard
-
-"@asamuzakjp/nwsapi@npm:^2.3.9":
-  version: 2.3.9
-  resolution: "@asamuzakjp/nwsapi@npm:2.3.9"
-  checksum: 10c0/869b81382e775499c96c45c6dbe0d0766a6da04bcf0abb79f5333535c4e19946851acaa43398f896e2ecc5a1de9cf3db7cf8c4b1afac1ee3d15e21584546d74d
-  languageName: node
-  linkType: hard
-
 "@babel/code-frame@npm:^7.0.0, @babel/code-frame@npm:^7.10.4, @babel/code-frame@npm:^7.27.1":
   version: 7.27.1
   resolution: "@babel/code-frame@npm:7.27.1"
@@ -155,6 +122,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@babel/parser@npm:^7.29.0":
+  version: 7.29.2
+  resolution: "@babel/parser@npm:7.29.2"
+  dependencies:
+    "@babel/types": "npm:^7.29.0"
+  bin:
+    parser: ./bin/babel-parser.js
+  checksum: 10c0/e5a4e69e3ac7acdde995f37cf299a68458cfe7009dff66bd0962fd04920bef287201169006af365af479c08ff216bfefbb595e331f87f6ae7283858aebbc3317
+  languageName: node
+  linkType: hard
+
 "@babel/runtime@npm:^7.10.0, @babel/runtime@npm:^7.12.5, @babel/runtime@npm:^7.14.6, @babel/runtime@npm:^7.15.4, @babel/runtime@npm:^7.17.2, @babel/runtime@npm:^7.18.3, @babel/runtime@npm:^7.19.4, @babel/runtime@npm:^7.5.5, @babel/runtime@npm:^7.8.7":
   version: 7.26.10
   resolution: "@babel/runtime@npm:7.26.10"
@@ -231,6 +209,23 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@babel/types@npm:^7.29.0":
+  version: 7.29.0
+  resolution: "@babel/types@npm:7.29.0"
+  dependencies:
+    "@babel/helper-string-parser": "npm:^7.27.1"
+    "@babel/helper-validator-identifier": "npm:^7.28.5"
+  checksum: 10c0/23cc3466e83bcbfab8b9bd0edaafdb5d4efdb88b82b3be6728bbade5ba2f0996f84f63b1c5f7a8c0d67efded28300898a5f930b171bb40b311bca2029c4e9b4f
+  languageName: node
+  linkType: hard
+
+"@bcoe/v8-coverage@npm:^1.0.2":
+  version: 1.0.2
+  resolution: "@bcoe/v8-coverage@npm:1.0.2"
+  checksum: 10c0/1eb1dc93cc17fb7abdcef21a6e7b867d6aa99a7ec88ec8207402b23d9083ab22a8011213f04b2cf26d535f1d22dc26139b7929e6c2134c254bd1e14ba5e678c3
+  languageName: node
+  linkType: hard
+
 "@biomejs/js-api@npm:4.0.0":
   version: 4.0.0
   resolution: "@biomejs/js-api@npm:4.0.0"
@@ -256,17 +251,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@bramus/specificity@npm:^2.4.2":
-  version: 2.4.2
-  resolution: "@bramus/specificity@npm:2.4.2"
-  dependencies:
-    css-tree: "npm:^3.0.0"
-  bin:
-    specificity: bin/cli.js
-  checksum: 10c0/c5f4e04e0bca0d2202598207a5eb0733c8109d12a68a329caa26373bec598d99db5bb785b8865fefa00fc01b08c6068138807ceb11a948fe15e904ed6cf4ba72
-  languageName: node
-  linkType: hard
-
 "@casl/ability@npm:6.8.1":
   version: 6.8.1
   resolution: "@casl/ability@npm:6.8.1"
@@ -1180,64 +1164,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@csstools/color-helpers@npm:^6.0.2":
-  version: 6.0.2
-  resolution: "@csstools/color-helpers@npm:6.0.2"
-  checksum: 10c0/4c66574563d7c960010c11e41c2673675baff07c427cca6e8dddffa5777de45770d13ff3efce1c0642798089ad55de52870d9d8141f78db3fa5bba012f2d3789
-  languageName: node
-  linkType: hard
-
-"@csstools/css-calc@npm:^3.1.1":
-  version: 3.1.1
-  resolution: "@csstools/css-calc@npm:3.1.1"
-  peerDependencies:
-    "@csstools/css-parser-algorithms": ^4.0.0
-    "@csstools/css-tokenizer": ^4.0.0
-  checksum: 10c0/6efcc016d988edf66e54c7bad03e352d61752cbd1b56c7557fd013868aab23505052ded8f912cd4034e216943ea1e04c957d81012489e3eddc14a57b386510ef
-  languageName: node
-  linkType: hard
-
-"@csstools/css-color-parser@npm:^4.0.2":
-  version: 4.0.2
-  resolution: "@csstools/css-color-parser@npm:4.0.2"
-  dependencies:
-    "@csstools/color-helpers": "npm:^6.0.2"
-    "@csstools/css-calc": "npm:^3.1.1"
-  peerDependencies:
-    "@csstools/css-parser-algorithms": ^4.0.0
-    "@csstools/css-tokenizer": ^4.0.0
-  checksum: 10c0/487cf507ef4630f74bd67d84298294ed269900b206ade015a968d20047e07ff46f235b72e26fe0c6b949a03f8f9f00a22c363da49c1b06ca60b32d0188e546be
-  languageName: node
-  linkType: hard
-
-"@csstools/css-parser-algorithms@npm:^4.0.0":
-  version: 4.0.0
-  resolution: "@csstools/css-parser-algorithms@npm:4.0.0"
-  peerDependencies:
-    "@csstools/css-tokenizer": ^4.0.0
-  checksum: 10c0/94558c2428d6ef0ddef542e86e0a8376aa1263a12a59770abb13ba50d7b83086822c75433f32aa2e7fef00555e1cc88292f9ca5bce79aed232bb3fed73b1528d
-  languageName: node
-  linkType: hard
-
-"@csstools/css-syntax-patches-for-csstree@npm:^1.1.1":
-  version: 1.1.2
-  resolution: "@csstools/css-syntax-patches-for-csstree@npm:1.1.2"
-  peerDependencies:
-    css-tree: ^3.2.1
-  peerDependenciesMeta:
-    css-tree:
-      optional: true
-  checksum: 10c0/1c320718c2ad3002f9f13e8d6f149416168be346bd4910ff8eb5bf1bd57fa1a54e93dd1b00026269533a3117a18e742b9cf6d99e92527145a0d08d6f4075eb34
-  languageName: node
-  linkType: hard
-
-"@csstools/css-tokenizer@npm:^4.0.0":
-  version: 4.0.0
-  resolution: "@csstools/css-tokenizer@npm:4.0.0"
-  checksum: 10c0/669cf3d0f9c8e1ffdf8c9955ad8beba0c8cfe03197fe29a4fcbd9ee6f7a18856cfa42c62670021a75183d9ab37f5d14a866e6a9df753a6c07f59e36797a9ea9f
-  languageName: node
-  linkType: hard
-
 "@emnapi/core@npm:1.9.1":
   version: 1.9.1
   resolution: "@emnapi/core@npm:1.9.1"
@@ -1728,30 +1654,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@exodus/bytes@npm:^1.11.0, @exodus/bytes@npm:^1.15.0":
-  version: 1.15.0
-  resolution: "@exodus/bytes@npm:1.15.0"
-  peerDependencies:
-    "@noble/hashes": ^1.8.0 || ^2.0.0
-  peerDependenciesMeta:
-    "@noble/hashes":
-      optional: true
-  checksum: 10c0/b48aad9729653385d6ed055c28cfcf0b1b1481cf5d83f4375c12abd7988f1d20f69c80b5f95d4a1cc24d9abe32b9efc352a812d53884c26efea172aca8b6356d
-  languageName: node
-  linkType: hard
-
-"@exodus/bytes@npm:^1.6.0":
-  version: 1.14.1
-  resolution: "@exodus/bytes@npm:1.14.1"
-  peerDependencies:
-    "@noble/hashes": ^1.8.0 || ^2.0.0
-  peerDependenciesMeta:
-    "@noble/hashes":
-      optional: true
-  checksum: 10c0/486dad30992a8c81058b6b59341ee934c10a7e8016b440770de0f86d2e270950c5d37fc6724ea017295b8654c7564abf6a21cc49bed569d74721b545f571e416
-  languageName: node
-  linkType: hard
-
 "@exodus/schemasafe@npm:^1.0.0-rc.2":
   version: 1.3.0
   resolution: "@exodus/schemasafe@npm:1.3.0"
@@ -2043,6 +1945,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@jridgewell/trace-mapping@npm:^0.3.31":
+  version: 0.3.31
