ci: enroll shared Gitea lifecycle

ci: add the isolated postpublish job to the QRun release caller
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Co-Authored-By: Codex <noreply@openai.com>
2026-11-02 18:58:37 +00:00 · 2026-11-02 15:49:21 +00:00 · 2026-11-02 06:18:13 +00:00 · 2026-11-02 04:11:07 +00:00 · 2026-10-21 19:52:13 -05:00 · 2026-10-21 10:18:10 -05:00
35 changed files with 362 additions and 2001 deletions
@@ -1,65 +1,14 @@
 version: 2.1
-
+setup: true
 orbs:
-  qqq-orb: kingsrook/qqq-orb@0.6.8
-
-commands:
-  configure-package-install:
-    steps:
-      - run:
-          name: Keep package installation unattended
-          command: |
-            # These build machines are discarded after the job.
-            sudo install -d /etc/needrestart/conf.d
-            printf '%s\n' '$nrconf{restart} = "l";' | sudo tee /etc/needrestart/conf.d/99-qqq-ci.conf >/dev/null
-
+  qqq-orb: kingsrook/qqq-orb@0.8
 workflows:
-
-  test_only:
+  setup:
    jobs:
-      - qqq-orb/mvn_test_only:
-          pre-steps:
-            - configure-package-install
-          context: [ qqq-maven-registry-credentials ]
-          filters:
-            branches:
-              ignore: /(develop|release/.*|integration.*)/
-            tags:
-              only: []  
-
-  publish_snapshot:
-    jobs:
-      - qqq-orb/mvn_publish:
-          pre-steps:
-            - configure-package-install
-          context: [ qqq-maven-registry-credentials ]
-          branch_type: snapshot
-          filters:
-            branches:
-              only:
-                - develop
-
-  publish_release_candidate:
-    jobs:
-      - qqq-orb/mvn_publish:
-          pre-steps:
-            - configure-package-install
-          context: [ qqq-maven-registry-credentials ]
-          branch_type: release_candidate
-          filters:
-            branches:
-              only:
-                - /release\/.*/
-
-  publish_release:
-    jobs:
-      - qqq-orb/mvn_publish:
-          pre-steps:
-            - configure-package-install
-          context: [ qqq-maven-registry-credentials ]
-          branch_type: release
-          filters:
-            branches:
-              ignore: /.*/
-            tags:
-              only: [ /^v\d+\.\d+\.\d+$/ ]
+    - qqq-orb/generate_pipeline:
+        orb_version: '0.8'
+        filters:
+          branches:
+            ignore: automation/qbit-rc-pending
+          tags:
+            ignore: /.*/
@@ -1,20 +0,0 @@
-# QRun-IO qbit .editorconfig: the Kingsrook layout (3-space indentation, never tabs).
-root = true
-
-[*]
-charset = utf-8
-end_of_line = lf
-insert_final_newline = true
-trim_trailing_whitespace = true
-indent_style = space
-indent_size = 3
-tab_width = 3
-
-[*.md]
-trim_trailing_whitespace = false
-
-[*.{yml,yaml}]
-indent_size = 2
-
-[*.{cmd,bat}]
-end_of_line = crlf
@@ -1,3 +0,0 @@
-* text=auto eol=lf
-*.cmd text eol=crlf
-mvnw text eol=lf
@@ -0,0 +1,25 @@
+# Standard QRun release caller (v2, thin contract): every push and manual dispatch delegates to the protected qrun-release-v1 channel. Do not edit per repository.
+name: qrun-release
+on:
+  push: {}
+  workflow_dispatch: {}
+permissions:
+  contents: read
+  actions: read
+jobs:
+  release:
+    uses: self:KofTwentyTwo/platform-ci/.gitea/workflows/java-docker.yaml@qrun-release-v1
+    with:
+      runner: linux-small
+      docker-runner: container-build
+      browsers: true
+      browser-runner: browser-build
+  postpublish:
+    if: ${{ needs.release.outputs.capture == 'true' }}
+    needs: release
+    permissions:
+      contents: write
+      actions: write
+    uses: self:KofTwentyTwo/platform-ci/.gitea/workflows/qrun-source-version.yaml@qrun-release-v1
+    with:
+      runner: linux-small
@@ -1,25 +0,0 @@
-# Weekly, grouped dependency updates. Minor and patch updates arrive as one PR per ecosystem;
-# major updates stay separate so each gets its own review. At most three version-update PRs per
-# ecosystem are open at once. Security updates are enabled in the repository settings and are
-# not limited by this schedule.
-version: 2
-updates:
-  - package-ecosystem: maven
-    directory: /
-    target-branch: develop
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 3
-    groups:
-      maven-minor-and-patch:
-        update-types: [minor, patch]
-
-  - package-ecosystem: github-actions
-    directory: /
-    target-branch: develop
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 3
-    groups:
-      github-actions:
-        patterns: ['*']
@@ -1,31 +0,0 @@
-# GitHub Release Configuration
-# Auto-generates release notes from PR labels
-
-changelog:
-  exclude:
-    labels:
-      - ignore-for-release
-      - duplicate
-      - invalid
-    authors:
-      - dependabot
-      - dependabot[bot]
-  categories:
-    - title: Breaking Changes
-      labels:
-        - breaking-change
-        - breaking
-    - title: New Features
-      labels:
-        - enhancement
-        - feature
-    - title: Bug Fixes
-      labels:
-        - bug
-        - fix
-    - title: Dependencies
-      labels:
-        - dependencies
-    - title: Other Changes
-      labels:
-        - "*"
@@ -0,0 +1,23 @@
+name: CodeQL
+'on':
+  push:
+    branches:
+    - main
+    - develop
+    - release/**
+    - hotfix/**
+  pull_request: {}
+  schedule:
+  - cron: 41 16 * * 0
+  workflow_dispatch: {}
+permissions:
+  contents: read
+  actions: read
+  security-events: write
+  packages: read
+concurrency:
+  group: codeql-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+jobs:
+  analyze:
+    uses: QRun-IO/qqq-orb/.github/workflows/qbit-codeql.yml@c288a8864fe9054f68410e1d78f5863aea4c4d22
@@ -1,25 +0,0 @@
-# Cut the next release candidate (QRun-IO/qqq docs/QRUN-QBIT-REPO-STANDARD.md, C6):
-# run this workflow by hand, or merge a develop PR labelled `release:rc`. It merges develop into
-# the release line and the release/* push runs CircleCI publish_release_candidate.
-name: Release candidate
-
-on:
-  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: Print the plan without merging or creating branches
-        type: boolean
-        default: false
-  pull_request:
-    types: [closed]
-    branches: [develop]
-
-permissions:
-  contents: write
-
-jobs:
-  release-rc:
-    if: github.event_name == 'workflow_dispatch' || (github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'release:rc'))
-    uses: QRun-IO/.github/.github/workflows/qbit-release-rc.yml@main
-    with:
-      dry_run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }}
@@ -1,21 +1,20 @@
+# Maven
 target/
-.env
-.idea
-*.iml
-*.class
-*.log
 *.jar
 *.war
-*.nar
 *.ear
-*.zip
-*.tar.gz
-*.rar
-hs_err_pid*
+
+# IDE
+.idea/
+*.iml
+.vscode/
+.project
+.classpath
+.settings/
+
+# OS
 .DS_Store
-*.sw*
-.flattened-pom.xml
-dependency-reduced-pom.xml
-/.env.local
-/.cache/
-.claude/settings.local.json
+Thumbs.db
+
+# Logs
+*.log
@@ -1,3 +0,0 @@
-wrapperVersion=3.3.4
-distributionType=only-script
-distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.11/apache-maven-3.9.11-bin.zip
@@ -0,0 +1,15 @@
+profile: qbit
+orb_version: '0.8'
+default_branch: develop
+java_version: '21'
+browsers: true
+api_checks: false
+docs_only: false
+release_on_main: false
+release_tag_policy: none
+test_branch_policy: all
+publish:
+  snapshot: false
+  release_candidate: false
+  release: false
+  asciidoc: false
@@ -1,47 +0,0 @@
-# AGENTS.md
-
-This file provides guidance to coding agents working in this repository (same content as CLAUDE.md).
-
-## Project Overview
-
-**QBit Email**: one email service for a QQQ system (outbox, providers, templates with branding,
-delivery tracking, suppression, unsubscribe, PHI-safe sending; inbound in phase 2).
-Design: `docs/DESIGN.md`.
-
-## Build Commands
-
-```bash
-./mvnw compile          # always use the wrapper: Maven 3.10 cannot read the parent POM
-./mvnw test
-./mvnw verify           # tests + Checkstyle + JaCoCo gate (70% instructions, 90% classes)
-```
-
-## Architecture
-
- **Entry point:** `EmailQBitProducer implements QBitMetaDataProducer<EmailQBitConfig>`, package `com.kingsrook.qbits.email`.
- Packages are added per phase as `docs/DESIGN.md` describes.
-
-## Invariants
-
- Every send goes through the outbox (`email_message`); nothing sends inline.
- Provider credentials are environment-variable NAMES; values are never stored, logged or returned.
- PHI and PII never reach a body or a variable snapshot unless the template is `phiApproved`; snapshots follow the secured-data redaction and HMAC rules.
-
-## Naming (owner rule)
-
- Tables are lowercase snake_case, prefixed `email_`; the backend name is the table name; columns are snake_case.
- Permissions use the full qbit name: `email.view`, `email.send`, `email.manage`, `email.admin`.
- Data lives in standard visible tables. Processes are table or record actions, never in the nav. The nav lists only the main tables.
- UI endpoints are `/qqq/v1` spec extensions (`docs/UI-API-EXTENSIONS.md` in QRun-IO/qqq); provider webhooks are under `/qqq/hooks/email/...`.
-
-## Code Style
-
-3-space indent, braces on the next line, `return (x);`, flower-box Javadoc on every class and method, fluent `withX()` setters.
-
-## Release
-
- CircleCI qqq-orb 0.6.8.
- `develop` publishes SNAPSHOTs.
- `release/*` publishes RCs (automated by `.github/workflows/release-rc.yml`).
- `vX.Y.Z` tags publish releases (GA tags only).
- Never push `hotfix/*` or `release/*` branches by hand; use `feature/` or `fix/`.
@@ -1,9 +0,0 @@
-# Changelog
-
-All notable changes to QBit Email are documented in this file.
-The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project uses [Semantic Versioning](https://semver.org/).
-
-## [Unreleased]
-
-### Added
- Repository scaffold to the QRun qbit repository standard (Apache-2.0, CircleCI qqq-orb 0.6.8 with the `configure-package-install` pre-step, GA-only `publish_release`, the `release-rc` caller workflow).
@@ -1,47 +1,17 @@
-# CLAUDE.md
+# qbit-template-extension

-This file provides guidance to Claude Code when working with code in this repository.
+GitHub template repository for scaffolding QQQ "Extension QBits" (infrastructure-level plugins: table customizers, auth, audit, action wrappers). Not a shipping library — consumers click "Use this template" and rename the `com.kingsrook.qbits.example` package.

-## Project Overview
+## QQQ 4.0 baseline — 2026-09-24

-**QBit Email**: one email service for a QQQ system (outbox, providers, templates with branding,
-delivery tracking, suppression, unsubscribe, PHI-safe sending; inbound in phase 2).
-Design: `docs/DESIGN.md`.
+The historical review below predates the 4.0 migration. This template targets Java 21 and the public QQQ 4.0.0 release from Maven Central. The corrected APIs, license references and actual template commands are in README.md and docs/00-getting-started.md. Preserve the documented multi-instance and scaffold limitations.

-## Build Commands
+## Knowledge base

-```bash
-./mvnw compile          # always use the wrapper: Maven 3.10 cannot read the parent POM
-./mvnw test
-./mvnw verify           # tests + Checkstyle + JaCoCo gate (70% instructions, 90% classes)
-```
+Reviewed dossiers for this repo and the wider QQQ platform live in the second-brain vault:

-## Architecture
+- Hub / entry point: `R:/Git.Local/KofTwentyTwo/second-brain/knowledge/qqq/qqq-hub.md`
+- This repo's dossier: `R:/Git.Local/KofTwentyTwo/second-brain/knowledge/qqq/repos/qbit-template-extension.md`
+- QBit mechanics refresher: `R:/Git.Local/KofTwentyTwo/second-brain/knowledge/qqq/architecture/metadata-model.md`

- **Entry point:** `EmailQBitProducer implements QBitMetaDataProducer<EmailQBitConfig>`, package `com.kingsrook.qbits.email`.
- Packages are added per phase as `docs/DESIGN.md` describes.
-
-## Invariants
-
- Every send goes through the outbox (`email_message`); nothing sends inline.
- Provider credentials are environment-variable NAMES; values are never stored, logged or returned.
- PHI and PII never reach a body or a variable snapshot unless the template is `phiApproved`; snapshots follow the secured-data redaction and HMAC rules.
-
-## Naming (owner rule)
-
- Tables are lowercase snake_case, prefixed `email_`; the backend name is the table name; columns are snake_case.
- Permissions use the full qbit name: `email.view`, `email.send`, `email.manage`, `email.admin`.
- Data lives in standard visible tables. Processes are table or record actions, never in the nav. The nav lists only the main tables.
- UI endpoints are `/qqq/v1` spec extensions (`docs/UI-API-EXTENSIONS.md` in QRun-IO/qqq); provider webhooks are under `/qqq/hooks/email/...`.
-
-## Code Style
-
-3-space indent, braces on the next line, `return (x);`, flower-box Javadoc on every class and method, fluent `withX()` setters.
-
-## Release
-
- CircleCI qqq-orb 0.6.8.
- `develop` publishes SNAPSHOTs.
- `release/*` publishes RCs (automated by `.github/workflows/release-rc.yml`).
- `vX.Y.Z` tags publish releases (GA tags only).
- Never push `hotfix/*` or `release/*` branches by hand; use `feature/` or `fix/`.
+Reviewed at commit `e7d4b4d672cc` (branch `main`, 2026-05-21). Known drift as of that review: no `qbit-build-parent` parent pom (org convention), qqq pinned at 0.35.0 on main (0.40.0-SNAPSHOT on develop), README still claims AGPL-3.0 while LICENSE/NOTICE are Apache-2.0, and README references `scripts/customize_template.py` / `actions/ExampleActionCustomizer.java` which do not exist. See the dossier's "Maturity & risks" and "v4.0 impact" sections before modifying the scaffold.
@@ -1,3 +0,0 @@
-# Code of Conduct
-
-See Project level [Code of Conduct](https://github.com/QRun-IO/qqq/blob/develop/CODE_OF_CONDUCT.md)
@@ -1,3 +0,0 @@
-# Code Style Guide
-
-* See Project [Code Style Guide](https://github.com/QRun-IO/qqq/blob/develop/CODE_STYLE.md)
@@ -1,6 +0,0 @@
-# Contributing to QBit Webhooks
-
-* See Project [Contributing](https://github.com/QRun-IO/qqq/blob/develop/CONTRIBUTING.md)
-* Branches follow GitFlow: `feature/*` from `develop`, pull requests to `develop`, `release/*` for release candidates, `vX.Y.Z` tags for releases.
-* Commits are signed and follow Conventional Commits.
-* Build and test locally with `./mvnw verify` (Java 21).
@@ -176,7 +176,7 @@

   END OF TERMS AND CONDITIONS

-   Copyright 2024 Kingsrook, LLC
+   Copyright 2022-2025 QRunIO, LLC

   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
@@ -1,6 +1,6 @@
-QBit Email
-Copyright 2026 Kingsrook, LLC
+qBit Template - Extension
+Copyright 2022-2025 QRunIO, LLC

-This product includes software developed at Kingsrook, LLC (https://kingsrook.com/).
+This product includes software developed at QRunIO, LLC (https://qrun.io/).

