The RC.5 step of #20 (architecture review QRun-IO/qqq#1150, finding F19, pinned baselines).
Moves the qqq-snapshot profile (qqq.snapshot.version) from 4.1.0-RC.2 to 4.1.0-RC.5, the released BOM.
No source compatibility fixes were needed. Comments in AuthentikGuard and the drift widget now say that core permission enforcement is opt-in in 4.1, so the qbit guard stays.
The test-only synthetic feature-permission catalog is tagged STAND-IN(core=QRun-IO/qqq#1136, removeBy=4.1.0-RC.6).
#20 stays open for the RC.6 bump. RC.6 also brings TableFeaturePermissionsMetaData, for the policy-editor catalog, and client channels; adopting them is a follow-up.
Tests
mvnw -B verify: 210 unit tests pass. Coverage is 91.57% instructions and 100% classes.
CI=true mvnw verify (Authentik 2026.8.3 contract ITs, run locally): 42 of 44 pass. The two failures are pre-existing and unrelated to this pom-only change:
QbitReadContractIT.groups expects authentik.* but sees authentik.*, cms.publish. The kof22-identity-bootstrap test blueprint now grants cms.publish.
BlueprintReapplyIT.apiEditsSurviveReapplyOfCreatedEntries timed out waiting for the blueprint re-apply (327 s), which looks like local container timing.
## Summary
The RC.5 step of #20 (architecture review QRun-IO/qqq#1150, finding F19, pinned baselines).
- Moves the `qqq-snapshot` profile (`qqq.snapshot.version`) from **4.1.0-RC.2 to 4.1.0-RC.5**, the released BOM.
- No source compatibility fixes were needed. Comments in `AuthentikGuard` and the drift widget now say that core permission enforcement is opt-in in 4.1, so the qbit guard stays.
- The test-only synthetic feature-permission catalog is tagged `STAND-IN(core=QRun-IO/qqq#1136, removeBy=4.1.0-RC.6)`.
- Docs: README, CHANGELOG, UPGRADE, POLICY-FORMAT, DESIGN.
#20 stays open for the RC.6 bump. RC.6 also brings `TableFeaturePermissionsMetaData`, for the policy-editor catalog, and client channels; adopting them is a follow-up.
## Tests
- `mvnw -B verify`: 210 unit tests pass. Coverage is 91.57% instructions and 100% classes.
- `CI=true mvnw verify` (Authentik 2026.8.3 contract ITs, run locally): 42 of 44 pass. The two failures are **pre-existing and unrelated to this pom-only change**:
- `QbitReadContractIT.groups` expects `authentik.*` but sees `authentik.*, cms.publish`. The `kof22-identity-bootstrap` test blueprint now grants `cms.publish`.
- `BlueprintReapplyIT.apiEditsSurviveReapplyOfCreatedEntries` timed out waiting for the blueprint re-apply (327 s), which looks like local container timing.
Worth a separate fix by the authentik owner.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
The RC.5 step of #20 (architecture review QRun-IO/qqq#1150, finding F19, pinned baselines).
qqq-snapshotprofile (qqq.snapshot.version) from 4.1.0-RC.2 to 4.1.0-RC.5, the released BOM.AuthentikGuardand the drift widget now say that core permission enforcement is opt-in in 4.1, so the qbit guard stays.STAND-IN(core=QRun-IO/qqq#1136, removeBy=4.1.0-RC.6).#20 stays open for the RC.6 bump. RC.6 also brings
TableFeaturePermissionsMetaData, for the policy-editor catalog, and client channels; adopting them is a follow-up.Tests
mvnw -B verify: 210 unit tests pass. Coverage is 91.57% instructions and 100% classes.CI=true mvnw verify(Authentik 2026.8.3 contract ITs, run locally): 42 of 44 pass. The two failures are pre-existing and unrelated to this pom-only change:QbitReadContractIT.groupsexpectsauthentik.*but seesauthentik.*, cms.publish. Thekof22-identity-bootstraptest blueprint now grantscms.publish.BlueprintReapplyIT.apiEditsSurviveReapplyOfCreatedEntriestimed out waiting for the blueprint re-apply (327 s), which looks like local container timing.Worth a separate fix by the authentik owner.
🤖 Generated with Claude Code