+  resolution: "@jridgewell/trace-mapping@npm:0.3.31"
+  dependencies:
+    "@jridgewell/resolve-uri": "npm:^3.1.0"
+    "@jridgewell/sourcemap-codec": "npm:^1.4.14"
+  checksum: 10c0/4b30ec8cd56c5fd9a661f088230af01e0c1a3888d11ffb6b47639700f71225be21d1f7e168048d6d4f9449207b978a235c07c8f15c07705685d16dc06280e9d9
+  languageName: node
+  linkType: hard
+
 "@js-sdsl/ordered-map@npm:^4.4.2":
   version: 4.4.2
   resolution: "@js-sdsl/ordered-map@npm:4.4.2"
@@ -3092,6 +3004,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@types/node@npm:^20.0.0":
+  version: 20.19.39
+  resolution: "@types/node@npm:20.19.39"
+  dependencies:
+    undici-types: "npm:~6.21.0"
+  checksum: 10c0/1d16da7b5f47a7415b827fcf3b94d279febf4c14671afec74a03e47856b5270023d9beb1b9aeab4d3b622fd97d61a60206cfc2cca588663181331bc592468289
+  languageName: node
+  linkType: hard
+
 "@types/parse-json@npm:^4.0.0":
   version: 4.0.2
   resolution: "@types/parse-json@npm:4.0.2"
@@ -3219,6 +3140,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@types/whatwg-mimetype@npm:^3.0.2":
+  version: 3.0.2
+  resolution: "@types/whatwg-mimetype@npm:3.0.2"
+  checksum: 10c0/dad39d1e4abe760a0a963c84bbdbd26b1df0eb68aff83bdf6ecbb50ad781ead777f6906d19a87007790b750f7500a12e5624d31fc6a1529d14bd19b5c3a316d1
+  languageName: node
+  linkType: hard
+
 "@typescript-eslint/eslint-plugin@npm:8.57.0":
   version: 8.57.0
   resolution: "@typescript-eslint/eslint-plugin@npm:8.57.0"
@@ -3679,6 +3607,30 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@vitest/coverage-v8@npm:4.1.2":
+  version: 4.1.2
+  resolution: "@vitest/coverage-v8@npm:4.1.2"
+  dependencies:
+    "@bcoe/v8-coverage": "npm:^1.0.2"
+    "@vitest/utils": "npm:4.1.2"
+    ast-v8-to-istanbul: "npm:^1.0.0"
+    istanbul-lib-coverage: "npm:^3.2.2"
+    istanbul-lib-report: "npm:^3.0.1"
+    istanbul-reports: "npm:^3.2.0"
+    magicast: "npm:^0.5.2"
+    obug: "npm:^2.1.1"
+    std-env: "npm:^4.0.0-rc.1"
+    tinyrainbow: "npm:^3.1.0"
+  peerDependencies:
+    "@vitest/browser": 4.1.2
+    vitest: 4.1.2
+  peerDependenciesMeta:
+    "@vitest/browser":
+      optional: true
+  checksum: 10c0/2f4488efb34a5d9e3a70631ba263e153eecba8ec0da52cb874cdc674c88369061706572b9fc0c302376fd1de58aedc86a2f9f75e5a521084e31a1446c85f2c40
+  languageName: node
+  linkType: hard
+
 "@vitest/eslint-plugin@npm:1.6.12":
   version: 1.6.12
   resolution: "@vitest/eslint-plugin@npm:1.6.12"
@@ -3740,6 +3692,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@vitest/pretty-format@npm:4.1.2":
+  version: 4.1.2
+  resolution: "@vitest/pretty-format@npm:4.1.2"
+  dependencies:
+    tinyrainbow: "npm:^3.1.0"
+  checksum: 10c0/6f57519c707e6a3d1ff8630ca87ce78fda9bf7bb33f6e4a0c775a8b510f2a6cee109849e2cdb736b0280681c567bd03e4cff724cbf0962950c9ff81377f0b2bc
+  languageName: node
+  linkType: hard
+
 "@vitest/runner@npm:4.1.0":
   version: 4.1.0
   resolution: "@vitest/runner@npm:4.1.0"
@@ -3780,6 +3741,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@vitest/utils@npm:4.1.2":
+  version: 4.1.2
+  resolution: "@vitest/utils@npm:4.1.2"
+  dependencies:
+    "@vitest/pretty-format": "npm:4.1.2"
+    convert-source-map: "npm:^2.0.0"
+    tinyrainbow: "npm:^3.1.0"
+  checksum: 10c0/d96475e0703b6e5208c6c0f570c1235278cbac3f3913a9aa4203a3e617c9eaca85a184bfd5d13cf366b84754df787ab8bc85242c5e0c63105ee7176c186a2136
+  languageName: node
+  linkType: hard
+
 "@xyflow/react@npm:12.10.2":
   version: 12.10.2
   resolution: "@xyflow/react@npm:12.10.2"
@@ -4139,6 +4111,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"ast-v8-to-istanbul@npm:^1.0.0":
+  version: 1.0.0
+  resolution: "ast-v8-to-istanbul@npm:1.0.0"
+  dependencies:
+    "@jridgewell/trace-mapping": "npm:^0.3.31"
+    estree-walker: "npm:^3.0.3"
+    js-tokens: "npm:^10.0.0"
+  checksum: 10c0/35e57b754ba63287358094d4f7ae8de2de27286fb4e76a1fbf28b2e67e3b670b59c3f511882473d0fd2cdbaa260062e3cd4f216b724c70032e2b09e5cebbd618
+  languageName: node
+  linkType: hard
+
 "async-function@npm:^1.0.0":
   version: 1.0.0
   resolution: "async-function@npm:1.0.0"
@@ -4244,15 +4227,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"bidi-js@npm:^1.0.3":
-  version: 1.0.3
-  resolution: "bidi-js@npm:1.0.3"
-  dependencies:
-    require-from-string: "npm:^2.0.2"
-  checksum: 10c0/fdddea4aa4120a34285486f2267526cd9298b6e8b773ad25e765d4f104b6d7437ab4ba542e6939e3ac834a7570bcf121ee2cf6d3ae7cd7082c4b5bedc8f271e1
-  languageName: node
-  linkType: hard
-
 "bignumber.js@npm:^9.0.0":
   version: 9.3.1
   resolution: "bignumber.js@npm:9.3.1"
@@ -4883,16 +4857,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"css-tree@npm:^3.0.0, css-tree@npm:^3.2.1":
-  version: 3.2.1
-  resolution: "css-tree@npm:3.2.1"
-  dependencies:
-    mdn-data: "npm:2.27.1"
-    source-map-js: "npm:^1.2.1"
-  checksum: 10c0/1f65e9ccaa56112a4706d6f003dd43d777f0dbcf848e66fd320f823192533581f8dd58daa906cb80622658332d50284d6be13b87a6ab4556cbbfe9ef535bbf7e
-  languageName: node
-  linkType: hard
-
 "csstype@npm:^3.0.2, csstype@npm:^3.1.3":
   version: 3.1.3
   resolution: "csstype@npm:3.1.3"
@@ -5003,16 +4967,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"data-urls@npm:^7.0.0":
-  version: 7.0.0
-  resolution: "data-urls@npm:7.0.0"
-  dependencies:
-    whatwg-mimetype: "npm:^5.0.0"
-    whatwg-url: "npm:^16.0.0"
-  checksum: 10c0/08d88ef50d8966a070ffdaa703e1e4b29f01bb2da364dfbc1612b1c2a4caa8045802c9532d81347b21781100132addb36a585071c8323b12cce97973961dee9f
-  languageName: node
-  linkType: hard
-
 "data-view-buffer@npm:^1.0.2":
   version: 1.0.2
   resolution: "data-view-buffer@npm:1.0.2"
@@ -5081,13 +5035,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"decimal.js@npm:^10.6.0":
-  version: 10.6.0
-  resolution: "decimal.js@npm:10.6.0"
-  checksum: 10c0/07d69fbcc54167a340d2d97de95f546f9ff1f69d2b45a02fd7a5292412df3cd9eb7e23065e532a318f5474a2e1bccf8392fdf0443ef467f97f3bf8cb0477e5aa
-  languageName: node
-  linkType: hard
-
 "decode-named-character-reference@npm:^1.0.0":
   version: 1.2.0
   resolution: "decode-named-character-reference@npm:1.2.0"
@@ -5424,13 +5371,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"entities@npm:^6.0.0":
-  version: 6.0.1
-  resolution: "entities@npm:6.0.1"
