Part 1 of #15 (architecture review QRun-IO/qqq#1150, findings F3 and F11). Bumps the core baseline to QQQ 4.1.0-RC.5 and replaces the stand-ins that core now covers:
Core alerts SPI.
Deleted the alert-side copies in spi/: AlertSignal, AlertSeverity, AlertResolution, AlertSinkInterface, AlertsInstanceMetaData, QAlertTypeMetaData, AlertDefaultMonitor, AlertMonitorKind, AlertRecordRef, DetailLevel and ResolveMode.
Everything now imports com.kingsrook.qqq.backend.core.alerts.
The qbit registers QbitAlertsSink through core AlertsInstanceMetaData, so core QAlerts.raise/resolve/heartbeat calls from other qbits (backups, assistant) reach it.
Core webhook signer.
StandardWebhookSigner delegates to core WebhookSigner/WebhookSecret. The wire format is unchanged.
Core requires keys of at least 16 bytes. Shorter legacy keys are zero-padded, which yields an identical HMAC-SHA256 because HMAC zero-pads keys to its block size. New secrets should come from WebhookSecret.generate().
Still a stand-in, by design
NotificationSignal, NotificationAudience, NotificationCategory, NotificationSeverity and spi.AlertLink, plus AlertsRuntime.sink().notify(...), keep their exact JVM signatures.
Why: the released qbit-easypost-tracking 0.1.x calls them. Its migration to core QAlerts.notify is qbit-easypost-tracking#15.
Tag: each is marked STAND-IN(core=QRun-IO/qqq#1125, removeBy=4.1.0-RC.6).
Removal: a follow-up PR on RC.6 deletes them.
Tests
mvnw -B clean verify: 74 tests, 0 failures. Coverage is 92.13% instructions and 100% classes.
New end-to-end test: core QAlerts.raise reaches the qbit sink.
The spi notify path still delivers.
Signer interop with core WebhookVerifier (new StandardWebhookSignerTest).
Release
After merge, the release captain cuts an alerts RC on QQQ RC.5.
## Summary
Part 1 of #15 (architecture review QRun-IO/qqq#1150, findings F3 and F11). Bumps the core baseline to **QQQ 4.1.0-RC.5** and replaces the stand-ins that core now covers:
- **Core alerts SPI.**
- Deleted the alert-side copies in `spi/`: AlertSignal, AlertSeverity, AlertResolution, AlertSinkInterface, AlertsInstanceMetaData, QAlertTypeMetaData, AlertDefaultMonitor, AlertMonitorKind, AlertRecordRef, DetailLevel and ResolveMode.
- Everything now imports `com.kingsrook.qqq.backend.core.alerts`.
- The qbit registers `QbitAlertsSink` through core `AlertsInstanceMetaData`, so core `QAlerts.raise/resolve/heartbeat` calls from other qbits (backups, assistant) reach it.
- **Core webhook signer.**
- `StandardWebhookSigner` delegates to core `WebhookSigner`/`WebhookSecret`. The wire format is unchanged.
- Core requires keys of at least 16 bytes. Shorter legacy keys are zero-padded, which yields an identical HMAC-SHA256 because HMAC zero-pads keys to its block size. New secrets should come from `WebhookSecret.generate()`.
## Still a stand-in, by design
`NotificationSignal`, `NotificationAudience`, `NotificationCategory`, `NotificationSeverity` and `spi.AlertLink`, plus `AlertsRuntime.sink().notify(...)`, keep their exact JVM signatures.
- **Why:** the released qbit-easypost-tracking 0.1.x calls them. Its migration to core `QAlerts.notify` is qbit-easypost-tracking#15.
- **Tag:** each is marked `STAND-IN(core=QRun-IO/qqq#1125, removeBy=4.1.0-RC.6)`.
- **Removal:** a follow-up PR on RC.6 deletes them.
## Tests
`mvnw -B clean verify`: 74 tests, 0 failures. Coverage is 92.13% instructions and 100% classes.
- New end-to-end test: core `QAlerts.raise` reaches the qbit sink.
- The spi notify path still delivers.
- Signer interop with core `WebhookVerifier` (new `StandardWebhookSignerTest`).
## Release
After merge, the release captain cuts an alerts RC on QQQ RC.5.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
Part 1 of #15 (architecture review QRun-IO/qqq#1150, findings F3 and F11). Bumps the core baseline to QQQ 4.1.0-RC.5 and replaces the stand-ins that core now covers:
spi/: AlertSignal, AlertSeverity, AlertResolution, AlertSinkInterface, AlertsInstanceMetaData, QAlertTypeMetaData, AlertDefaultMonitor, AlertMonitorKind, AlertRecordRef, DetailLevel and ResolveMode.com.kingsrook.qqq.backend.core.alerts.QbitAlertsSinkthrough coreAlertsInstanceMetaData, so coreQAlerts.raise/resolve/heartbeatcalls from other qbits (backups, assistant) reach it.StandardWebhookSignerdelegates to coreWebhookSigner/WebhookSecret. The wire format is unchanged.WebhookSecret.generate().Still a stand-in, by design
NotificationSignal,NotificationAudience,NotificationCategory,NotificationSeverityandspi.AlertLink, plusAlertsRuntime.sink().notify(...), keep their exact JVM signatures.QAlerts.notifyis qbit-easypost-tracking#15.STAND-IN(core=QRun-IO/qqq#1125, removeBy=4.1.0-RC.6).Tests
mvnw -B clean verify: 74 tests, 0 failures. Coverage is 92.13% instructions and 100% classes.QAlerts.raisereaches the qbit sink.WebhookVerifier(newStandardWebhookSignerTest).Release
After merge, the release captain cuts an alerts RC on QQQ RC.5.
🤖 Generated with Claude Code