 Licensed under the Apache License, Version 2.0.
@@ -1,52 +1,42 @@
-# QBit Email
+# QBit Template: Extension

-One email service for a QQQ system: an outbox with async sending, retries, dead letters and
-idempotency keys; providers as data rows (SMTP relay, Amazon SES, Postmark, SendGrid, Mailgun,
-Gmail); Markdown and MJML/HTML templates with versions and branding; delivery tracking from
-provider webhooks; a suppression list; RFC 8058 one-click unsubscribe; and PHI-safe sending.
-Inbound mail is phase 2.
+Template repository for creating QQQ Extension QBits - infrastructure extensions, customizers, and action handlers.

-Design: [`docs/DESIGN.md`](docs/DESIGN.md).
+## What is an Extension QBit?

-## Requirements
+Extension QBits extend or enhance how QQQ operates at the infrastructure/framework level. They provide:
+- New backend implementations
+- Authentication mechanisms
+- Audit capabilities
+- Table customizers
+- Action handlers

- Java 21
- QQQ 4.1 (`qqq-bom-pom` 4.1.0-RC.4 or later)
- An RDBMS backend for the `email_` tables
+## Quick Start

-## Install
+Requires **Java 21**, **Maven 3.8+**, and QQQ **4.0.0**. Create your repository, customize its Maven coordinates and Java package/classes, implement the table customizer, then run `mvn clean verify`. See [Getting Started](docs/00-getting-started.md).