-  checksum: 10c0/ed836ddac5acb34341094eb495185d527bd70e8632b6c0d59548cbfa23defdbae70b96f9a405c82904efa421230b5b3fd2283752447d737beffd3f3e6ee74414
-  languageName: node
-  linkType: hard
-
 "entities@npm:^8.0.0":
   version: 8.0.0
   resolution: "entities@npm:8.0.0"
@@ -6747,6 +6687,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"happy-dom@npm:^18.0.1":
+  version: 18.0.1
+  resolution: "happy-dom@npm:18.0.1"
+  dependencies:
+    "@types/node": "npm:^20.0.0"
+    "@types/whatwg-mimetype": "npm:^3.0.2"
+    whatwg-mimetype: "npm:^3.0.0"
+  checksum: 10c0/10f2115f5001fdaf1aedcbda89c15248a1c2e43a25d7e774cb641a35bf6763cef9097b438ef3c2248ab59a0ef33b3e88cb94da096f2bb0fc109ba3f43f7c66d4
+  languageName: node
+  linkType: hard
+
 "has-bigints@npm:^1.0.2":
   version: 1.1.0
   resolution: "has-bigints@npm:1.1.0"
@@ -7158,15 +7109,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"html-encoding-sniffer@npm:^6.0.0":
-  version: 6.0.0
-  resolution: "html-encoding-sniffer@npm:6.0.0"
-  dependencies:
-    "@exodus/bytes": "npm:^1.6.0"
-  checksum: 10c0/66dc3f6f5539cc3beb814fcbfae7eacf4ec38cf824d6e1425b72039b51a40f4456bd8541ba66f4f4fe09cdf885ab5cd5bae6ec6339d6895a930b2fdb83c53025
-  languageName: node
-  linkType: hard
-
 "html-entities@npm:2.6.0":
   version: 2.6.0
   resolution: "html-entities@npm:2.6.0"
@@ -7738,13 +7680,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"is-potential-custom-element-name@npm:^1.0.1":
-  version: 1.0.1
-  resolution: "is-potential-custom-element-name@npm:1.0.1"
-  checksum: 10c0/b73e2f22bc863b0939941d369486d308b43d7aef1f9439705e3582bfccaa4516406865e32c968a35f97a99396dac84e2624e67b0a16b0a15086a785e16ce7db9
-  languageName: node
-  linkType: hard
-
 "is-promise@npm:^4.0.0":
   version: 4.0.0
   resolution: "is-promise@npm:4.0.0"
@@ -7944,6 +7879,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"js-tokens@npm:^10.0.0":
+  version: 10.0.0
+  resolution: "js-tokens@npm:10.0.0"
+  checksum: 10c0/a93498747812ba3e0c8626f95f75ab29319f2a13613a0de9e610700405760931624433a0de59eb7c27ff8836e526768fb20783861b86ef89be96676f2c996b64
+  languageName: node
+  linkType: hard
+
 "js-tokens@npm:^3.0.0 || ^4.0.0, js-tokens@npm:^4.0.0":
   version: 4.0.0
   resolution: "js-tokens@npm:4.0.0"
@@ -7962,40 +7904,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"jsdom@npm:29.0.1":
-  version: 29.0.1
-  resolution: "jsdom@npm:29.0.1"
-  dependencies:
-    "@asamuzakjp/css-color": "npm:^5.0.1"
-    "@asamuzakjp/dom-selector": "npm:^7.0.3"
-    "@bramus/specificity": "npm:^2.4.2"
-    "@csstools/css-syntax-patches-for-csstree": "npm:^1.1.1"
-    "@exodus/bytes": "npm:^1.15.0"
-    css-tree: "npm:^3.2.1"
-    data-urls: "npm:^7.0.0"
-    decimal.js: "npm:^10.6.0"
-    html-encoding-sniffer: "npm:^6.0.0"
-    is-potential-custom-element-name: "npm:^1.0.1"
-    lru-cache: "npm:^11.2.7"
-    parse5: "npm:^8.0.0"
-    saxes: "npm:^6.0.0"
-    symbol-tree: "npm:^3.2.4"
-    tough-cookie: "npm:^6.0.1"
-    undici: "npm:^7.24.5"
-    w3c-xmlserializer: "npm:^5.0.0"
-    webidl-conversions: "npm:^8.0.1"
-    whatwg-mimetype: "npm:^5.0.0"
-    whatwg-url: "npm:^16.0.1"
-    xml-name-validator: "npm:^5.0.0"
-  peerDependencies:
-    canvas: ^3.0.0
-  peerDependenciesMeta:
-    canvas:
-      optional: true
-  checksum: 10c0/f8eeadc9bb45fb5736501f855b5f8247c9eadcd7f52ef2e11677c3a2197284051b4623004889543eb9613ecdfb47ddb5405b822d9623b0524edd901288cc361d
-  languageName: node
-  linkType: hard
-
 "jsesc@npm:^3.0.2":
   version: 3.1.0
   resolution: "jsesc@npm:3.1.0"
@@ -8411,13 +8319,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lru-cache@npm:^11.2.6, lru-cache@npm:^11.2.7":
-  version: 11.2.7
-  resolution: "lru-cache@npm:11.2.7"
-  checksum: 10c0/549cdb59488baa617135fc12159cafb1a97f91079f35093bb3bcad72e849fc64ace636d244212c181dfdf1a99bbfa90757ff303f98561958ee4d0f885d9bd5f7
-  languageName: node
-  linkType: hard
-
 "lz-string@npm:^1.5.0":
   version: 1.5.0
   resolution: "lz-string@npm:1.5.0"
@@ -8450,6 +8351,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"magicast@npm:^0.5.2":
+  version: 0.5.2
+  resolution: "magicast@npm:0.5.2"
+  dependencies:
+    "@babel/parser": "npm:^7.29.0"
+    "@babel/types": "npm:^7.29.0"
+    source-map-js: "npm:^1.2.1"
+  checksum: 10c0/924af677643c5a0a7d6cdb3247c0eb96fa7611b2ba6a5e720d35d81c503d3d9f5948eb5227f80f90f82ea3e7d38cffd10bb988f3fc09020db428e14f26e960d7
+  languageName: node
+  linkType: hard
+
 "make-dir@npm:^4.0.0":
   version: 4.0.0
   resolution: "make-dir@npm:4.0.0"
@@ -8729,13 +8641,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"mdn-data@npm:2.27.1":
-  version: 2.27.1
-  resolution: "mdn-data@npm:2.27.1"
-  checksum: 10c0/eb8abf5d22e4d1e090346f5e81b67d23cef14c83940e445da5c44541ad874dc8fb9f6ca236e8258c3a489d9fb5884188a4d7d58773adb9089ac2c0b966796393
-  languageName: node
-  linkType: hard
-
 "media-typer@npm:^1.1.0":
   version: 1.1.0
   resolution: "media-typer@npm:1.1.0"
@@ -9730,6 +9635,7 @@ __metadata:
     "@typescript-eslint/utils": "npm:8.57.0"
     "@uiw/react-md-editor": "npm:4.1.0"
     "@vitejs/plugin-react": "npm:6.0.1"
+    "@vitest/coverage-v8": "npm:4.1.2"
     "@vitest/eslint-plugin": "npm:1.6.12"
     "@xyflow/react": "npm:12.10.2"
     apexcharts: "npm:5.3.6"
@@ -9758,13 +9664,13 @@ __metadata:
     final-form-arrays: "npm:4.0.0"
     fs-extra: "npm:11.3.4"
     globals: "npm:17.4.0"
+    happy-dom: "npm:^18.0.1"
     html-react-parser: "npm:6.0.1"
     html-to-image: "npm:1.11.13"
     http-proxy-middleware: "npm:3.0.5"
     i18n-auto-translation: "npm:2.2.3"
     immutable: "npm:5.1.5"
     js-file-download: "npm:0.4.12"
-    jsdom: "npm:29.0.1"
     mdi-material-ui: "npm:7.9.4"
     moment: "npm:2.30.1"
     moment-timezone: "npm:0.6.1"
@@ -9931,15 +9837,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"parse5@npm:^8.0.0":
-  version: 8.0.0
-  resolution: "parse5@npm:8.0.0"
-  dependencies:
-    entities: "npm:^6.0.0"
-  checksum: 10c0/8279892dcd77b2f2229707f60eb039e303adf0288812b2a8fd5acf506a4d432da833c6c5d07a6554bef722c2367a81ef4a1f7e9336564379a7dba3e798bf16b3
-  languageName: node
-  linkType: hard
-
 "parseurl@npm:^1.3.3":
   version: 1.3.3
   resolution: "parseurl@npm:1.3.3"
@@ -10112,13 +10009,13 @@ __metadata:
   linkType: hard
 
