QRun-IO/.github#2 adds a tag-and-release job that signs vX with the
QRUN_TAG_SIGNING_KEY secret after Maven Central confirms the artifact.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Removes publish_hotfix_release: a hotfix/* branch push published a GA
release to Maven Central with no tag or review (QRun-IO/qbit-cdn#12,
QRun-IO/qqq#1121). hotfix/* branches now run test_only; a hotfix
release publishes from a reviewed vX.Y.Z tag through publish_release.
Adds .github/workflows/release-rc.yml (reusable QRun-IO/.github
qbit-release-rc): a manual dispatch, or merging a develop PR labelled
release:rc, merges develop into the release line and the release/* push
runs the existing CircleCI RC publish.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: phase 0 foundations (read-only client, contract tests on Authentik 2026.8.3)
- AuthentikQBitConfig (validated, secrets resolved by the qbit, never
serialized or printed) and AuthentikQBitProducer (API backend, read-only
authentikUser / authentikGroup tables, Identity app).
- AuthentikActionUtil on qqq-backend-module-api: bearer auth, page/page_size
paging with pagination.count, key lookups by GET, server-side user scope,
AuthentikFilterMapper (rejects whatever Authentik cannot evaluate),
10 rps token-bucket throttle, 429/5xx retries, error mapping, and logging
that never carries the token, query strings, successful GET bodies or
sensitive bodies (AuthentikRedactor).
- AuthentikGuard: identity.* read checks, sensitive fields behind
identity.audit.read, all writes refused in this release, protected-account
detection.
- Pinned Authentik 2026.8.3 schema, SchemaDriftTest / SchemaDriftIT over
the API surface used, and a weekly drift workflow against new releases.
- Testcontainers harness (Authentik server + worker, Postgres, Mailpit) with
the kof22-shaped blueprints, fixture recorder, and contract tests (b), (c),
(d), (h) plus the access-check, sign-in policy, webhook and token findings.
- Owner checklist, rehearsal script and blueprint lint for the cluster-gitops
migration (KofTwentyTwo/cluster-gitops#72).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: drop committed Python bytecode and ignore it
The lint script's __pycache__/*.pyc was committed by accident: it is
generated output and an unreviewable binary (K22-REPO-05).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
james.maesandCodex