-```xml
-<dependency>
-   <groupId>com.kingsrook.qbits</groupId>
-   <artifactId>qbit-email</artifactId>
-   <version>${qbit-email.version}</version>
-</dependency>
+## Structure
+
+```
+src/main/java/com/kingsrook/qbits/example/
+├── ExampleExtensionQBitConfig.java    # Configuration
+├── ExampleExtensionQBitProducer.java  # Entry point
+└── customizers/
+    └── ExampleTableCustomizer.java    # Table customization
 ```

-```java
-new EmailQBitProducer()
-   .withQBitConfig(new EmailQBitConfig().withBackendName("rdbms"))
-   .produce(qInstance);
-```
+## Key Characteristics

-## Tables, permissions and configuration
+- **No QAppSection** - Pure infrastructure
+- **No user-facing tables** (or minimal operational)
+- **Wraps existing tables/processes** with new behavior
+- **Validates dependencies** on other QQQ components

-See [`docs/DESIGN.md`](docs/DESIGN.md). Tables are prefixed `email_`; permissions use the full
-qbit name (`email.view`, `email.send`, `email.manage`, `email.admin`).
+## Documentation

-## Adopting in another app
-
-Add the dependency, produce the qbit against your RDBMS backend, add a provider row, and send
-through `EmailService` (or the `email_send_templated` process). Code that already calls core's
-`SendEmailAction` can route through the outbox with the messaging bridge (DESIGN section 2).
-
-## Build
-
-```bash
-./mvnw verify    # tests, Checkstyle and the JaCoCo gate
-```
+- [Getting Started](docs/00-getting-started.md)
+- [Extension Patterns](docs/01-extension-patterns.md)

 ## License

-Apache License 2.0. See [LICENSE](LICENSE) and [NOTICE](NOTICE).
+See [LICENSE](LICENSE) and [NOTICE](NOTICE).
@@ -1,4 +0,0 @@
-# Security Policy
-
-* See Project [Security Policy](https://github.com/QRun-IO/qqq/blob/develop/SECURITY.md)
-* Report suspected vulnerabilities privately through GitHub private vulnerability reporting on this repository, never in a public issue.
@@ -1,246 +0,0 @@
-<?xml version="1.0"?>
-<!--
-  ~ QQQ - Low-code Application Framework for Engineers.
-  ~ Copyright (C) 2021-2022.  Kingsrook, LLC
-  ~ 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
-  ~ contact@kingsrook.com
-  ~ https://github.com/Kingsrook/
-  ~
-  ~ Licensed under the Apache License, Version 2.0 (the "License");
-  ~ you may not use this file except in compliance with the License.
-  ~ You may obtain a copy of the License at
-  ~
-  ~     https://www.apache.org/licenses/LICENSE-2.0
-  ~
-  ~ Unless required by applicable law or agreed to in writing, software
-  ~ distributed under the License is distributed on an "AS IS" BASIS,
-  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  ~ See the License for the specific language governing permissions and
-  ~ limitations under the License.
-  -->
-
-<!DOCTYPE module PUBLIC
-        "-//Puppy Crawl//DTD Check Configuration 1.3//EN"
-        "http://checkstyle.sourceforge.net/dtds/configuration_1_3.dtd">
-<!--
-   See reference at https://checkstyle.sourceforge.io/checks.html
-->
-<module name = "Checker">
-   <property name="charset" value="UTF-8"/>
-
-   <property name="severity" value="warning"/>
-
-   <property name="fileExtensions" value="java, properties, xml"/>
-   <!-- Checks for whitespace                        -->
-   <!-- See http://checkstyle.sf.net/config_whitespace.html -->
-   <module name="FileTabCharacter">
-      <property name="eachLine" value="true"/>
-   </module>
-
-   <!--
-   <module name="LineLength">
-      <property name="max" value="100"/>
-      <property name="ignorePattern" value="^package.*|^import.*|a href|href|http://|https://|ftp://"/>
-   </module>
-   -->
-
-   <module name="TreeWalker">
-      <module name="SuppressWarningsHolder"/>
-      <module name="OuterTypeFilename"/>
-      <module name="IllegalTokenText">
-         <property name="tokens" value="STRING_LITERAL, CHAR_LITERAL"/>
-         <property name="format" value="\\u00(09|0(a|A)|0(c|C)|0(d|D)|22|27|5(C|c))|\\(0(10|11|12|14|15|42|47)|134)"/>
-         <property name="message" value="Consider using special escape sequence instead of octal value or Unicode escaped value."/>
-      </module>
-      <module name="AvoidEscapedUnicodeCharacters">
-         <property name="allowEscapesForControlCharacters" value="true"/>
-         <property name="allowByTailComment" value="true"/>
-         <property name="allowNonPrintableEscapes" value="true"/>
-      </module>
-      <module name="AvoidStarImport"/>
-      <module name="OneTopLevelClass"/>
-      <module name="NoLineWrap"/>
-      <module name="EmptyBlock">
-         <property name="option" value="TEXT"/>
-         <property name="tokens" value="LITERAL_TRY, LITERAL_FINALLY, LITERAL_IF, LITERAL_ELSE, LITERAL_SWITCH"/>
-      </module>
-      <module name="NeedBraces"/>
-      <module name="LeftCurly">
-         <property name="option" value="nl"/>
-      </module>
-      <module name="RightCurly">
-         <property name="option" value="alone"/>
-      </module>
-      <!--
-      <module name="WhitespaceAround">
-         <property name="allowEmptyConstructors" value="true"/>
-         <property name="allowEmptyMethods" value="true"/>
-         <property name="allowEmptyTypes" value="true"/>
-         <property name="allowEmptyLoops" value="true"/>
-         <message key="ws.notFollowed"
-          value="WhitespaceAround: ''{0}'' is not followed by whitespace. Empty blocks may only be represented as '{}' when not part of a multi-block statement (4.1.3)"/>
-          <message key="ws.notPreceded"
-          value="WhitespaceAround: ''{0}'' is not preceded with whitespace."/>
-      </module>
-      -->
-      <module name="OneStatementPerLine"/>
-      <module name="MultipleVariableDeclarations"/>
-      <module name="ArrayTypeStyle"/>
-      <module name="MissingSwitchDefault"/>
-      <module name="FallThrough"/>
-      <module name="UpperEll"/>
-      <module name="ModifierOrder"/>
-      <module name="EmptyLineSeparator">
-         <property name="allowNoEmptyLineBetweenFields" value="true"/>
-      </module>
-      <module name="SeparatorWrap">
-         <property name="id" value="SeparatorWrapDot"/>
-         <property name="tokens" value="DOT"/>
-         <property name="option" value="nl"/>
-      </module>
-      <module name="SeparatorWrap">
-         <property name="id" value="SeparatorWrapComma"/>
-         <property name="tokens" value="COMMA"/>
-         <property name="option" value="EOL"/>
-      </module>
-      <module name="SeparatorWrap">
-         <!-- ELLIPSIS is EOL until https://github.com/google/styleguide/issues/258 -->
-         <property name="id" value="SeparatorWrapEllipsis"/>
-         <property name="tokens" value="ELLIPSIS"/>
-         <property name="option" value="EOL"/>
-      </module>
-      <module name="SeparatorWrap">
-         <!-- ARRAY_DECLARATOR is EOL until https://github.com/google/styleguide/issues/259 -->
-         <property name="id" value="SeparatorWrapArrayDeclarator"/>
-         <property name="tokens" value="ARRAY_DECLARATOR"/>
-         <property name="option" value="EOL"/>
-      </module>
-      <module name="SeparatorWrap">
-         <property name="id" value="SeparatorWrapMethodRef"/>
-         <property name="tokens" value="METHOD_REF"/>
-         <property name="option" value="nl"/>
-      </module>
-      <module name="PackageName">
-         <property name="format" value="^[a-z]+(\.[a-z][a-z0-9]*)*$"/>
-         <message key="name.invalidPattern"
-          value="Package name ''{0}'' must match pattern ''{1}''."/>
-      </module>
-      <module name="TypeName">
-         <message key="name.invalidPattern"
-          value="Type name ''{0}'' must match pattern ''{1}''."/>
-      </module>
-      <module name="MemberName">
-         <property name="format" value="^[_a-zA-Z]([a-z0-9A-Z][a-zA-Z0-9]*)?$"/>
-         <message key="name.invalidPattern" value="Member name ''{0}'' must match pattern ''{1}''."/>
-      </module>
-      <module name="ParameterName">
-         <property name="format" value="^[a-zA-Z]([a-z0-9A-Z][a-zA-Z0-9]*)?$"/>
-         <message key="name.invalidPattern" value="Parameter name ''{0}'' must match pattern ''{1}''."/>
-      </module>
-      <module name="CatchParameterName">
-         <property name="format" value="^[a-zA-Z]([a-z0-9A-Z][a-zA-Z0-9]*)?$"/>
-         <message key="name.invalidPattern" value="Catch parameter name ''{0}'' must match pattern ''{1}''."/>
-      </module>
-      <module name="LocalVariableName">
-         <property name="tokens" value="VARIABLE_DEF"/>
-         <property name="format" value="^[a-zA-Z]([a-z0-9A-Z][a-zA-Z0-9]*)?$"/>
-         <message key="name.invalidPattern" value="Local variable name ''{0}'' must match pattern ''{1}''."/>
-      </module>
-      <module name="ClassTypeParameterName">
-         <property name="format" value="(^[A-Z][0-9]?)$|([A-Z][_A-Z0-9]*$)"/>
-         <message key="name.invalidPattern" value="Class type name ''{0}'' must match pattern ''{1}''."/>
-      </module>
-      <module name="MethodTypeParameterName">
-         <property name="format" value="(^[A-Z][0-9]?)$|([A-Z][_A-Z0-9]*$)"/>
-         <message key="name.invalidPattern" value="Method type name ''{0}'' must match pattern ''{1}''."/>
-      </module>
-      <module name="InterfaceTypeParameterName">
-         <property name="format" value="(^[A-Z][0-9]?)$|([A-Z][_A-Z0-9]*$)"/>
-         <message key="name.invalidPattern" value="Interface type name ''{0}'' must match pattern ''{1}''."/>
-      </module>
-      <module name="NoFinalizer"/>
-      <module name="GenericWhitespace">
-         <message key="ws.followed" value="GenericWhitespace ''{0}'' is followed by whitespace."/>
-         <message key="ws.preceded" value="GenericWhitespace ''{0}'' is preceded with whitespace."/>
-         <message key="ws.illegalFollow" value="GenericWhitespace ''{0}'' should followed by whitespace."/>
-         <message key="ws.notPreceded" value="GenericWhitespace ''{0}'' is not preceded with whitespace."/>
-      </module>
-      <module name="Indentation">
-         <property name="basicOffset" value="3"/>
-         <property name="braceAdjustment" value="0"/>
-         <property name="caseIndent" value="3"/>
-         <property name="throwsIndent" value="6"/>
-         <property name="lineWrappingIndentation" value="3"/>
-         <property name="arrayInitIndent" value="6"/>
-      </module>
-      <!--
-      <module name="AbbreviationAsWordInName">
-         <property name="ignoreFinal" value="false"/>
-         <property name="allowedAbbreviationLength" value="1"/>
-      </module>
-      <module name="OverloadMethodsDeclarationOrder"/>
-      <module name="VariableDeclarationUsageDistance"/>
-      <module name="CustomImportOrder">
-         <property name="sortImportsInGroupAlphabetically" value="true"/>
-         <property name="separateLineBetweenGroups" value="true"/>
-         <property name="customImportOrderRules" value="STATIC###THIRD_PARTY_PACKAGE"/>
-      </module>
-      -->
-      <module name="CustomImportOrder">
-         <property name="customImportOrderRules" value="SPECIAL_IMPORTS###STANDARD_JAVA_PACKAGE###THIRD_PARTY_PACKAGE###STATIC"/>
-         <property name="specialImportsRegExp" value="^javax\."/>
-         <property name="standardPackageRegExp" value="^java\."/>
-         <property name="sortImportsInGroupAlphabetically" value="true"/>
-         <property name="separateLineBetweenGroups" value="false"/>
-      </module>
-      <module name="MethodParamPad"/>
-      <module name="NoWhitespaceBefore">
-         <property name="tokens" value="COMMA, SEMI, POST_INC, POST_DEC, DOT, ELLIPSIS, METHOD_REF"/>
-         <property name="allowLineBreaks" value="true"/>
-      </module>
-      <module name="ParenPad"/>
-      <module name="OperatorWrap">
-         <property name="option" value="NL"/>
-         <property name="tokens" value="BAND, BOR, BSR, BXOR, DIV, EQUAL, GE, GT, LAND, LE, LITERAL_INSTANCEOF, LOR, LT, MINUS, MOD, NOT_EQUAL, PLUS, QUESTION, SL, SR, STAR, METHOD_REF "/>
-      </module>
-      <module name="AnnotationLocation">
-         <property name="id" value="AnnotationLocationMostCases"/>
-         <property name="tokens" value="CLASS_DEF, INTERFACE_DEF, ENUM_DEF, METHOD_DEF, CTOR_DEF"/>
-      </module>
-      <module name="AnnotationLocation">
-         <property name="id" value="AnnotationLocationVariables"/>
-         <property name="tokens" value="VARIABLE_DEF"/>
-         <property name="allowSamelineMultipleAnnotations" value="true"/>
-      </module>
-      <module name="JavadocMethod">
-         <property name="allowMissingParamTags" value="true"/>
-         <property name="allowMissingReturnTag" value="true"/>
-         <property name="allowedAnnotations" value="Override, Test"/>
-      </module>
-      <module name="MissingJavadocMethod">
-         <property name="scope" value="private"/>
-      </module>
-      <module name="MissingJavadocType">
-         <property name="scope" value="private"/>
-      </module>
-      <module name="MethodName">
-         <property name="format" value="^[a-z][a-zA-Z0-9_]*$"/>
-         <message key="name.invalidPattern"
-          value="Method name ''{0}'' must match pattern ''{1}''."/>
-      </module>
-      <module name="EmptyCatchBlock">
-         <property name="exceptionVariableName" value="expected"/>
-      </module>
-      <module name="CommentsIndentation"/>
-
-      <!-- this would be nice, but requires the the @inheritDoc javadoc tag... -->
-      <module name="MissingOverride"/>
-
-   </module>
-   <module name="Header">
-     <property name="headerFile" value="checkstyle/license.txt"/>
-     <property name="fileExtensions" value="java"/>
-     <property name="ignoreLines" value="3"/>
-   </module>
-   <module name="SuppressWarningsFilter"/>
-</module>
@@ -1,19 +0,0 @@
-/*
- * QQQ - Low-code Application Framework for Engineers.
- * Copyright (C) 2021-2025.  Kingsrook, LLC
- * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
- * contact@kingsrook.com
- * https://github.com/Kingsrook/
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
@@ -0,0 +1,28 @@
+# Getting Started
+
+Targets Java 21, Maven 3.8 or later, and QQQ 4.0.0. Maven resolves the framework dependencies from Maven Central.
+
+1. Choose **Use this template** on GitHub, then clone the repository you created.
+2. In `pom.xml`, set your own `groupId`, `artifactId`, name, description, and version.
+3. Use your IDE's package refactoring to rename `com.kingsrook.qbits.example` throughout `src/`. Rename the `Example*` classes and update their imports and references with the IDE's rename refactoring.
+4. Update the QBit producer's `GROUP_ID`, `ARTIFACT_ID`, and `VERSION` constants to match your project. Give the metadata names their own stable names before combining the QBit with other examples.
+5. Build the generated project:
+
+```bash
+mvn clean verify
+```
+
+The repository provides example Java sources; customization uses normal package/class refactoring. Keep example coordinates unpublished. After customizing, add tests for your QBit's behavior before setting up its publishing workflow.
+
+## Register with a host application
+
+The following uses the original example names; substitute the names chosen above:
+
+```java
+new ExampleExtensionQBitProducer()
+   .withConfig(new ExampleExtensionQBitConfig()
+      .withTargetTableName("order"))
+   .produce(qInstance, "my-extension");
+```
+
+Register the target table before producing the extension, then implement its customizer. See [Extension Patterns](01-extension-patterns.md).
@@ -0,0 +1,16 @@
+# Extension Patterns
+