 "postcss@npm:^8.5.8":
-  version: 8.5.10
-  resolution: "postcss@npm:8.5.10"
+  version: 8.5.8
+  resolution: "postcss@npm:8.5.8"
   dependencies:
     nanoid: "npm:^3.3.11"
     picocolors: "npm:^1.1.1"
     source-map-js: "npm:^1.2.1"
-  checksum: 10c0/c592dffa0c4873b401f01955b265538d9942f425040df5e2b8f0ad34c83773a792ea0fa5859ccc99cfb5b955b4ebff118ab7056315388dc83b107b0fa8313576
+  checksum: 10c0/dd918f7127ee7c60a0295bae2e72b3787892296e1d1c3c564d7a2a00c68d8df83cadc3178491259daa19ccc54804fb71ed8c937c6787e08d8bd4bedf8d17044c
   languageName: node
   linkType: hard
 
@@ -10242,7 +10139,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"punycode@npm:^2.1.0, punycode@npm:^2.3.1":
+"punycode@npm:^2.1.0":
   version: 2.3.1
   resolution: "punycode@npm:2.3.1"
   checksum: 10c0/14f76a8206bc3464f794fb2e3d3cc665ae416c01893ad7a02b23766eb07159144ee612ad67af5e84fa4479ccfe67678c4feb126b0485651b302babf66f04f9e9
@@ -11224,15 +11121,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"saxes@npm:^6.0.0":
-  version: 6.0.0
-  resolution: "saxes@npm:6.0.0"
-  dependencies:
-    xmlchars: "npm:^2.2.0"
-  checksum: 10c0/3847b839f060ef3476eb8623d099aa502ad658f5c40fd60c105ebce86d244389b0d76fcae30f4d0c728d7705ceb2f7e9b34bb54717b6a7dbedaf5dad2d9a4b74
-  languageName: node
-  linkType: hard
-
 "scheduler@npm:^0.27.0":
   version: 0.27.0
   resolution: "scheduler@npm:0.27.0"
@@ -11886,13 +11774,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"symbol-tree@npm:^3.2.4":
-  version: 3.2.4
-  resolution: "symbol-tree@npm:3.2.4"
-  checksum: 10c0/dfbe201ae09ac6053d163578778c53aa860a784147ecf95705de0cd23f42c851e1be7889241495e95c37cabb058edb1052f141387bef68f705afc8f9dd358509
-  languageName: node
-  linkType: hard
-
 "tagged-tag@npm:^1.0.0":
   version: 1.0.0
   resolution: "tagged-tag@npm:1.0.0"
@@ -11984,31 +11865,13 @@ __metadata:
   languageName: node
   linkType: hard
 
