[evaline-ju]

Summary

Redis is RSALv2/SSPLv1 (not OSI) since 7.4; swap the deploy tree to Valkey, the BSD-3 fork. The valkey image ships redis-server/redis-cli symlinks with the same uid/gid, so commands, probes, and securityContext are unchanged.

Migration

Existing deployments pick up the swap on their next apply; data written by Redis 7.x (or Valkey 8+) stays readable, but PVCs written by Redis 8 (RDB v12) need Valkey 8 or newer. The pin here is 9, so a plain apply is enough.

Checklist

• Commits are signed off (git commit -s).
• make lint and the tests for the touched packages pass.
• Docs: changed behavior, flags or environment variables are reflected in the relevant README or
  docs/ page, with the right maturity label (see docs/CONTRIBUTING-DOCS.md).
• Docs: make check-links passes if any Markdown changed.
• A new spec or ADR is registered in docs/specs/README.md or docs/adrs/README.md. - N/A

[ingpaolodettori-dev]

LGTM. The swap is consistent across VM, Compose, k8s base, and knative. The new k8s digest sha256:bf09d58e…ae0b resolves to the current valkey/valkey:9-alpine multi-arch index on Docker Hub, and k8s-kind-e2e passes with the unchanged uid 999/gid 1000 securityContext.

Non-blocking follow-ups (outside the diff hunks):

• suggestion: .github/workflows/ci.yml:18: the CI service is still image: redis:7, so the Redis integration tests run against Redis 7 while every deployment runs Valkey 9. Consider valkey/valkey:9.
• suggestion: deploy/vm/README.md ~L732-746: the dump.rdb warning and the by-hand recovery recipe still say "Redis 7" and use docker.io/redis:7-alpine. They should use docker.io/valkey/valkey:9-alpine to match setup-vm.sh. It's also worth noting that the swap is one-way: once Valkey 9 rewrites the AOF/RDB, rolling back to redis:7-alpine isn't guaranteed to load it.
• nit: deploy/vm/setup-vm.sh ~L243-245: the comment still says "pins a floating :7-alpine tag".
• nit: harness/src/leaf-result-store.ts:131: "every deployment pins redis:7" is now stale (GETDEL is still fine on Valkey).

[ingpaolodettori-dev]

suggestion: Add a case for what every existing VM host is actually running, so the real upgrade path is covered:

MOCK_REDIS_IMAGE=docker.io/library/redis:7-alpine|image is 'docker.io/library/redis:7-alpine'

This PR triggers that diff (replace on the same named volume), and the cases here only cover redis:6-alpine.

[ingpaolodettori-dev]

Follow-up at 34c4518: all five items from the 5e3b5db review are addressed. The CI service now runs valkey/valkey:9 (the redis-cli ping health check works through the compat symlink). There is a library/redis:7-alpine upgrade case in setup-vm.test.sh, the VM README recovery recipe uses valkey/valkey:9-alpine and has the one-way note, and the stale :7-alpine and redis:7 comments are fixed. No new issues.

• nit: packages/control-plane/test/refresh-redis.test.ts:14 and packages/control-plane/test/sandbox-redis.test.ts:8 still say "CI provides a redis:7 service". That service is now valkey/valkey:9.