+[ExampleExtensionQBitProducer](../src/main/java/com/kingsrook/qbits/example/ExampleExtensionQBitProducer.java) registers the QBit identity and calls `applyTableCustomizations` for the configured target. That method is the extension point: look up the table, validate that it exists, and call your customized [ExampleTableCustomizer](../src/main/java/com/kingsrook/qbits/example/customizers/ExampleTableCustomizer.java).
+
+```java
+QTableMetaData table = qInstance.getTable(tableName);
+if(table == null)
+{
+   throw new QException("Target table not found: " + tableName);
+}
+new ExampleTableCustomizer().customize(table);
+```
+
+When implementing this method, add `throws QException` to its declaration. Run the config's `validate(QInstance, List<String>)` before registering metadata, and report validation errors rather than silently ignoring a missing target. The uncustomized template contains placeholders for this behavior.
+
+For record hooks, use QQQ's existing table customizer interfaces or `AbstractPreInsertCustomizer`. Its `apply(List<QRecord>)` method returns the records for the next stage; register the customizer through the table's `TableCustomizers.PRE_INSERT_RECORD` role. Check the actual QQQ interface before adding another hook. Add tests proving that the intended table changes and invalid configurations are handled.
@@ -1,461 +0,0 @@
-# qbit-email design
-
-**Status:** spec. Phases (a) to (d) build outbound; phase (e) is inbound (section 12, design only).
-**Brief:** owner decisions of 2026-10-13 (providers, outbound first, both template kinds).
-**Owner decisions (2026-10-12): all recommendations accepted.** Every "Recommended" choice and
-every decision below stands; it is adjusted once it can be seen working.
-
-One email service for a whole QQQ system. Every qbit and app that sends mail queues it through
-this qbit's outbox and gets the same providers, templates, branding, tracking, suppression,
-unsubscribe and PHI rules.
-
-| # | Decision |
-|---|---|
-| D1 | Build on core's messaging SPI (`MessagingProviderInterface`, `SendMessageAction`). The qbit registers one provider type, `QBIT_EMAIL`, that writes to the outbox, so existing `SendMessageAction` callers move by pointing their `messagingProviderName` at it (section 2.4). Core's built-in `EMAIL` and `SES` types are not overridden. |
-| D2 | Delivery transports live in the qbit (section 3): core's SMTP provider has no auth, STARTTLS or timeouts, and its SES provider uses AWS SDK v1 with static keys in metadata. No core PR is required; the transports can move to core later without changing the tables. |
-| D3 | Providers are data rows (`email_provider`). Credentials are environment-variable NAMES, never values (the qbit-assistant rule). |
-| D4 | Every send goes through the outbox (`email_message`); nothing sends inline. Async, at least once, retries with backoff, dead letters, idempotency keys. |
-| D5 | Two template kinds: Markdown with `{{variables}}` inside the branded responsive layout (the default), and raw MJML or HTML (marketing). Templates are versioned. |
-| D6 | Tracking events (SES via SNS, Postmark, SendGrid, Mailgun) arrive at `/qqq/hooks/email/...` (not the UI API), are signature-verified, and land in a durable inbox before processing. |
-| D7 | Hard bounces and complaints suppress the address. One-click unsubscribe (RFC 8058) records a suppression for the message's category, and users see it as a Preferences section (core #1162). |
-| D8 | PHI-safe by default: PII/PHI-classified variables are refused unless the template is `phi_approved`. The recommended PHI pattern is a "secure message" (a sign-in link, no PHI in the body). |
-| D9 | Gmail: SMTP with an app password in phase (b), as a preset of the SMTP transport. The Gmail API with OAuth is specified (section 3.6) and built only on request. |
-| D10 | MJML is compiled when a version is activated, by a pluggable compiler (default: the `mjml` CLI when configured, through stdin and stdout). Sends never need the compiler; HTML templates need nothing. |
-| D11 | Owner rule (2026-10-13): no files or filesystem, only the database and S3. Attachments, rendered bodies and (phase e) inbound mail live in the database or in object storage (qbit-object-storage), never on local disk; the services are stateless, so any replica can send, receive a webhook or render a preview. |
-
-## 1. Flow
-
-```
- EmailService.send(EmailRequest)     ─┐
- email_send_templated (process)      ─┤
- SendMessageAction (type QBIT_EMAIL) ─┼─► EmailOutbox.enqueue ─► email_message (QUEUED; rendered, redacted)
- record action "Send Test Email"     ─┘     idempotency key unique; suppression and PHI checks first
-                                                     │
-                   scheduler (every 15 s) ─► EmailDispatcher.runOnce
-                      claim attempt n (unique insert into email_message_attempt)
-                      ─► provider rate limit ─► EmailTransport.send (SMTP | SES | Postmark | SendGrid | Mailgun | Gmail)
-                      ─► SENT (provider message id) │ RETRY_WAIT (backoff) │ DEAD_LETTER
-                                                     │
- provider webhook ─► /qqq/hooks/email/{kind}/{providerName} ─► verify ─► email_webhook_inbox (durable)
-                      ─► inbox processor ─► email_event (DELIVERED, BOUNCED, COMPLAINED, OPENED, CLICKED, ...)
-                      ─► message status ─► email_suppression (hard bounce, complaint)
- List-Unsubscribe one-click POST ─► /qqq/hooks/email/unsubscribe/{token} ─► email_suppression (category)
-```
-
-## 2. Sending API
-
-### 2.1 `EmailService` (Java, for every consumer)
-
-```java
-EmailSendResult result = EmailService.send(new EmailRequest()
-   .withTemplateName("alerts_notification")        // or withSubject + withMarkdownBody / withHtmlBody for ad-hoc mail
-   .withTo("pat@example.com")                      // withCc, withBcc, withReplyTo; "addr" or "Name <addr>"
-   .withVariable("count", 3)                       // plain values, checked against the template's schema
-   .withRecordVariable("order", "order", 1234)     // a record, read as the sender; classification known
-   .withCategory(EmailCategory.NOTIFICATION)       // default: the template's
-   .withProviderName("pmg")                        // optional; else the default provider
-   .withBrandName("kof22")                         // optional; else the template's, else the default brand
-   .withIdempotencyKey("alerts:notif:991")         // optional; a repeat returns the existing message
-   .withLinkedRecord("alerts_alert", 991)          // shown as a link on the message record
-   .withSender("qbit-alerts", "alerts_notify")     // sender qbit and process
-   .withSendAfter(instant));                       // optional deferral
-// EmailSendResult { messageId, status (QUEUED | DUPLICATE | SUPPRESSED | REFUSED), reasons }
-```
-
- Runs inside the caller's transaction when the backends match (the row commits with the caller's
-  write), else after commit, as qbit-webhooks does.
- Validation is synchronous: unknown template, missing required variables, bad addresses, a
-  PII/PHI variable on a template that is not `phi_approved` (section 7), and a disabled or missing
-  provider all return `REFUSED` with plain reasons, and nothing is queued.
- All recipients suppressed for the category: `SUPPRESSED`; the message is stored with that status
-  (visible in the outbox) and not sent. Partly suppressed: those addresses are dropped and listed
-  on the message.
-
-### 2.2 Process `email_send_templated`
-The same request as a backend process (template, to, cc, bcc, variables JSON, linked table and
-id, idempotency key, provider, brand) for scripts, the API and other qbits. Not in the nav;
-callable through the API and `/qqq/v1/processes`.
-
-### 2.3 Permissions
-`email.view` (read every `email_` table), `email.send` (send through the API or the process;
-system callers use the authorized scope), `email.manage` (templates, brands, suppressions, resend,
-cancel), `email.admin` (providers, test send, PHI approval, removing complaint suppressions). A
-template may set `edit_permission_name` to restrict who edits it (e.g. marketing templates to
-`marketing.manage`).
-
-### 2.4 Core messaging bridge
- `EmailOutboxMessagingProviderMetaData` (type `QBIT_EMAIL`, a `QMessagingProviderMetaData`)
-  registers `EmailOutboxMessagingProvider` with `QMessagingProviderDispatcher`. The producer adds
-  one instance named `qbitEmail` (configurable).
- `sendMessage(SendMessageInput)` maps the parties (`EmailPartyRole` TO/CC/BCC/FROM), subject and
-  contents (`EmailContentRole` TEXT/HTML) to an ad-hoc `EmailRequest` (no template, category
-  TRANSACTIONAL unless configured) and enqueues it. It throws on `REFUSED`, so callers still see
-  failures; delivery is then asynchronous.
- Attachments are stored through qbit-object-storage when it is installed, else refused with a
-  plain message (no blobs in the outbox, nothing on local disk: D11).
- Callers (qbit-alerts `EmailChannel` and `NotificationEmailer`, qbit-marketing
-  `QqqMessagingEmailTransport`) can switch by configuration at once, then move to `EmailService`
-  in phase (d) for templates, categories, idempotency and linked records.
-
-## 3. Providers and transports
-
-### 3.1 `email_provider`
-| Field | Notes |
-|---|---|
-| name, label | unique name, used by `withProviderName` |
-| kind | SMTP, SES, POSTMARK, SENDGRID, MAILGUN, GMAIL_SMTP, GMAIL_API |
-| enabled, is_default | exactly one enabled default (validated) |
-| from_address, from_name, reply_to | defaults for messages |
-| sending_domain | the domain the provider is verified for; other from domains are refused |
-| host, port, security | SMTP: NONE, STARTTLS, TLS; timeouts fixed (10 s connect, 15 s read and write) |
-| region | SES region; Mailgun region (US or EU) |
-| username_env_name, secret_env_name | env-var NAMES only (`^[A-Z_][A-Z0-9_]{0,99}$`, and in the config allowlist) |
-| webhook_secret_env_name | env-var NAME for webhook verification (Mailgun signing key, SendGrid public key, Postmark basic-auth password) |
-| sns_topic_arn, configuration_set, message_stream | SES events topic and configuration set; Postmark message stream |
-| max_per_minute, max_per_day | counted from `email_message_attempt` in the database, so they hold across replicas |
-| track_opens, track_clicks | off by default; refused for `phi_approved` templates |
-| phi_allowed | admin attestation that the provider may carry PHI (BAA in place, or an internal relay) |
-| health_status, last_success_date, last_failure_date, last_failure_message | kept by the dispatcher |
-
-Secrets resolve through `EmailQBitConfig.secretResolver` (default `System::getenv`) at send time.
-They are never stored, logged, audited, put in process output or returned. The record screen shows
-whether each named variable is set (yes or no), never the value.
-
-**Record action "Send Test Email"** (`email.admin`): queues a fixed test message to a given
-address through that provider and reports the outcome on the standard result screen.
-
-### 3.2 `EmailTransport` SPI (in the qbit)
-```java
-public interface EmailTransport
-{
-   EmailTransportResult send(EmailEnvelope envelope, EmailProviderSettings settings) throws EmailTransportException;
-}
-```
-`EmailEnvelope` holds the rendered MIME parts: from, to, cc, bcc, reply-to, subject, HTML, text,
-and headers (`List-Unsubscribe`, `Auto-Submitted`, `X-QQQ-Email-Id`). The result is the
-provider's message id. The exception says whether the failure is **permanent** (rejected address,
-sender refused, 4xx validation) or **transient** (connection, 5xx, throttling with an optional
-retry-after).
-
-### 3.3 SMTP (phase a)
-`jakarta.mail` (already in core): auth when a username env name is set, STARTTLS or implicit TLS,
-connect/read/write timeouts (the kof22 `Mailer` lesson: a stuck relay must not pin a thread).
-Covers PMG (`smtp.galaxy.lan:26`, no auth), any relay, and Gmail SMTP.
-
-### 3.4 SES (phase a)
-AWS SDK v2 `sesv2` `SendEmail` with raw content, so our MIME and headers are kept. Credentials:
-the default AWS chain when no env names are set (IRSA, instance role, `AWS_*`), else the named
-access-key and secret env vars. The configuration set routes events to SNS (section 6).
-
-### 3.5 Postmark, SendGrid, Mailgun (phase b)
-HTTP JSON APIs through `java.net.http`, no vendor SDKs: Postmark `POST /email` (server-token
-header, message stream), SendGrid `POST /v3/mail/send` (bearer key; `X-Message-Id`), Mailgun
-`POST /v3/{domain}/messages.mime` (basic auth `api:key`, US or EU base). 429 and 5xx are
-transient; other 4xx are permanent.
-
-### 3.6 Gmail
- **Phase (b): `GMAIL_SMTP`**, a preset of SMTP (`smtp.gmail.com:587`, STARTTLS) with the account
-  as username and an app password env var. `docs/PROVIDERS.md` documents it: it needs 2-step
-  verification and an app password; Google's daily limits (about 500 for a personal account, 2000
-  for Workspace) go in `max_per_day`.
- **`GMAIL_API` (specified, built on request):** OAuth client id, secret and refresh token (env
-  names), `users.messages.send` with the raw MIME. It needs a Google Cloud project and consent
-  screen and gives system mail nothing the app password does not, so it is deferred.
-
-## 4. Outbox and delivery
-
-### 4.1 `email_message`
-| Field | Notes |
-|---|---|
-| status | QUEUED, SENDING, SENT, DELIVERED, RETRY_WAIT, DEAD_LETTER, BOUNCED, COMPLAINED, SUPPRESSED, CANCELLED |
-| to_addresses, cc_addresses, bcc_addresses, from_address, reply_to | addresses are PII; the table is classified PII (section 7) |
-| subject | rendered; encrypted for `phi_approved` templates (section 7.3) |
-| template_id, template_version_id, brand_id, category, locale | |
-| variables_snapshot | JSON, redacted per section 7.3 |
-| html_body, text_body | rendered at queue time so retries send the same bytes; encrypted for `phi_approved`; cleared after `bodyRetentionDays` (default 30) once final, keeping `body_sha256` |
-| idempotency_key | unique when present |
-| provider_id, provider_message_id | |
-| attempt_count, next_attempt_date, lease_expires_date, last_error, sent_date, delivered_date, dead_letter_date | |
-| linked_table_name, linked_record_id | rendered as a link on the record screen |
-| sender_qbit, sender_process | |
-| suppressed_addresses | addresses dropped at queue time |
-
-Sub-tables, shown as relations on the message: `email_message_attempt` (message_id and
-attempt_number unique as a pair, outcome, provider_id, claimed_by, start and end dates, duration,
-error) and `email_event` (section 6).
-
-### 4.2 Semantics (as qbit-webhooks, proven across replicas)
- **Claim:** to send attempt *n* a runner inserts (`message_id`, *n*) into
-  `email_message_attempt`; the pair is unique, so exactly one runner sends.
- **Lease:** the winner marks the message SENDING with a 120 s lease; an expired lease is retried
-  as attempt *n+1*.
- **At least once:** a runner that dies after the provider accepted, but before recording it,
-  causes at most one repeat. None of the providers offers a send-idempotency key, so the spec says
-  so plainly.
- **Outcomes:** success → SENT. Transient → RETRY_WAIT after `retryMinutes` (1, 5, 15, 60, 240,
-  720; retry-after honoured, capped at 1 h). Permanent → DEAD_LETTER at once. After `maxAttempts`
-  (6) → DEAD_LETTER.
- **Rate limits** per provider per minute and per day, from the database. Over a limit the message
-  waits; that is not an attempt.
- **Provider health:** HEALTHY → UNHEALTHY after 10 consecutive transient failures; while
-  unhealthy one message is tried every 5 minutes; a success → HEALTHY. Alerts (optional, section
-  9): `email.provider.unhealthy` (ERROR, resolved on recovery) and `email.message.dead_letter`
-  (WARNING, deduplicated per provider per hour).