-"tinyrainbow@npm:^3.0.3":
+"tinyrainbow@npm:^3.0.3, tinyrainbow@npm:^3.1.0":
   version: 3.1.0
   resolution: "tinyrainbow@npm:3.1.0"
   checksum: 10c0/f11cf387a26c5c9255bec141a90ac511b26172981b10c3e50053bc6700ea7d2336edcc4a3a21dbb8412fe7c013477d2ba4d7e4877800f3f8107be5105aad6511
   languageName: node
   linkType: hard
 
-"tldts-core@npm:^7.0.17":
-  version: 7.0.17
-  resolution: "tldts-core@npm:7.0.17"
-  checksum: 10c0/39dd6f5852f241c88391dc462dd236fa8241309a76dbf2486afdba0f172358260b16b98c126d1d06e1d9ee9015d83448ed7c4e2885e5e5c06c368f6503bb6a97
-  languageName: node
-  linkType: hard
-
-"tldts@npm:^7.0.5":
-  version: 7.0.17
-  resolution: "tldts@npm:7.0.17"
-  dependencies:
-    tldts-core: "npm:^7.0.17"
-  bin:
-    tldts: bin/cli.js
-  checksum: 10c0/0ef2a40058a11c27a5b310489009002e57cd0789c2cf383c04ecf808e1523d442d9d9688ac0337c64b261609478b7fd85ddcd692976c8f763747a5e1c7c1c451
-  languageName: node
-  linkType: hard
-
 "to-regex-range@npm:^5.0.1":
   version: 5.0.1
   resolution: "to-regex-range@npm:5.0.1"
@@ -12025,24 +11888,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"tough-cookie@npm:^6.0.1":
-  version: 6.0.1
-  resolution: "tough-cookie@npm:6.0.1"
-  dependencies:
-    tldts: "npm:^7.0.5"
-  checksum: 10c0/ec70bd6b1215efe4ed31a158f0be3e4c9088fcbd8620edc23a5860d4f3d85c757b77e274baaa700f7b25e409f4181552ed189603c2b2e1a9f88104da3a61a37d
-  languageName: node
-  linkType: hard
-
-"tr46@npm:^6.0.0":
-  version: 6.0.0
-  resolution: "tr46@npm:6.0.0"
-  dependencies:
-    punycode: "npm:^2.3.1"
-  checksum: 10c0/83130df2f649228aa91c17754b66248030a3af34911d713b5ea417066fa338aa4bc8668d06bd98aa21a2210f43fc0a3db8b9099e7747fb5830e40e39a6a1058e
-  languageName: node
-  linkType: hard
-
 "tr46@npm:~0.0.3":
   version: 0.0.3
   resolution: "tr46@npm:0.0.3"
@@ -12278,13 +12123,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"undici@npm:^7.24.5":
-  version: 7.24.6
-  resolution: "undici@npm:7.24.6"
-  checksum: 10c0/0f5413ccb20bafe27637a3a02cada731c53ee75f1df79029099db3af1eaaed410488489d9f430c09bd30bf0b925cb75fc30c39dff0689f656fd6fb7d75ded95f
-  languageName: node
-  linkType: hard
-
 "unicode-properties@npm:^1.4.0":
   version: 1.4.1
   resolution: "unicode-properties@npm:1.4.1"
@@ -12746,15 +12584,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"w3c-xmlserializer@npm:^5.0.0":
-  version: 5.0.0
-  resolution: "w3c-xmlserializer@npm:5.0.0"
-  dependencies:
-    xml-name-validator: "npm:^5.0.0"
-  checksum: 10c0/8712774c1aeb62dec22928bf1cdfd11426c2c9383a1a63f2bcae18db87ca574165a0fbe96b312b73652149167ac6c7f4cf5409f2eb101d9c805efe0e4bae798b
-  languageName: node
-  linkType: hard
-
 "web-namespaces@npm:^2.0.0":
   version: 2.0.1
   resolution: "web-namespaces@npm:2.0.1"
@@ -12776,28 +12605,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"webidl-conversions@npm:^8.0.1":
-  version: 8.0.1
-  resolution: "webidl-conversions@npm:8.0.1"
-  checksum: 10c0/3f6f327ca5fa0c065ed8ed0ef3b72f33623376e68f958e9b7bd0df49fdb0b908139ac2338d19fb45bd0e05595bda96cb6d1622222a8b413daa38a17aacc4dd46
-  languageName: node
-  linkType: hard
-
-"whatwg-mimetype@npm:^5.0.0":
-  version: 5.0.0
-  resolution: "whatwg-mimetype@npm:5.0.0"
-  checksum: 10c0/eead164fe73a00dd82f817af6fc0bd22e9c273e1d55bf4bc6bdf2da7ad8127fca82ef00ea6a37892f5f5641f8e34128e09508f92126086baba126b9e0d57feb4
-  languageName: node
-  linkType: hard
-
-"whatwg-url@npm:^16.0.0, whatwg-url@npm:^16.0.1":
-  version: 16.0.1
-  resolution: "whatwg-url@npm:16.0.1"
-  dependencies:
-    "@exodus/bytes": "npm:^1.11.0"
-    tr46: "npm:^6.0.0"
-    webidl-conversions: "npm:^8.0.1"
-  checksum: 10c0/e75565566abf3a2cdbd9f06c965dbcccee6ec4e9f0d3728ad5e08ceb9944279848bcaa211d35a29cb6d2df1e467dd05cfb59fbddf8a0adcd7d0bce9ffb703fd2
+"whatwg-mimetype@npm:^3.0.0":
+  version: 3.0.0
+  resolution: "whatwg-mimetype@npm:3.0.0"
+  checksum: 10c0/323895a1cda29a5fb0b9ca82831d2c316309fede0365047c4c323073e3239067a304a09a1f4b123b9532641ab604203f33a1403b5ca6a62ef405bcd7a204080f
   languageName: node
   linkType: hard
 