- **Record actions:** Resend (dead letters and bounces: a new linked message with the same
-  content), Cancel (queued or waiting), Send Now (waiting). Standard streamed-ETL Review and Result
-  screens.
- **Retention:** a daily job clears bodies after `bodyRetentionDays` and deletes final messages
-  older than `messageRetentionDays` (0 = keep forever; kof22 keeps).
-
-## 5. Templates and branding
-
-### 5.1 Tables
- `email_template`: name (unique, snake_case), label, category (TRANSACTIONAL, NOTIFICATION,
-  MARKETING, SECURITY), kind (MARKDOWN, MJML, HTML), brand_id, active_version_id, phi_approved,
-  phi_approved_by, phi_approved_date, edit_permission_name, owner_qbit, description.
- `email_template_version` (child list on the template): template_id, version_number, status
-  (DRAFT, ACTIVE, RETIRED), locale (default `en`), subject, preheader, body_source, text_source
-  (optional), compiled_html (MJML), variables_schema (JSON), sample_variables (JSON), created_by,
-  activated_date.
- `email_brand`: name, label, logo_url, logo_dark_url, logo_alt, primary_color, text_color,
-  background_color, dark_background_color, dark_text_color, button_text_color, footer_markdown,
-  postal_address (shown on marketing mail, for CAN-SPAM), social_links (JSON list of label and
-  url), site_url, is_default, app_name (optional: the brand for that app's sends).
-
-An ACTIVE version cannot be edited. **Record action "New Version"** copies it to a DRAFT;
-**"Activate Version"** validates it (schema, a render with the samples, the PHI check, MJML
-compile, brand contrast) and makes it active, retiring the previous one. A message always records
-the exact version it used.
-
-### 5.2 Rendering
- **Variables:** `{{name}}` and dotted paths (`{{order.number}}`), always HTML-escaped;
-  `{{#if name}}…{{/if}}` and `{{#each items}}…{{/each}}`; `{{name|fallback text}}`. No unescaped
-  output and no helpers that run code. Unknown variables fail activation, not sends.
- **Schema:** each variable has name, label, type (STRING, NUMBER, DATE, DATE_TIME, BOOLEAN, URL,
-  LIST, RECORD), required, an optional classification, and an optional bound `table` and `field`
-  (the classification then comes from the field, section 7).
- **Markdown** (commonmark-java with GFM tables and autolinks; raw HTML in Markdown disabled)
-  renders into the branded layout: a fixed, tested, table-based responsive shell (600 px max,
-  single column, inline styles plus one `<style>` block for media queries) with the logo, a hidden
-  preheader, the body, a button style for links written `[Label](url){.button}`, and the footer
-  (brand footer, postal address for MARKETING, the unsubscribe link when it applies).
- **Dark mode:** the layout declares `color-scheme: light dark` and `supported-color-schemes`,
-  switches to the brand's dark colours under `@media (prefers-color-scheme: dark)` (and the
-  `[data-ogsc]` hooks Outlook uses), uses the dark logo when set, never puts text over a
-  background image, and keeps text and button contrast at WCAG AA in both schemes. Activation
-  checks the brand colours and refuses a brand that fails, quoting the ratio.
- **MJML:** compiled at activation by `MjmlCompilerInterface` (default `CliMjmlCompiler`, which
-  runs the configured `mjml` binary with a timeout). With no compiler configured, MJML versions
-  cannot be activated, and say so. The compiled HTML is stored on the version.
- **HTML:** used as given; variables are still substituted and escaped. The qbit adds the
-  unsubscribe footer and headers for MARKETING and NOTIFICATION.
- **Plain text** is generated from the rendered HTML (links as `text (url)`, headings and lists
-  kept) unless the version has its own text.
- **i18n-ready:** versions carry a locale; `EmailRequest.withLocale` picks that locale's active
-  version, else the default locale's. One locale (`en`) ships.
-
-### 5.3 Preview
-Each version record shows a **Preview** widget: the rendered email with the sample variables in a
-sandboxed iframe (`srcdoc`, scripts disabled), Light/Dark and 390/600 px toggles, and the plain
-text. It is served through the UI API (section 10): `POST /qqq/v1/qbit/email/preview` (a version
-id, or unsaved source, plus variables) returns subject, html, text and warnings.
-
-## 6. Delivery tracking
-
-### 6.1 Inbound route
-`EmailWebhookRouteProvider` (a `QJavalinRouteProviderInterface`, registered idempotently as in
-qbit-easypost-tracking) serves `POST /qqq/hooks/email/{kind}/{providerName}`: size cap (413), find
-the enabled provider of that kind (404), verify (401 on failure, 503 when its secret is not set),
-dedup-insert the raw payload into `email_webhook_inbox` (provider_id and external_event_id unique,
-status PENDING, attempts, payload_json, payload_sha256, received_date) and answer 200. A scheduled
-process drains the inbox into `email_event`.
-
-| Kind | Verification |
-|---|---|
-| SES (SNS) | SNS message signature (SignatureVersion 1 and 2) with the certificate from `SigningCertURL`, which must be `https://sns.<region>.amazonaws.com/...pem`; the topic ARN must be the provider's. `SubscriptionConfirmation` is confirmed by fetching `SubscribeURL` (same host rule). |
-| Postmark | HTTP basic auth on the webhook URL (Postmark does not sign); password from the webhook secret env name, compared in constant time. |
-| SendGrid | Signed Event Webhook: ECDSA P-256 over timestamp + body with the public key from the env name; timestamp within 5 minutes. |
-| Mailgun | HMAC-SHA256 of timestamp + token with the signing key; timestamp within 5 minutes; a token seen before is refused. |
-
-### 6.2 `email_event`
-message_id (matched by provider message id or our header), provider_id, event_type (DELIVERED,
-DEFERRED, BOUNCED, COMPLAINED, OPENED, CLICKED, UNSUBSCRIBED, REJECTED), bounce_type (HARD, SOFT,
-UNDETERMINED), recipient, occurred_date, detail (the provider's reason, truncated; never body
-content), url (clicks only). Opens and clicks are stored only when the provider row enables them.
-
-## 7. PHI and PII
-
-### 7.1 Classification
-Variables bound to a field (schema `table` + `field`, or `withRecordVariable`) take that field's
-classification from core `AiDataClassifications.ofField` (`DataClassification` PUBLIC,
-CONFIDENTIAL, PII, PHI; core #1142, first in 4.1.0-RC.6). Until RC.6 the qbit uses a stand-in,
-`EmailClassifications` (reflective lookup of the core class, else config-declared
-classifications), marked for replacement. Unbound variables may be declared PII or PHI in the
-schema.
-
-### 7.2 Refusal
- Activation and sending refuse a template whose variables include PII or PHI unless it is
-  `phi_approved`. Only `email.admin` sets that, through the record action "Approve For PHI", which
-  records who and when; a new version needs approval again.
- A `phi_approved` template may not use open or click tracking, may not be MARKETING, and must go
-  through a provider marked `phi_allowed`.
- **The default PHI pattern** is the built-in template `email_secure_message`: "You have a new
-  secure message from {{brand.label}}. Sign in to read it." with a button to the link the caller
-  passes. No PHI in the body, so it needs no approval. Consumers that hold PHI use it.
-
-### 7.3 Redaction and storage
-Following core `docs/SECURED-DATA.md` (section 15, QRun-IO/qqq#1161):
- `variables_snapshot`: PII/PHI values become tokens in the format of core
-  `ClassifiedValueTokens` (package `...core.actions.permissions.fieldaccess`, SECURED-DATA §14.5):
-  `hmac:v1:<keyId>:<b64url(HMAC-SHA256(key, m))>`, with `m` joined by `` and the canonical
-  value last, and the instance key from `QQQ_AUDIT_HMAC_KEY` (base64).
-  - **Record-bound variables** use the record binding, `m = table␟field␟pk␟canonical(value)`
-    (`forRecordField`), so the token matches the audit's and a field under a wipe rule gets
-    `shred:v1` with the same per-record-field key: a wipe also shreds the outbox snapshot.
-  - **Other values** use a domain-prefixed binding,
-    `m = "email"␟template␟variable␟messageId␟canonical(value)` (`forContext`), so they never
-    collide with a record binding. They get `hmac:v1` only; a low-entropy value (booleans, values
-    with under 4 distinct characters) gets `changed:v1`, because there is no record key to shred.
-  - No key configured: `changed:v1`.
-  - Until core ships the helper, the qbit carries `EmailValueTokens`, marked
-    `STAND-IN(core=#1161-impl, removeBy=RC.7)`, with the same names and output.
- The subject and bodies of `phi_approved` messages are stored AES-256-GCM encrypted with a key
-  from `QQQ_EMAIL_BODY_KEY` (no key: `phi_approved` sends are refused) and cleared after
-  `bodyRetentionDays` once final.
- Logs carry the message id and status only, never addresses, subjects or bodies.
- Record variables are read as the sending user, through core masking, so a value the sender may
-  not see arrives masked.
- **Canary-PHI egress test:** plants `CANARY-PHI-<random>` in a PHI field, sends through every
-  path (EmailService, the process, the core bridge, retry, dead letter, webhook events, an export
-  of `email_message`, the home widget, captured logs) and fails on any substring of the canary
-  longer than 4 characters outside the encrypted columns. It follows the core procedure so it can
-  join the shared canary suite when that exists.
-
-## 8. Suppression and unsubscribe
-
-### 8.1 `email_suppression`
-address (lowercased), scope (ALL or a category), reason (HARD_BOUNCE, COMPLAINT, UNSUBSCRIBE,
-MANUAL), source_message_id, source_event_id, note, created_date, expires_date (optional). Unique on
-(address, scope). `email.manage` adds and removes rows; removing a COMPLAINT needs `email.admin`.
- Hard bounce → ALL. Complaint → ALL. Unsubscribe → the message's category.
- TRANSACTIONAL and SECURITY mail ignores UNSUBSCRIBE rows (they cannot be opted out of) but
-  respects HARD_BOUNCE and COMPLAINT.
-
-### 8.2 One-click unsubscribe (RFC 8058, RFC 2369)
- MARKETING and NOTIFICATION messages carry
-  `List-Unsubscribe: <https://{publicBaseUrl}/qqq/hooks/email/unsubscribe/{token}>` and
-  `List-Unsubscribe-Post: List-Unsubscribe=One-Click`, and the footer links to the same URL.
- The token is `v1.<b64url(payload)>.<b64url(HMAC-SHA256)>` over the message id, an address hash
-  and the category, keyed by `QQQ_EMAIL_UNSUBSCRIBE_KEY`. With no key there is no header and
-  MARKETING sends are refused. Tokens do not expire (RFC 8058 expects the link to keep working).
- `POST` with `List-Unsubscribe=One-Click` records the suppression and returns 200. `GET` returns a
-  minimal page with one "Unsubscribe" button that POSTs, because mail scanners prefetch GETs; then
-  "You are unsubscribed from {category}", with a link to Preferences.
- An `UNSUBSCRIBED` event is recorded on the message.
-
-### 8.3 Preferences (core #1162)
-The qbit registers a Preferences section `email` ("Email") whose provider
-(`EmailPreferenceProvider implements UserPreferenceProviderInterface`) maps the signed-in user's
-address (`UserPreferenceRequestContext.getUserEmailAddress()`, never an address from the request)
-to `email_suppression` rows: one toggle per opt-out-able category (NOTIFICATION,
-MARKETING) and read-only rows saying that account and security mail is always sent. Qbits with
-finer settings keep their own sections: qbit-alerts' "Notifications" decides which alerts are
-emailed; this section decides whether NOTIFICATION mail reaches the address at all. It is built
-once #1162 is in an RC; one-click unsubscribe does not depend on it. With no address on the
-account, the rows are read-only ("No email address on your account") and writes are refused. The
-section's description explains the split with qbit-alerts' Notifications section.
-
-## 9. Integrations
- **Alerts (core `QAlerts`, #1108):** called reflectively when present (section 4.2).
- **ESB and Quick Search:** `email_message`, `email_template` and `email_suppression` publish table
-  events and are searchable (`EmailIntegrations`); bodies and snapshots are excluded.
- **API:** the same tables, permissions and customizers as the admin (QQQ API middleware).
- **Object storage (#1089):** attachments (section 2.4) and, in phase (e), inbound attachments.
-
-## 10. App and UI
- App **Email**, with one home dashboard (one HTML widget, real data only, inline styles, no inner
-  or horizontal scroll, stacked cards under 640 px, light and dark):
-  - sent, delivered, dead letters, bounced and complained in the last 24 h and 7 days;
-  - sends per hour for 24 h (sent and failed);
-  - suppression growth (new rows per day for 30 days, by reason);
-  - provider health (status, last success, last failure reason, rate-limit headroom);
-  - recent messages (newest 20: when, recipient masked as `p***@example.com`, subject unless
-    `phi_approved`, status), each linking to its record.
- Nav: Messages, Templates, Brands, Suppressions, Providers. Attempts, events, versions and inbox
-  rows are relations on their parents.
- UI API extension `email` (1.0.0, `/qqq/v1/qbit/email/...`): `POST /preview` (section 5.3), with
-  its OpenAPI fragment committed and contract-tested. Everything else is standard tables,
-  processes and widgets. The webhook and unsubscribe routes are non-UI (`/qqq/hooks/email/...`).
-
-## 11. Consumers (phase d, one PR per repo)
-| Consumer | Change |
-|---|---|
-| qbit-alerts | `EmailChannel` and `NotificationEmailer` use `EmailService` with templates `alerts_notification` and `alerts_digest` (NOTIFICATION), idempotency `alerts:<id>`, linked alert. `messagingProviderName` stays as the fallback when qbit-email is absent. |
-| qbit-collaboration | an `EmailCollaborationNotifier` for mentions, shares and task reminders (templates `collaboration_mention`, `collaboration_share`, `collaboration_task_reminder`); record labels obey `isRecordLabelFullAccess`. |
-| qbit-assistant | scheduled-task results by email through `EmailService` (template `assistant_scheduled_result`), after its EXTERNAL approval rule. |
-| qbit-easypost-tracking | delivery notices through a notifier that sends `easypost_delivery_notice` (NOTIFICATION). |
-| qbit-marketing | a `MarketingTransport` over `EmailService` (MARKETING, MJML/HTML templates, unsubscribe headers, suppression honoured). |
-| kof22 (Website-Backend) | the contact form's `Mailer` is replaced by `EmailService` with template `kof22_contact`, through an SMTP provider row for PMG (`smtp.galaxy.lan:26`, no auth, no new secrets). A draft PR with a Liquibase changeset for the `email_` tables and seed rows. |
-| Authentik | **keeps its own SMTP to PMG.** It is a separate product (Python) with its own flows and templates (recovery, enrollment, MFA); it must send when the QQQ app is down, since it guards sign-in to that app; and it has no hook to call a Java service. Its mail is account and security mail, to which suppression-by-unsubscribe would not apply anyway. |
-
-## 12. Phase 2: inbound (design only)
- Sources: SES inbound (receipt rule → S3 → SNS → `/qqq/hooks/email/inbound/ses/{name}`), Mailgun
-  routes, Postmark inbound, SendGrid inbound parse, and an IMAP or Gmail mailbox poller
-  (scheduled).
- `email_inbound`: provider, message id, in_reply_to, references, from, to, subject, text and html
-  (sanitized), received_date, status (NEW, ROUTED, UNMATCHED, REJECTED), routed_table, routed_id,
-  spam verdicts. Attachments go to qbit-object-storage (`email_inbound_attachment` rows).
- **Reply-to-record threading:** outbound NOTIFICATION mail sets
-  `Reply-To: reply+<token>@<inbound domain>`, where the token (HMAC) names the message and its
-  linked record. A reply is matched by token; the sender must be the original recipient; quoted
-  text is stripped; an `InboundEmailHandler` registered by the linked table's qbit acts (e.g.
-  qbit-collaboration adds a comment as that user). Unmatched mail stays UNMATCHED for review.
- PHI: inbound bodies are classified PHI by default (unknown content) and stored encrypted.
-
-## 13. Data model summary
-| Table | In the nav | Written by |
-|---|---|---|
-| `email_message` | yes | the qbit (people: record actions only) |
-| `email_message_attempt` | relation | the qbit |
-| `email_event` | relation | the qbit |
-| `email_template` | yes | people (`email.manage`, per-template permission) |
-| `email_template_version` | relation | people (drafts), actions (activation) |
-| `email_brand` | yes | people |
-| `email_suppression` | yes | people and the qbit |
-| `email_provider` | yes | admins |
-| `email_webhook_inbox` | relation (on the provider) | the qbit |
-| `email_inbound`, `email_inbound_attachment` | phase (e) | the qbit |
-
-Postgres DDL in `docs/ddl/email-postgres.sql` (phase a).
-
-## 14. Configuration (`EmailQBitConfig`)
-backendName (required), schedulerName (required to send), publicBaseUrl (unsubscribe links),
-defaultProviderName, bridgeProviderName (`qbitEmail`), secretResolver, allowedEnvNames,
-dispatchIntervalSeconds (15), batchSize (100), maxAttempts (6), retryMinutes, leaseSeconds (120),
-bodyRetentionDays (30), messageRetentionDays (0), mjmlCompiler, classificationOverrides, appName
-and appLabel, securityFields and recordSecurityLocks (multi-tenant hosts).
-
-## 15. Phases and acceptance
-| Phase | Scope | Acceptance (tests) |
-|---|---|---|
-| (a) | tables, outbox and dispatcher, SMTP and SES, Markdown templates and versions, brands and the layout, preview, EmailService, the process, the core bridge, PHI refusal and redaction, the app home | GreenMail SMTP sink end to end; SES through a mocked `SesV2Client`; the claim race (two runners, each message sent once); retry, dead letter, idempotency; rendering (variables, escaping, `#if`/`#each`, plain text, dark-mode contrast); PHI refusal; snapshot redaction; the canary test; producer standards (names, nav, permissions) |
-| (b) | Postmark, SendGrid, Mailgun, Gmail SMTP; MJML and HTML templates | HTTP mocks per provider (success, 4xx permanent, 429/5xx transient); MJML through a fake compiler; the Gmail preset |
-| (c) | webhook route and inbox, events, suppression, unsubscribe, Preferences section | signature verification per provider (valid, tampered, stale, missing secret); the SNS certificate host rule; suppression on hard bounce and complaint; one-click POST and the GET page; category rules |
-| (d) | consumer migrations | each consumer's own tests; a contract test of `EmailService` |
-| (e) | inbound | design only for now |
-
-Dependencies: phase (a) builds on QQQ 4.1.0-RC.5 with the classification stand-in, and moves to
-RC.6 for `DataClassification` and Preferences.
-
-## 16. Owner steps (outside code)
- **PMG (kof22):** none; the relay already accepts the cluster.
- **SES (when a consumer adopts it):** create the SES identity for each sending domain in the
-  `terraform/dns-route53` root (owner-applied), request production access, and create a
-  configuration set with an SNS destination to `https://<app>/qqq/hooks/email/ses/<provider>`.
-  The DNS records (DKIM CNAMEs, a custom MAIL FROM subdomain with its MX and SPF; DMARC stays at
-  p=reject) go in as Praetor octoDNS PRs once the identity exists, because SES issues the DKIM
-  tokens.
- **Postmark, SendGrid, Mailgun, Gmail:** accounts and keys only if used; keys go into Infisical
-  under the env names the provider rows reference.
- **Keys:** `QQQ_EMAIL_UNSUBSCRIBE_KEY` and `QQQ_EMAIL_BODY_KEY` per deployment (Infisical, seeded
-  write-only like other app keys).
@@ -1,295 +0,0 @@
-#!/bin/sh
-# ----------------------------------------------------------------------------
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-# ----------------------------------------------------------------------------
-
-# ----------------------------------------------------------------------------
-# Apache Maven Wrapper startup batch script, version 3.3.4
-#
-# Optional ENV vars
-# -----------------
-#   JAVA_HOME - location of a JDK home dir, required when download maven via java source
-#   MVNW_REPOURL - repo url base for downloading maven distribution
-#   MVNW_USERNAME/MVNW_PASSWORD - user and password for downloading maven
-#   MVNW_VERBOSE - true: enable verbose log; debug: trace the mvnw script; others: silence the output
-# ----------------------------------------------------------------------------
-
-set -euf
-[ "${MVNW_VERBOSE-}" != debug ] || set -x
-
-# OS specific support.
-native_path() { printf %s\\n "$1"; }
-case "$(uname)" in
-CYGWIN* | MINGW*)
-  [ -z "${JAVA_HOME-}" ] || JAVA_HOME="$(cygpath --unix "$JAVA_HOME")"
-  native_path() { cygpath --path --windows "$1"; }
-  ;;
-esac
-
-# set JAVACMD and JAVACCMD
-set_java_home() {
-  # For Cygwin and MinGW, ensure paths are in Unix format before anything is touched
-  if [ -n "${JAVA_HOME-}" ]; then
-    if [ -x "$JAVA_HOME/jre/sh/java" ]; then
-      # IBM's JDK on AIX uses strange locations for the executables
-      JAVACMD="$JAVA_HOME/jre/sh/java"
-      JAVACCMD="$JAVA_HOME/jre/sh/javac"
-    else
-      JAVACMD="$JAVA_HOME/bin/java"
-      JAVACCMD="$JAVA_HOME/bin/javac"
-
-      if [ ! -x "$JAVACMD" ] || [ ! -x "$JAVACCMD" ]; then
-        echo "The JAVA_HOME environment variable is not defined correctly, so mvnw cannot run." >&2
-        echo "JAVA_HOME is set to \"$JAVA_HOME\", but \"\$JAVA_HOME/bin/java\" or \"\$JAVA_HOME/bin/javac\" does not exist." >&2
-        return 1
-      fi
-    fi
-  else
-    JAVACMD="$(
-      'set' +e
-      'unset' -f command 2>/dev/null
-      'command' -v java
-    )" || :
-    JAVACCMD="$(
-      'set' +e
-      'unset' -f command 2>/dev/null
-      'command' -v javac
-    )" || :
-
-    if [ ! -x "${JAVACMD-}" ] || [ ! -x "${JAVACCMD-}" ]; then
-      echo "The java/javac command does not exist in PATH nor is JAVA_HOME set, so mvnw cannot run." >&2
-      return 1
-    fi
-  fi
-}
-
-# hash string like Java String::hashCode
-hash_string() {
-  str="${1:-}" h=0
-  while [ -n "$str" ]; do
-    char="${str%"${str#?}"}"
-    h=$(((h * 31 + $(LC_CTYPE=C printf %d "'$char")) % 4294967296))
-    str="${str#?}"
-  done
-  printf %x\\n $h
-}
-
-verbose() { :; }
-[ "${MVNW_VERBOSE-}" != true ] || verbose() { printf %s\\n "${1-}"; }
-
-die() {
-  printf %s\\n "$1" >&2
-  exit 1
-}
-
-trim() {
-  # MWRAPPER-139:
-  #   Trims trailing and leading whitespace, carriage returns, tabs, and linefeeds.
-  #   Needed for removing poorly interpreted newline sequences when running in more
-  #   exotic environments such as mingw bash on Windows.
-  printf "%s" "${1}" | tr -d '[:space:]'
-}
-
-scriptDir="$(dirname "$0")"
-scriptName="$(basename "$0")"
-
-# parse distributionUrl and optional distributionSha256Sum, requires .mvn/wrapper/maven-wrapper.properties
-while IFS="=" read -r key value; do
-  case "${key-}" in
-  distributionUrl) distributionUrl=$(trim "${value-}") ;;
-  distributionSha256Sum) distributionSha256Sum=$(trim "${value-}") ;;
-  esac
-done <"$scriptDir/.mvn/wrapper/maven-wrapper.properties"
-[ -n "${distributionUrl-}" ] || die "cannot read distributionUrl property in $scriptDir/.mvn/wrapper/maven-wrapper.properties"
-
-case "${distributionUrl##*/}" in
-maven-mvnd-*bin.*)
-  MVN_CMD=mvnd.sh _MVNW_REPO_PATTERN=/maven/mvnd/
-  case "${PROCESSOR_ARCHITECTURE-}${PROCESSOR_ARCHITEW6432-}:$(uname -a)" in
-  *AMD64:CYGWIN* | *AMD64:MINGW*) distributionPlatform=windows-amd64 ;;
-  :Darwin*x86_64) distributionPlatform=darwin-amd64 ;;
-  :Darwin*arm64) distributionPlatform=darwin-aarch64 ;;
-  :Linux*x86_64*) distributionPlatform=linux-amd64 ;;
-  *)
-    echo "Cannot detect native platform for mvnd on $(uname)-$(uname -m), use pure java version" >&2
-    distributionPlatform=linux-amd64
-    ;;
-  esac
-  distributionUrl="${distributionUrl%-bin.*}-$distributionPlatform.zip"
-  ;;
-maven-mvnd-*) MVN_CMD=mvnd.sh _MVNW_REPO_PATTERN=/maven/mvnd/ ;;
-*) MVN_CMD="mvn${scriptName#mvnw}" _MVNW_REPO_PATTERN=/org/apache/maven/ ;;
-esac
-
-# apply MVNW_REPOURL and calculate MAVEN_HOME
-# maven home pattern: ~/.m2/wrapper/dists/{apache-maven-<version>,maven-mvnd-<version>-<platform>}/<hash>
-[ -z "${MVNW_REPOURL-}" ] || distributionUrl="$MVNW_REPOURL$_MVNW_REPO_PATTERN${distributionUrl#*"$_MVNW_REPO_PATTERN"}"
-distributionUrlName="${distributionUrl##*/}"
-distributionUrlNameMain="${distributionUrlName%.*}"
-distributionUrlNameMain="${distributionUrlNameMain%-bin}"
-MAVEN_USER_HOME="${MAVEN_USER_HOME:-${HOME}/.m2}"
-MAVEN_HOME="${MAVEN_USER_HOME}/wrapper/dists/${distributionUrlNameMain-}/$(hash_string "$distributionUrl")"
-
-exec_maven() {
-  unset MVNW_VERBOSE MVNW_USERNAME MVNW_PASSWORD MVNW_REPOURL || :
-  exec "$MAVEN_HOME/bin/$MVN_CMD" "$@" || die "cannot exec $MAVEN_HOME/bin/$MVN_CMD"
-}
-
-if [ -d "$MAVEN_HOME" ]; then
-  verbose "found existing MAVEN_HOME at $MAVEN_HOME"
-  exec_maven "$@"
-fi
-
-case "${distributionUrl-}" in
-*?-bin.zip | *?maven-mvnd-?*-?*.zip) ;;
-*) die "distributionUrl is not valid, must match *-bin.zip or maven-mvnd-*.zip, but found '${distributionUrl-}'" ;;
-esac
-
-# prepare tmp dir
-if TMP_DOWNLOAD_DIR="$(mktemp -d)" && [ -d "$TMP_DOWNLOAD_DIR" ]; then
-  clean() { rm -rf -- "$TMP_DOWNLOAD_DIR"; }
-  trap clean HUP INT TERM EXIT
-else
-  die "cannot create temp dir"
-fi
-
-mkdir -p -- "${MAVEN_HOME%/*}"
-
-# Download and Install Apache Maven
-verbose "Couldn't find MAVEN_HOME, downloading and installing it ..."
-verbose "Downloading from: $distributionUrl"
-verbose "Downloading to: $TMP_DOWNLOAD_DIR/$distributionUrlName"
-
-# select .zip or .tar.gz
-if ! command -v unzip >/dev/null; then
-  distributionUrl="${distributionUrl%.zip}.tar.gz"
-  distributionUrlName="${distributionUrl##*/}"
-fi
-
-# verbose opt
-__MVNW_QUIET_WGET=--quiet __MVNW_QUIET_CURL=--silent __MVNW_QUIET_UNZIP=-q __MVNW_QUIET_TAR=''
-[ "${MVNW_VERBOSE-}" != true ] || __MVNW_QUIET_WGET='' __MVNW_QUIET_CURL='' __MVNW_QUIET_UNZIP='' __MVNW_QUIET_TAR=v
-
-# normalize http auth
-case "${MVNW_PASSWORD:+has-password}" in
-'') MVNW_USERNAME='' MVNW_PASSWORD='' ;;
-has-password) [ -n "${MVNW_USERNAME-}" ] || MVNW_USERNAME='' MVNW_PASSWORD='' ;;
-esac
-
-if [ -z "${MVNW_USERNAME-}" ] && command -v wget >/dev/null; then
-  verbose "Found wget ... using wget"
-  wget ${__MVNW_QUIET_WGET:+"$__MVNW_QUIET_WGET"} "$distributionUrl" -O "$TMP_DOWNLOAD_DIR/$distributionUrlName" || die "wget: Failed to fetch $distributionUrl"
-elif [ -z "${MVNW_USERNAME-}" ] && command -v curl >/dev/null; then
-  verbose "Found curl ... using curl"
-  curl ${__MVNW_QUIET_CURL:+"$__MVNW_QUIET_CURL"} -f -L -o "$TMP_DOWNLOAD_DIR/$distributionUrlName" "$distributionUrl" || die "curl: Failed to fetch $distributionUrl"
-elif set_java_home; then
-  verbose "Falling back to use Java to download"
-  javaSource="$TMP_DOWNLOAD_DIR/Downloader.java"
-  targetZip="$TMP_DOWNLOAD_DIR/$distributionUrlName"
-  cat >"$javaSource" <<-END
-	public class Downloader extends java.net.Authenticator
-	{
-	  protected java.net.PasswordAuthentication getPasswordAuthentication()
-	  {
-	    return new java.net.PasswordAuthentication( System.getenv( "MVNW_USERNAME" ), System.getenv( "MVNW_PASSWORD" ).toCharArray() );
-	  }
-	  public static void main( String[] args ) throws Exception
-	  {
-	    setDefault( new Downloader() );
-	    java.nio.file.Files.copy( java.net.URI.create( args[0] ).toURL().openStream(), java.nio.file.Paths.get( args[1] ).toAbsolutePath().normalize() );
-	  }
-	}
-	END
-  # For Cygwin/MinGW, switch paths to Windows format before running javac and java
-  verbose " - Compiling Downloader.java ..."
-  "$(native_path "$JAVACCMD")" "$(native_path "$javaSource")" || die "Failed to compile Downloader.java"
-  verbose " - Running Downloader.java ..."
-  "$(native_path "$JAVACMD")" -cp "$(native_path "$TMP_DOWNLOAD_DIR")" Downloader "$distributionUrl" "$(native_path "$targetZip")"
-fi
-
-# If specified, validate the SHA-256 sum of the Maven distribution zip file
-if [ -n "${distributionSha256Sum-}" ]; then
-  distributionSha256Result=false
-  if [ "$MVN_CMD" = mvnd.sh ]; then
-    echo "Checksum validation is not supported for maven-mvnd." >&2
-    echo "Please disable validation by removing 'distributionSha256Sum' from your maven-wrapper.properties." >&2
-    exit 1
-  elif command -v sha256sum >/dev/null; then
-    if echo "$distributionSha256Sum  $TMP_DOWNLOAD_DIR/$distributionUrlName" | sha256sum -c - >/dev/null 2>&1; then
-      distributionSha256Result=true
-    fi
-  elif command -v shasum >/dev/null; then
-    if echo "$distributionSha256Sum  $TMP_DOWNLOAD_DIR/$distributionUrlName" | shasum -a 256 -c >/dev/null 2>&1; then
-      distributionSha256Result=true
-    fi
-  else
-    echo "Checksum validation was requested but neither 'sha256sum' or 'shasum' are available." >&2
-    echo "Please install either command, or disable validation by removing 'distributionSha256Sum' from your maven-wrapper.properties." >&2
-    exit 1
-  fi
-  if [ $distributionSha256Result = false ]; then
-    echo "Error: Failed to validate Maven distribution SHA-256, your Maven distribution might be compromised." >&2
-    echo "If you updated your Maven version, you need to update the specified distributionSha256Sum property." >&2
-    exit 1
-  fi
-fi
-
-# unzip and move
-if command -v unzip >/dev/null; then
-  unzip ${__MVNW_QUIET_UNZIP:+"$__MVNW_QUIET_UNZIP"} "$TMP_DOWNLOAD_DIR/$distributionUrlName" -d "$TMP_DOWNLOAD_DIR" || die "failed to unzip"
-else
-  tar xzf${__MVNW_QUIET_TAR:+"$__MVNW_QUIET_TAR"} "$TMP_DOWNLOAD_DIR/$distributionUrlName" -C "$TMP_DOWNLOAD_DIR" || die "failed to untar"
-fi
-
-# Find the actual extracted directory name (handles snapshots where filename != directory name)
-actualDistributionDir=""
-
-# First try the expected directory name (for regular distributions)
-if [ -d "$TMP_DOWNLOAD_DIR/$distributionUrlNameMain" ]; then
-  if [ -f "$TMP_DOWNLOAD_DIR/$distributionUrlNameMain/bin/$MVN_CMD" ]; then
-    actualDistributionDir="$distributionUrlNameMain"
-  fi
-fi
-
-# If not found, search for any directory with the Maven executable (for snapshots)
-if [ -z "$actualDistributionDir" ]; then
-  # enable globbing to iterate over items
-  set +f
-  for dir in "$TMP_DOWNLOAD_DIR"/*; do
-    if [ -d "$dir" ]; then
-      if [ -f "$dir/bin/$MVN_CMD" ]; then
-        actualDistributionDir="$(basename "$dir")"
-        break
-      fi
-    fi
-  done
-  set -f
-fi
-
-if [ -z "$actualDistributionDir" ]; then
-  verbose "Contents of $TMP_DOWNLOAD_DIR:"
-  verbose "$(ls -la "$TMP_DOWNLOAD_DIR")"
-  die "Could not find Maven distribution directory in extracted archive"
-fi
-
-verbose "Found extracted Maven distribution directory: $actualDistributionDir"
-printf %s\\n "$distributionUrl" >"$TMP_DOWNLOAD_DIR/$actualDistributionDir/mvnw.url"
-mv -- "$TMP_DOWNLOAD_DIR/$actualDistributionDir" "$MAVEN_HOME" || [ -d "$MAVEN_HOME" ] || die "fail to move MAVEN_HOME"
-
-clean || :
-exec_maven "$@"
@@ -1,189 +0,0 @@
-<# : batch portion
-@REM ----------------------------------------------------------------------------
-@REM Licensed to the Apache Software Foundation (ASF) under one
-@REM or more contributor license agreements.  See the NOTICE file
-@REM distributed with this work for additional information
-@REM regarding copyright ownership.  The ASF licenses this file
-@REM to you under the Apache License, Version 2.0 (the
-@REM "License"); you may not use this file except in compliance
-@REM with the License.  You may obtain a copy of the License at
-@REM
-@REM    http://www.apache.org/licenses/LICENSE-2.0
-@REM
-@REM Unless required by applicable law or agreed to in writing,