@@ -12953,20 +12764,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"xml-name-validator@npm:^5.0.0":
-  version: 5.0.0
-  resolution: "xml-name-validator@npm:5.0.0"
-  checksum: 10c0/3fcf44e7b73fb18be917fdd4ccffff3639373c7cb83f8fc35df6001fecba7942f1dbead29d91ebb8315e2f2ff786b508f0c9dc0215b6353f9983c6b7d62cb1f5
-  languageName: node
-  linkType: hard
-
-"xmlchars@npm:^2.2.0":
-  version: 2.2.0
-  resolution: "xmlchars@npm:2.2.0"
-  checksum: 10c0/b64b535861a6f310c5d9bfa10834cf49127c71922c297da9d4d1b45eeaae40bf9b4363275876088fbe2667e5db028d2cd4f8ee72eed9bede840a67d57dab7593
-  languageName: node
-  linkType: hard
-
 "xmldoc@npm:^2.0.3":
   version: 2.0.3
   resolution: "xmldoc@npm:2.0.3"
diff --git a/openaev-model/pom.xml b/openaev-model/pom.xml
index 761a92cbc7f..f9c0ef68809 100644
--- a/openaev-model/pom.xml
+++ b/openaev-model/pom.xml
@@ -6,7 +6,7 @@
     <parent>
         <groupId>io.openaev</groupId>
         <artifactId>openaev-platform</artifactId>
-        <version>2.3.3</version>
+        <version>2.3.4</version>
     </parent>
 
     <artifactId>openaev-model</artifactId>
@@ -114,12 +114,12 @@
         <dependency>
             <groupId>software.amazon.awssdk</groupId>
             <artifactId>apache-client</artifactId>
-            <version>2.42.37</version>
+            <version>2.42.41</version>
         </dependency>
         <dependency>
             <groupId>software.amazon.awssdk</groupId>
             <artifactId>regions</artifactId>
-            <version>2.42.37</version>
+            <version>2.42.41</version>
         </dependency>
         <dependency>
             <groupId>io.swagger.core.v3</groupId>
diff --git a/openaev-model/src/main/java/io/openaev/database/model/Inject.java b/openaev-model/src/main/java/io/openaev/database/model/Inject.java
index f40830d79b5..93a89f0ce74 100644
--- a/openaev-model/src/main/java/io/openaev/database/model/Inject.java
+++ b/openaev-model/src/main/java/io/openaev/database/model/Inject.java
@@ -388,7 +388,7 @@ public boolean isUserHasAccess(User user) {
 
   @JsonIgnore
   public void clean() {
-    this.status = null;
+    this.setStatus(null); // note this does not delete the status record in the db
     this.communications.clear();
     this.expectations.clear();
     this.findings.clear();
diff --git a/openaev-model/src/main/java/io/openaev/jsonapi/GenericJsonApiImporter.java b/openaev-model/src/main/java/io/openaev/jsonapi/GenericJsonApiImporter.java
index 0b94cba7fc5..de7814ae746 100644
--- a/openaev-model/src/main/java/io/openaev/jsonapi/GenericJsonApiImporter.java
+++ b/openaev-model/src/main/java/io/openaev/jsonapi/GenericJsonApiImporter.java
@@ -62,7 +62,13 @@ public T handleImportEntity(
 
     T entity =
         buildEntity(
-            doc.data(), includedMap, entityCache, entitiesNeedingRemapping, includeOptions, true);
+            doc.data(),
+            includedMap,
+            entityCache,
+            entitiesNeedingRemapping,
+            includeOptions,
+            true,
+            false);
     T toPersist = Optional.ofNullable(sanityCheck).map(check -> check.apply(entity)).orElse(entity);
 
     // Persist included entities that not inner relationship
@@ -142,13 +148,33 @@ private void addToRemapping(
     entitiesNeedingRemapping.add((CanRemapWeakRelationships) obj);
   }
 