-@REM software distributed under the License is distributed on an
-@REM "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-@REM KIND, either express or implied.  See the License for the
-@REM specific language governing permissions and limitations
-@REM under the License.
-@REM ----------------------------------------------------------------------------
-
-@REM ----------------------------------------------------------------------------
-@REM Apache Maven Wrapper startup batch script, version 3.3.4
-@REM
-@REM Optional ENV vars
-@REM   MVNW_REPOURL - repo url base for downloading maven distribution
-@REM   MVNW_USERNAME/MVNW_PASSWORD - user and password for downloading maven
-@REM   MVNW_VERBOSE - true: enable verbose log; others: silence the output
-@REM ----------------------------------------------------------------------------
-
-@IF "%__MVNW_ARG0_NAME__%"=="" (SET __MVNW_ARG0_NAME__=%~nx0)
-@SET __MVNW_CMD__=
-@SET __MVNW_ERROR__=
-@SET __MVNW_PSMODULEP_SAVE=%PSModulePath%
-@SET PSModulePath=
-@FOR /F "usebackq tokens=1* delims==" %%A IN (`powershell -noprofile "& {$scriptDir='%~dp0'; $script='%__MVNW_ARG0_NAME__%'; icm -ScriptBlock ([Scriptblock]::Create((Get-Content -Raw '%~f0'))) -NoNewScope}"`) DO @(
-  IF "%%A"=="MVN_CMD" (set __MVNW_CMD__=%%B) ELSE IF "%%B"=="" (echo %%A) ELSE (echo %%A=%%B)
-)
-@SET PSModulePath=%__MVNW_PSMODULEP_SAVE%
-@SET __MVNW_PSMODULEP_SAVE=
-@SET __MVNW_ARG0_NAME__=
-@SET MVNW_USERNAME=
-@SET MVNW_PASSWORD=
-@IF NOT "%__MVNW_CMD__%"=="" ("%__MVNW_CMD__%" %*)
-@echo Cannot start maven from wrapper >&2 && exit /b 1
-@GOTO :EOF
-: end batch / begin powershell #>
-
-$ErrorActionPreference = "Stop"
-if ($env:MVNW_VERBOSE -eq "true") {
-  $VerbosePreference = "Continue"
-}
-
-# calculate distributionUrl, requires .mvn/wrapper/maven-wrapper.properties
-$distributionUrl = (Get-Content -Raw "$scriptDir/.mvn/wrapper/maven-wrapper.properties" | ConvertFrom-StringData).distributionUrl
-if (!$distributionUrl) {
-  Write-Error "cannot read distributionUrl property in $scriptDir/.mvn/wrapper/maven-wrapper.properties"
-}
-
-switch -wildcard -casesensitive ( $($distributionUrl -replace '^.*/','') ) {
-  "maven-mvnd-*" {
-    $USE_MVND = $true
-    $distributionUrl = $distributionUrl -replace '-bin\.[^.]*$',"-windows-amd64.zip"
-    $MVN_CMD = "mvnd.cmd"
-    break
-  }
-  default {
-    $USE_MVND = $false
-    $MVN_CMD = $script -replace '^mvnw','mvn'
-    break
-  }
-}
-
-# apply MVNW_REPOURL and calculate MAVEN_HOME
-# maven home pattern: ~/.m2/wrapper/dists/{apache-maven-<version>,maven-mvnd-<version>-<platform>}/<hash>
-if ($env:MVNW_REPOURL) {
-  $MVNW_REPO_PATTERN = if ($USE_MVND -eq $False) { "/org/apache/maven/" } else { "/maven/mvnd/" }
-  $distributionUrl = "$env:MVNW_REPOURL$MVNW_REPO_PATTERN$($distributionUrl -replace "^.*$MVNW_REPO_PATTERN",'')"
-}
-$distributionUrlName = $distributionUrl -replace '^.*/',''
-$distributionUrlNameMain = $distributionUrlName -replace '\.[^.]*$','' -replace '-bin$',''
-
-$MAVEN_M2_PATH = "$HOME/.m2"
-if ($env:MAVEN_USER_HOME) {
-  $MAVEN_M2_PATH = "$env:MAVEN_USER_HOME"
-}
-
-if (-not (Test-Path -Path $MAVEN_M2_PATH)) {
-    New-Item -Path $MAVEN_M2_PATH -ItemType Directory | Out-Null
-}
-
-$MAVEN_WRAPPER_DISTS = $null
-if ((Get-Item $MAVEN_M2_PATH).Target[0] -eq $null) {
-  $MAVEN_WRAPPER_DISTS = "$MAVEN_M2_PATH/wrapper/dists"
-} else {
-  $MAVEN_WRAPPER_DISTS = (Get-Item $MAVEN_M2_PATH).Target[0] + "/wrapper/dists"
-}
-
-$MAVEN_HOME_PARENT = "$MAVEN_WRAPPER_DISTS/$distributionUrlNameMain"
-$MAVEN_HOME_NAME = ([System.Security.Cryptography.SHA256]::Create().ComputeHash([byte[]][char[]]$distributionUrl) | ForEach-Object {$_.ToString("x2")}) -join ''
-$MAVEN_HOME = "$MAVEN_HOME_PARENT/$MAVEN_HOME_NAME"
-
-if (Test-Path -Path "$MAVEN_HOME" -PathType Container) {
-  Write-Verbose "found existing MAVEN_HOME at $MAVEN_HOME"
-  Write-Output "MVN_CMD=$MAVEN_HOME/bin/$MVN_CMD"
-  exit $?
-}
-
-if (! $distributionUrlNameMain -or ($distributionUrlName -eq $distributionUrlNameMain)) {
-  Write-Error "distributionUrl is not valid, must end with *-bin.zip, but found $distributionUrl"
-}
-
-# prepare tmp dir
-$TMP_DOWNLOAD_DIR_HOLDER = New-TemporaryFile
-$TMP_DOWNLOAD_DIR = New-Item -Itemtype Directory -Path "$TMP_DOWNLOAD_DIR_HOLDER.dir"
-$TMP_DOWNLOAD_DIR_HOLDER.Delete() | Out-Null
-trap {
-  if ($TMP_DOWNLOAD_DIR.Exists) {
-    try { Remove-Item $TMP_DOWNLOAD_DIR -Recurse -Force | Out-Null }
-    catch { Write-Warning "Cannot remove $TMP_DOWNLOAD_DIR" }
-  }
-}
-
-New-Item -Itemtype Directory -Path "$MAVEN_HOME_PARENT" -Force | Out-Null
-
-# Download and Install Apache Maven
-Write-Verbose "Couldn't find MAVEN_HOME, downloading and installing it ..."
-Write-Verbose "Downloading from: $distributionUrl"
-Write-Verbose "Downloading to: $TMP_DOWNLOAD_DIR/$distributionUrlName"
-
-$webclient = New-Object System.Net.WebClient
-if ($env:MVNW_USERNAME -and $env:MVNW_PASSWORD) {
-  $webclient.Credentials = New-Object System.Net.NetworkCredential($env:MVNW_USERNAME, $env:MVNW_PASSWORD)
-}
-[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
-$webclient.DownloadFile($distributionUrl, "$TMP_DOWNLOAD_DIR/$distributionUrlName") | Out-Null
-
-# If specified, validate the SHA-256 sum of the Maven distribution zip file
-$distributionSha256Sum = (Get-Content -Raw "$scriptDir/.mvn/wrapper/maven-wrapper.properties" | ConvertFrom-StringData).distributionSha256Sum
-if ($distributionSha256Sum) {
-  if ($USE_MVND) {
-    Write-Error "Checksum validation is not supported for maven-mvnd. `nPlease disable validation by removing 'distributionSha256Sum' from your maven-wrapper.properties."
-  }
-  Import-Module $PSHOME\Modules\Microsoft.PowerShell.Utility -Function Get-FileHash
-  if ((Get-FileHash "$TMP_DOWNLOAD_DIR/$distributionUrlName" -Algorithm SHA256).Hash.ToLower() -ne $distributionSha256Sum) {
-    Write-Error "Error: Failed to validate Maven distribution SHA-256, your Maven distribution might be compromised. If you updated your Maven version, you need to update the specified distributionSha256Sum property."
-  }
-}
-
-# unzip and move
-Expand-Archive "$TMP_DOWNLOAD_DIR/$distributionUrlName" -DestinationPath "$TMP_DOWNLOAD_DIR" | Out-Null
-
-# Find the actual extracted directory name (handles snapshots where filename != directory name)
-$actualDistributionDir = ""
-
-# First try the expected directory name (for regular distributions)
-$expectedPath = Join-Path "$TMP_DOWNLOAD_DIR" "$distributionUrlNameMain"
-$expectedMvnPath = Join-Path "$expectedPath" "bin/$MVN_CMD"
-if ((Test-Path -Path $expectedPath -PathType Container) -and (Test-Path -Path $expectedMvnPath -PathType Leaf)) {
-  $actualDistributionDir = $distributionUrlNameMain
-}
-
-# If not found, search for any directory with the Maven executable (for snapshots)
-if (!$actualDistributionDir) {
-  Get-ChildItem -Path "$TMP_DOWNLOAD_DIR" -Directory | ForEach-Object {
-    $testPath = Join-Path $_.FullName "bin/$MVN_CMD"
-    if (Test-Path -Path $testPath -PathType Leaf) {
-      $actualDistributionDir = $_.Name
-    }
-  }
-}
-
-if (!$actualDistributionDir) {
-  Write-Error "Could not find Maven distribution directory in extracted archive"
-}
-
-Write-Verbose "Found extracted Maven distribution directory: $actualDistributionDir"
-Rename-Item -Path "$TMP_DOWNLOAD_DIR/$actualDistributionDir" -NewName $MAVEN_HOME_NAME | Out-Null
-try {
-  Move-Item -Path "$TMP_DOWNLOAD_DIR/$MAVEN_HOME_NAME" -Destination $MAVEN_HOME_PARENT | Out-Null
-} catch {
-  if (! (Test-Path -Path "$MAVEN_HOME" -PathType Container)) {
-    Write-Error "fail to move MAVEN_HOME"
-  }
-} finally {
-  try { Remove-Item $TMP_DOWNLOAD_DIR -Recurse -Force | Out-Null }
-  catch { Write-Warning "Cannot remove $TMP_DOWNLOAD_DIR" }
-}
-
-Write-Output "MVN_CMD=$MAVEN_HOME/bin/$MVN_CMD"
@@ -1,101 +1,36 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!--
-  ~ QQQ - Low-code Application Framework for Engineers.
-  ~ Copyright (C) 2021-2026.  Kingsrook, LLC
-  ~ 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
-  ~ contact@kingsrook.com
-  ~ https://github.com/Kingsrook/
-  ~
-  ~ Licensed under the Apache License, Version 2.0 (the "License");
-  ~ you may not use this file except in compliance with the License.
-  ~ You may obtain a copy of the License at
-  ~
-  ~     https://www.apache.org/licenses/LICENSE-2.0
-  ~
-  ~ Unless required by applicable law or agreed to in writing, software
-  ~ distributed under the License is distributed on an "AS IS" BASIS,
-  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  ~ See the License for the specific language governing permissions and
-  ~ limitations under the License.
-  -->
-
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
-
-   <properties>
-      <revision>0.1.0-SNAPSHOT</revision>
-      <maven.compiler.source>21</maven.compiler.source>
-      <maven.compiler.target>21</maven.compiler.target>
-      <jacoco.version>0.8.15</jacoco.version>
-      <h2.version>2.2.224</h2.version>
-   </properties>
-
-   <parent>
-      <groupId>com.kingsrook</groupId>
-      <artifactId>qbit-build-parent</artifactId>
-      <version>2.0.0</version>
-   </parent>
-
-   <groupId>com.kingsrook.qbits</groupId>
-   <artifactId>qbit-email</artifactId>
-   <version>${revision}</version>
-   <packaging>jar</packaging>
-
-   <name>QBit Email</name>
-   <description>QBit for email across a QQQ system: an outbox with retries, SMTP, SES, Postmark, SendGrid, Mailgun and Gmail providers, Markdown and MJML templates with branding, delivery tracking, suppression and one-click unsubscribe</description>
-   <url>https://github.com/QRun-IO/qbit-email</url>
-
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
+         http://maven.apache.org/xsd/maven-4.0.0.xsd">
   <modelVersion>4.0.0</modelVersion>

-   <licenses>
-      <license>
-         <name>Apache License, Version 2.0</name>
-         <url>https://www.apache.org/licenses/LICENSE-2.0</url>
-         <distribution>repo</distribution>
-      </license>
-   </licenses>
+   <groupId>com.kingsrook.qbits</groupId>
+   <artifactId>qbit-example-extension</artifactId>
+   <version>0.1.0-SNAPSHOT</version>
+   <packaging>jar</packaging>

-   <developers>
-      <developer>
-         <id>kingsrook</id>
-         <name>Kingsrook Team</name>
-         <email>contact@kingsrook.com</email>
-         <organization>Kingsrook, LLC</organization>
-         <organizationUrl>https://kingsrook.com</organizationUrl>
-      </developer>
-   </developers>
+   <name>QBit Example Extension</name>
+   <description>Example Extension QBit - rename this for your QBit</description>

-   <scm>
-      <connection>scm:git:git://github.com/QRun-IO/qbit-email.git</connection>
-      <developerConnection>scm:git:ssh://github.com:QRun-IO/qbit-email.git</developerConnection>
-      <url>https://github.com/QRun-IO/qbit-email</url>
-      <tag>HEAD</tag>
-   </scm>
+   <properties>
+      <maven.compiler.source>21</maven.compiler.source>
+      <maven.compiler.target>21</maven.compiler.target>
+      <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+      <qqq.version>4.0.0</qqq.version>
+   </properties>

   <dependencies>
      <dependency>
         <groupId>com.kingsrook.qqq</groupId>
         <artifactId>qqq-backend-core</artifactId>
+         <version>${qqq.version}</version>
      </dependency>

-      <dependency>
-         <groupId>com.kingsrook.qqq</groupId>
-         <artifactId>qqq-backend-module-rdbms</artifactId>
-         <scope>test</scope>
-      </dependency>
-      <dependency>
-         <groupId>com.kingsrook.qqq</groupId>
-         <artifactId>qqq-middleware-javalin</artifactId>
-         <scope>test</scope>
-      </dependency>
-      <dependency>
-         <groupId>com.h2database</groupId>
-         <artifactId>h2</artifactId>
-         <version>${h2.version}</version>
-         <scope>test</scope>
-      </dependency>
      <dependency>
         <groupId>org.junit.jupiter</groupId>
         <artifactId>junit-jupiter</artifactId>
+         <version>5.10.0</version>
         <scope>test</scope>
      </dependency>
      <dependency>
@@ -110,104 +45,14 @@
      <plugins>
         <plugin>
            <groupId>org.apache.maven.plugins</groupId>
-            <artifactId>maven-checkstyle-plugin</artifactId>
-            <version>3.3.1</version>
-            <dependencies>
-               <dependency>
-                  <groupId>com.puppycrawl.tools</groupId>
-                  <artifactId>checkstyle</artifactId>
-                  <version>10.12.6</version>
-               </dependency>
-            </dependencies>
-            <configuration>
-               <configLocation>checkstyle/config.xml</configLocation>
-               <headerLocation>checkstyle/license.txt</headerLocation>
-               <encoding>UTF-8</encoding>
-               <consoleOutput>true</consoleOutput>
-               <failsOnError>false</failsOnError>
-               <failOnViolation>true</failOnViolation>
-               <violationSeverity>warning</violationSeverity>
-               <includeTestSourceDirectory>false</includeTestSourceDirectory>
-            </configuration>
-            <executions>
-               <execution>
-                  <id>validate</id>
-                  <phase>validate</phase>
-                  <goals>
-                     <goal>check</goal>
-                  </goals>
-               </execution>
-            </executions>
+            <artifactId>maven-compiler-plugin</artifactId>
+            <version>3.11.0</version>
         </plugin>
         <plugin>
-            <groupId>org.jacoco</groupId>
-            <artifactId>jacoco-maven-plugin</artifactId>
-            <version>${jacoco.version}</version>
-            <executions>
-               <execution>
-                  <id>prepare-agent</id>
-                  <goals>
-                     <goal>prepare-agent</goal>
-                  </goals>
-               </execution>
-               <execution>
-                  <id>report</id>
-                  <phase>verify</phase>
-                  <goals>
-                     <goal>report</goal>
-                  </goals>
-               </execution>
-               <execution>
-                  <id>check</id>
-                  <goals>
-                     <goal>check</goal>
-                  </goals>
-                  <configuration>
-                     <rules>
-                        <rule>
-                           <element>BUNDLE</element>
-                           <limits>
-                              <limit>
-                                 <counter>INSTRUCTION</counter>
-                                 <value>COVEREDRATIO</value>
-                                 <minimum>0.70</minimum>
-                              </limit>
-                              <limit>
-                                 <counter>CLASS</counter>
-                                 <value>COVEREDRATIO</value>
-                                 <minimum>0.90</minimum>
-                              </limit>
-                           </limits>
-                        </rule>
-                     </rules>
-                  </configuration>
-               </execution>
-            </executions>
+            <groupId>org.apache.maven.plugins</groupId>
+            <artifactId>maven-surefire-plugin</artifactId>
+            <version>3.1.2</version>
         </plugin>
      </plugins>
   </build>
-
-   <profiles>
-      <!-- QQQ 4.1 APIs until qbit-build-parent imports the 4.1 BOM (as in qbit-quick-search and qbit-cdn, ADR-0007). -->
-      <profile>
-         <id>qqq-snapshot</id>
-         <activation>
-            <activeByDefault>true</activeByDefault>
-         </activation>
-         <properties>
-            <qqq.snapshot.version>4.1.0-RC.4</qqq.snapshot.version>