+  /**
+   * Builds an entity from a JSON:API resource object, resolving its attributes and relationships.
+   *
+   * @param resource the JSON:API resource to convert into a JPA entity
+   * @param includedMap lookup of included resources by ID
+   * @param entityCache cache of already-built entities to avoid duplicates
+   * @param entitiesNeedingRemapping entities that need weak relationship ID remapping after persist
+   * @param includeOptions controls which relationships are included, excluded, or conditional
+   * @param rootEntity {@code true} if this is the top-level entity being imported (not a related
+   *     entity)
+   * @param ifExistsOnly when {@code true}, the entity is only resolved if it already exists in the
+   *     database (found by {@code @BusinessId}). If the entity is not found, an {@link
+   *     IllegalArgumentException} is thrown instead of creating a new instance. This is propagated
+   *     from {@link IncludeOptions.IncludeMode#IF_EXISTS_IN_DB} and allows skipping entire
+   *     relationship subtrees when a required dependency does not exist in the target database
+   *     (e.g. skip a DetectionRemediation if its Collector is not installed).
+   * @return the resolved or newly created entity, or {@code null} if the resource is null
+   * @throws IllegalArgumentException if {@code ifExistsOnly} is true and the entity is not found
+   */
   private T buildEntity(
       ResourceObject resource,
       Map<String, ResourceObject> includedMap,
       Map<String, Pair<T, Boolean>> entityCache,
       List<CanRemapWeakRelationships> entitiesNeedingRemapping,
       IncludeOptions includeOptions,
-      boolean rootEntity) {
+      boolean rootEntity,
+      boolean ifExistsOnly) {
     // Sanity check
     if (resource == null) {
       return null;
@@ -201,6 +227,15 @@ private T buildEntity(
         }
       }
     }
+
+    // In IF_EXISTS_IN_DB mode, reject non-root entities not found in the database
+    if (ifExistsOnly) {
+      throw new IllegalArgumentException(
+          "Entity of type '"
+              + clazz.getSimpleName()
+              + "' not found in database — skipped (IF_EXISTS_IN_DB mode)");
+    }
+
     // Create new instance if not found.
     if (entity == null) {
       entity = instantiate(clazz);
@@ -267,6 +302,8 @@ private void applyRelationships(
       }
 
       Relationship rel = e.getValue();
+      boolean ifExistsOnly = includeOptions.ifExistsInDb(e.getKey());
+
       if (isCollection(f)) {
         List<ResourceIdentifier> ids = rel.asMany();
 
@@ -275,7 +312,12 @@ private void applyRelationships(
           try {
             Object child =
                 resolveOrBuildEntity(
-                    ri, includedMap, entityCache, entitiesNeedingRemapping, includeOptions);
+                    ri,
+                    includedMap,
+                    entityCache,
+                    entitiesNeedingRemapping,
+                    includeOptions,
+                    ifExistsOnly);
             if (child != null) {
               target.add(child);
               setInverseRelation(child, entity);
@@ -299,7 +341,12 @@ private void applyRelationships(
         Object child =
             (ri != null)
                 ? resolveOrBuildEntity(
-                    ri, includedMap, entityCache, entitiesNeedingRemapping, includeOptions)
+                    ri,
+                    includedMap,
+                    entityCache,
+                    entitiesNeedingRemapping,
+                    includeOptions,
+                    ifExistsOnly)
                 : null;
         setField(entity, f, child);
         if (child != null) {
@@ -314,7 +361,8 @@ private T resolveOrBuildEntity(
       Map<String, ResourceObject> includedMap,
       Map<String, Pair<T, Boolean>> entityCache,
       List<CanRemapWeakRelationships> entitiesNeedingRemapping,
-      IncludeOptions includeOptions) {
+      IncludeOptions includeOptions,
+      boolean ifExistsOnly) {
     if (resourceIdentifier == null) {
       return null;
     }
@@ -326,7 +374,13 @@ private T resolveOrBuildEntity(
     ResourceObject included = includedMap.get(id);
     if (included != null) {
       return buildEntity(
-          included, includedMap, entityCache, entitiesNeedingRemapping, includeOptions, false);
+          included,
+          includedMap,
+          entityCache,
+          entitiesNeedingRemapping,
+          includeOptions,
+          false,
+          ifExistsOnly);
     }
 
     // Not present in the bundle
diff --git a/openaev-model/src/main/java/io/openaev/jsonapi/IncludeOptions.java b/openaev-model/src/main/java/io/openaev/jsonapi/IncludeOptions.java
index ac9a0bc15ce..0ef06317527 100644
--- a/openaev-model/src/main/java/io/openaev/jsonapi/IncludeOptions.java
+++ b/openaev-model/src/main/java/io/openaev/jsonapi/IncludeOptions.java
@@ -4,12 +4,35 @@
 import java.util.Map;
 
 /**
- * Options container to control which relationships are included during JSON:API export.
+ * Options container to control which relationships are included during JSON:API import/export.
  *
  * <p>By default, all relationships are included. However, fields annotated with {@link
  * IncludeOption} can be selectively included or excluded depending on the provided options map.
+ *
+ * <p>Three modes are supported per relationship:
+ *
+ * <ul>
+ *   <li>{@link IncludeMode#TRUE} — always include (default)
+ *   <li>{@link IncludeMode#FALSE} — always exclude
+ *   <li>{@link IncludeMode#IF_EXISTS_IN_DB} — include only if the referenced entity already exists
+ *       in the database (resolved via {@code @BusinessId}). If not found, the child entity is
+ *       skipped instead of being created.
+ * </ul>
  */
-public record IncludeOptions(Map<String, Boolean> includes) {
+public record IncludeOptions(Map<String, IncludeMode> modes) {
+
+  /** Controls how a relationship is handled during import/export. */
+  public enum IncludeMode {
+    /** Always include the relationship. */
+    TRUE,
+    /** Always exclude the relationship. */
+    FALSE,
+    /**
+     * Include only if the referenced entity already exists in the database. If not found, the
+     * entity is skipped rather than created.
+     */
+    IF_EXISTS_IN_DB
+  }
 
   public static boolean shouldInclude(Field f, IncludeOptions opts) {
     IncludeOption ann = f.getAnnotation(IncludeOption.class);
@@ -21,10 +44,18 @@ public static boolean shouldInclude(Field f, IncludeOptions opts) {
   }
 
   public boolean include(String relationName) {
-    return includes.getOrDefault(relationName, true);
+    return modes.getOrDefault(relationName, IncludeMode.TRUE) != IncludeMode.FALSE;
+  }
+
+  /**
+   * Returns {@code true} if the given relationship is configured with {@link
+   * IncludeMode#IF_EXISTS_IN_DB}.
+   */
+  public boolean ifExistsInDb(String relationName) {
+    return modes.getOrDefault(relationName, IncludeMode.TRUE) == IncludeMode.IF_EXISTS_IN_DB;
   }
 
-  public static IncludeOptions of(Map<String, Boolean> f) {
-    return new IncludeOptions(f == null ? Map.of() : f);
+  public static IncludeOptions of(Map<String, IncludeMode> modes) {
+    return new IncludeOptions(modes == null ? Map.of() : modes);
   }
 }
diff --git a/pom.xml b/pom.xml
index 318963b71b4..ec0b9d40918 100644
--- a/pom.xml
+++ b/pom.xml
@@ -11,7 +11,7 @@
 
     <groupId>io.openaev</groupId>
     <artifactId>openaev-platform</artifactId>
-    <version>2.3.3</version>
+    <version>2.3.4</version>
     <packaging>pom</packaging>
 
     <name>OpenAEV platform</name>
diff --git a/scripts/download-binaries.sh b/scripts/download-binaries.sh
new file mode 100644
index 00000000000..c8a81ba31d4
--- /dev/null
+++ b/scripts/download-binaries.sh
@@ -0,0 +1,109 @@
+#!/usr/bin/env bash
+# ---------------------------------------------------------------------------
+# Download openaev-agent and openaev-implant binaries from JFrog Artifactory.
+#
+# Usage:
+#   ./scripts/download-binaries.sh <BINARY_VERSION> <LOCAL_VERSION>
+#
+#   BINARY_VERSION  – the JFrog artifact suffix to fetch (e.g. "latest",
+#                     "prerelease", or a semver tag like "1.2.3").
+#   LOCAL_VERSION   – the version string used in the local file name
+#                     (e.g. the git tag). Defaults to BINARY_VERSION.
+# ---------------------------------------------------------------------------
+set -euo pipefail
+
+BINARY_VERSION="${1:?Usage: $0 <BINARY_VERSION> [LOCAL_VERSION]}"
+LOCAL_VERSION="${2:-$BINARY_VERSION}"
+
+JFROG_BASE="https://filigran.jfrog.io/artifactory"
+AGENT_REMOTE="openaev-agent"
+IMPLANT_REMOTE="openaev-implant"
+
+RESOURCES="openaev-api/src/main/resources"
+AGENT_LOCAL="${RESOURCES}/agents/openaev-agent"
+IMPLANT_LOCAL="${RESOURCES}/implants/openaev-implant"
+
+CURL_OPTS=(-L --fail --retry 3 --retry-delay 5 --silent --show-error)
+
+# ---------------------------------------------------------------------------
+# helper: download <remote_path> <local_path>
+# ---------------------------------------------------------------------------
+download() {
+  local remote="$1" local_path="$2"
+  mkdir -p "$(dirname "$local_path")"
+  echo "  ↓ ${local_path}"
+  curl "${CURL_OPTS[@]}" -o "$local_path" "$remote"
+}
+
+echo "══════════════════════════════════════════════════════════════"
+echo " Downloading binaries  (remote: ${BINARY_VERSION}, local: ${LOCAL_VERSION})"
+echo "══════════════════════════════════════════════════════════════"
+
+# ── openaev-agent ─────────────────────────────────────────────────
+echo ""
+echo "── openaev-agent ──"
+
+# Linux binaries
+download "${JFROG_BASE}/${AGENT_REMOTE}/linux/arm64/openaev-agent-${BINARY_VERSION}" \
+         "${AGENT_LOCAL}/linux/arm64/openaev-agent-${LOCAL_VERSION}"
+download "${JFROG_BASE}/${AGENT_REMOTE}/linux/x86_64/openaev-agent-${BINARY_VERSION}" \
+         "${AGENT_LOCAL}/linux/x86_64/openaev-agent-${LOCAL_VERSION}"
+
+# Linux shell scripts
+for script in installer installer-service-user installer-session-user \
+              upgrade upgrade-service-user upgrade-session-user; do
+  download "${JFROG_BASE}/${AGENT_REMOTE}/linux/openaev-agent-${script}-${BINARY_VERSION}.sh" \
+           "${AGENT_LOCAL}/linux/openaev-agent-${script}-${LOCAL_VERSION}.sh"
+done
+
+# macOS binaries
+download "${JFROG_BASE}/${AGENT_REMOTE}/macos/arm64/openaev-agent-${BINARY_VERSION}" \
+         "${AGENT_LOCAL}/macos/arm64/openaev-agent-${LOCAL_VERSION}"
+download "${JFROG_BASE}/${AGENT_REMOTE}/macos/x86_64/openaev-agent-${BINARY_VERSION}" \
+         "${AGENT_LOCAL}/macos/x86_64/openaev-agent-${LOCAL_VERSION}"
+
+# macOS shell scripts
+for script in installer installer-service-user installer-session-user \
+              upgrade upgrade-service-user upgrade-session-user; do
+  download "${JFROG_BASE}/${AGENT_REMOTE}/macos/openaev-agent-${script}-${BINARY_VERSION}.sh" \
+           "${AGENT_LOCAL}/macos/openaev-agent-${script}-${LOCAL_VERSION}.sh"
+done
+
+# Windows binaries (arm64)
+for suffix in "" "-installer" "-installer-service-user" "-installer-session-user"; do
+  download "${JFROG_BASE}/${AGENT_REMOTE}/windows/arm64/openaev-agent${suffix}-${BINARY_VERSION}.exe" \
+           "${AGENT_LOCAL}/windows/arm64/openaev-agent${suffix}-${LOCAL_VERSION}.exe"
+done
+
+# Windows binaries (x86_64)
+for suffix in "" "-installer" "-installer-service-user" "-installer-session-user"; do
+  download "${JFROG_BASE}/${AGENT_REMOTE}/windows/x86_64/openaev-agent${suffix}-${BINARY_VERSION}.exe" \
+           "${AGENT_LOCAL}/windows/x86_64/openaev-agent${suffix}-${LOCAL_VERSION}.exe"
+done
+
+# Windows PowerShell scripts
+for script in installer installer-service-user installer-session-user \
+              upgrade upgrade-service-user upgrade-session-user; do
+  download "${JFROG_BASE}/${AGENT_REMOTE}/windows/openaev-agent-${script}-${BINARY_VERSION}.ps1" \
+           "${AGENT_LOCAL}/windows/openaev-agent-${script}-${LOCAL_VERSION}.ps1"
+done
+
+# ── openaev-implant ───────────────────────────────────────────────
+echo ""
+echo "── openaev-implant ──"
+
+for os in linux macos; do
+  for arch in arm64 x86_64; do
+    download "${JFROG_BASE}/${IMPLANT_REMOTE}/${os}/${arch}/openaev-implant-${BINARY_VERSION}" \
+             "${IMPLANT_LOCAL}/${os}/${arch}/openaev-implant-${LOCAL_VERSION}"
+  done
+done
+
+for arch in arm64 x86_64; do
+  download "${JFROG_BASE}/${IMPLANT_REMOTE}/windows/${arch}/openaev-implant-${BINARY_VERSION}.exe" \
+           "${IMPLANT_LOCAL}/windows/${arch}/openaev-implant-${LOCAL_VERSION}.exe"
+done
+
+echo ""
+echo "✅ All binaries downloaded successfully."
+