-         </properties>
-         <dependencyManagement>
-            <dependencies>
-               <dependency>
-                  <groupId>com.kingsrook.qqq</groupId>
-                  <artifactId>qqq-bom-pom</artifactId>
-                  <version>${qqq.snapshot.version}</version>
-                  <type>pom</type>
-                  <scope>import</scope>
-               </dependency>
-            </dependencies>
-         </dependencyManagement>
-      </profile>
-   </profiles>
-</project>
+</project>
@@ -1,75 +0,0 @@
-/*
- * QQQ - Low-code Application Framework for Engineers.
- * Copyright (C) 2021-2025.  Kingsrook, LLC
- * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
- * contact@kingsrook.com
- * https://github.com/Kingsrook/
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package com.kingsrook.qbits.email;
-
-
-import java.util.List;
-import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
-import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitConfig;
-import com.kingsrook.qqq.backend.core.utils.StringUtils;
-
-
-/*******************************************************************************
- ** Configuration for the email qbit. See docs/DESIGN.md.
- *******************************************************************************/
-public class EmailQBitConfig implements QBitConfig
-{
-   private String backendName;
-
-
-
-   /*******************************************************************************
-    ** Validate the configuration against the instance.
-    *******************************************************************************/
-   @Override
-   public void validate(QInstance qInstance, List<String> errors)
-   {
-      if(!StringUtils.hasContent(backendName))
-      {
-         errors.add("EmailQBitConfig: backendName is required");
-      }
-      else if(qInstance.getBackend(backendName) == null)
-      {
-         errors.add("EmailQBitConfig: backend not found: " + backendName);
-      }
-   }
-
-
-
-   /*******************************************************************************
-    ** Getter for backendName
-    *******************************************************************************/
-   public String getBackendName()
-   {
-      return (backendName);
-   }
-
-
-
-   /*******************************************************************************
-    ** Fluent setter for backendName
-    *******************************************************************************/
-   public EmailQBitConfig withBackendName(String backendName)
-   {
-      this.backendName = backendName;
-      return (this);
-   }
-}
@@ -1,130 +0,0 @@
-/*
- * QQQ - Low-code Application Framework for Engineers.
- * Copyright (C) 2021-2025.  Kingsrook, LLC
- * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
- * contact@kingsrook.com
- * https://github.com/Kingsrook/
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package com.kingsrook.qbits.email;
-
-
-import java.util.ArrayList;
-import java.util.List;
-import com.kingsrook.qqq.backend.core.exceptions.QException;
-import com.kingsrook.qqq.backend.core.model.metadata.MetaDataProducerMultiOutput;
-import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
-import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitMetaData;
-import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitMetaDataProducer;
-
-
-/*******************************************************************************
- ** Entry point of the email qbit (scaffold: the tables, providers and app
- ** arrive in phase (a), see docs/DESIGN.md).
- *******************************************************************************/
-public class EmailQBitProducer implements QBitMetaDataProducer<EmailQBitConfig>
-{
-   public static final String GROUP_ID    = "com.kingsrook.qbits";
-   public static final String ARTIFACT_ID = "qbit-email";
-   public static final String VERSION     = "0.1.0";
-
-   private EmailQBitConfig qBitConfig;
-   private String          namespace;
-
-
-
-   /*******************************************************************************
-    ** Fluent setter for the config.
-    *******************************************************************************/
-   public EmailQBitProducer withQBitConfig(EmailQBitConfig config)
-   {
-      this.qBitConfig = config;
-      return (this);
-   }
-
-
-
-   /*******************************************************************************
-    ** Getter for the config.
-    *******************************************************************************/
-   @Override
-   public EmailQBitConfig getQBitConfig()
-   {
-      return (qBitConfig);
-   }
-
-
-
-   /*******************************************************************************
-    ** Fluent setter for the namespace.
-    *******************************************************************************/
-   public EmailQBitProducer withNamespace(String namespace)
-   {
-      this.namespace = namespace;
-      return (this);
-   }
-
-
-
-   /*******************************************************************************
-    ** Getter for the namespace.
-    *******************************************************************************/
-   @Override
-   public String getNamespace()
-   {
-      return (namespace);
-   }
-
-
-
-   /*******************************************************************************
-    ** Identity.
-    *******************************************************************************/
-   @Override
-   public QBitMetaData getQBitMetaData()
-   {
-      return (new QBitMetaData().withGroupId(GROUP_ID).withArtifactId(ARTIFACT_ID).withVersion(VERSION).withNamespace(namespace).withConfig(qBitConfig));
-   }
-
-
-
-   /*******************************************************************************
-    ** Package-scanned producers have no config: skip them.
-    *******************************************************************************/
-   @Override
-   public boolean isEnabled()
-   {
-      return (qBitConfig != null);
-   }
-
-
-
-   /*******************************************************************************
-    ** Validate the config and register the qbit (scaffold: the email_ tables,
-    ** providers, processes and app arrive in phase (a), docs/DESIGN.md).
-    *******************************************************************************/
-   @Override
-   public MetaDataProducerMultiOutput produce(QInstance qInstance) throws QException
-   {
-      List<String> errors = new ArrayList<>();
-      qBitConfig.validate(qInstance, errors);
-      if(!errors.isEmpty())
-      {
-         throw (new QException("Email qbit configuration is invalid: " + String.join("; ", errors)));
-      }
-      qInstance.addQBit(getQBitMetaData());
-      return (new MetaDataProducerMultiOutput());
-   }
-}
@@ -0,0 +1,75 @@
+/*******************************************************************************
+ ** Configuration for the Example Extension QBit.
+ *******************************************************************************/
+package com.kingsrook.qbits.example;
+
+import java.util.List;
+
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitConfig;
+
+
+/*******************************************************************************
+ ** Configuration class for the Example Extension QBit.
+ *******************************************************************************/
+public class ExampleExtensionQBitConfig implements QBitConfig
+{
+   private String  targetTableName;
+   private Boolean enableFeatureX = true;
+
+
+
+   /*******************************************************************************
+    ** Validate configuration before QBit is produced.
+    *******************************************************************************/
+   @Override
+   public void validate(QInstance qInstance, List<String> errors)
+   {
+      if(targetTableName != null && qInstance.getTable(targetTableName) == null)
+      {
+         errors.add("Target table not found: " + targetTableName);
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for targetTableName
+    *******************************************************************************/
+   public String getTargetTableName()
+   {
+      return targetTableName;
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for targetTableName
+    *******************************************************************************/
+   public ExampleExtensionQBitConfig withTargetTableName(String targetTableName)
+   {
+      this.targetTableName = targetTableName;
+      return this;
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for enableFeatureX
+    *******************************************************************************/
+   public Boolean getEnableFeatureX()
+   {
+      return enableFeatureX;
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for enableFeatureX
+    *******************************************************************************/
+   public ExampleExtensionQBitConfig withEnableFeatureX(Boolean enableFeatureX)
+   {
+      this.enableFeatureX = enableFeatureX;
+      return this;
+   }
+}
@@ -0,0 +1,66 @@
+/*******************************************************************************
+ ** Producer for the Example Extension QBit.
+ *******************************************************************************/
+package com.kingsrook.qbits.example;
+
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitProducer;
+
+
+/*******************************************************************************
+ ** Producer class for the Example Extension QBit.
+ *******************************************************************************/
+public class ExampleExtensionQBitProducer implements QBitProducer
+{
+   public static final String GROUP_ID    = "com.kingsrook.qbits";
+   public static final String ARTIFACT_ID = "qbit-example-extension";
+   public static final String VERSION     = "0.1.0";
+
+   private ExampleExtensionQBitConfig config;
+
+
+
+   /*******************************************************************************
+    ** Produce this QBit into the given QInstance.
+    *******************************************************************************/
+   @Override
+   public void produce(QInstance qInstance, String namespace) throws QException
+   {
+      QBitMetaData qBitMetaData = new QBitMetaData()
+         .withGroupId(GROUP_ID)
+         .withArtifactId(ARTIFACT_ID)
+         .withVersion(VERSION)
+         .withNamespace(namespace)
+         .withConfig(config);
+
+      qInstance.addQBit(qBitMetaData);
+
+      if(config != null && config.getTargetTableName() != null)
+      {
+         applyTableCustomizations(qInstance, config.getTargetTableName());
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** Apply customizations to the target table.
+    *******************************************************************************/
+   private void applyTableCustomizations(QInstance qInstance, String tableName)
+   {
+      // Implement your extension logic here
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for config
+    *******************************************************************************/
+   public ExampleExtensionQBitProducer withConfig(ExampleExtensionQBitConfig config)
+   {
+      this.config = config;
+      return this;
+   }
+}
@@ -0,0 +1,23 @@
+/*******************************************************************************
+ ** Example table customizer.
+ *******************************************************************************/
+package com.kingsrook.qbits.example.customizers;
+
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+
+
+/*******************************************************************************
+ ** Example table customizer that adds behavior to existing tables.
+ *******************************************************************************/
+public class ExampleTableCustomizer
+{
+
+   /*******************************************************************************
+    ** Apply customizations to the given table.
+    *******************************************************************************/
+   public void customize(QTableMetaData table)
+   {
+      // Example: Add audit tracking fields
+      // table.withField(new QFieldMetaData("createdAt", QFieldType.DATE_TIME));
+   }
+}
@@ -1,69 +0,0 @@
-/*
- * QQQ - Low-code Application Framework for Engineers.
- * Copyright (C) 2021-2025.  Kingsrook, LLC
- * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
- * contact@kingsrook.com
- * https://github.com/Kingsrook/
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package com.kingsrook.qbits.email;
-
-
-import com.kingsrook.qqq.backend.core.exceptions.QException;
-import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
-import com.kingsrook.qqq.backend.core.model.metadata.QBackendMetaData;
-import org.junit.jupiter.api.Test;
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.assertj.core.api.Assertions.assertThatThrownBy;
-
-
-/*******************************************************************************
- ** Scaffold checks for the producer and config.
- *******************************************************************************/
-class EmailQBitProducerTest
-{
-   /*******************************************************************************
-    ** A valid config registers the qbit.
-    *******************************************************************************/
-   @Test
-   void producesWithValidConfig() throws Exception
-   {
-      QInstance instance = new QInstance();
-      instance.addBackend(new QBackendMetaData().withName("memory"));
-      EmailQBitProducer producer = new EmailQBitProducer()
-         .withNamespace(null)
-         .withQBitConfig(new EmailQBitConfig().withBackendName("memory"));
-      assertThat(producer.isEnabled()).isTrue();
-      assertThat(producer.getNamespace()).isNull();
-      assertThat(producer.getQBitConfig().getBackendName()).isEqualTo("memory");
-      assertThat(producer.produce(instance)).isNotNull();
-      assertThat(instance.getQBits()).isNotEmpty();
-   }
-
-
-
-   /*******************************************************************************
-    ** A missing or unknown backend is refused; no config means disabled.
-    *******************************************************************************/
-   @Test
-   void refusesInvalidConfig()
-   {
-      assertThat(new EmailQBitProducer().isEnabled()).isFalse();
-      assertThatThrownBy(() -> new EmailQBitProducer().withQBitConfig(new EmailQBitConfig()).produce(new QInstance()))
-         .isInstanceOf(QException.class).hasMessageContaining("backendName is required");
-      assertThatThrownBy(() -> new EmailQBitProducer().withQBitConfig(new EmailQBitConfig().withBackendName("nope")).produce(new QInstance()))
-         .isInstanceOf(QException.class).hasMessageContaining("backend not found");
-   }
-}
Author	SHA1	Message	Date
forge-recovery	f8699ba7f2	ci: enroll shared Gitea lifecycle qrun-release / postpublish (push) Skipped Details QRun-IO/ci-policy: ci / fork-guard (push) Skipped Details QRun-IO/ci-policy: ci / head-profile (push) Skipped Details QRun-IO/ci-policy: ci / application-template-0 (push) Skipped Details QRun-IO/ci-policy: ci / gradle-1 (push) Skipped Details QRun-IO/ci-policy: ci / java-docker-4 (push) Skipped Details QRun-IO/ci-policy: ci / java-frontend-browser-5 (push) Skipped Details QRun-IO/ci-policy: ci / java-maven-6 (push) Skipped Details QRun-IO/ci-policy: ci / java-maven-7 (push) Skipped Details QRun-IO/ci-policy: ci / node-8 (push) Skipped Details QRun-IO/ci-policy: ci / node-9 (push) Skipped Details QRun-IO/ci-policy: ci / node-10 (push) Skipped Details QRun-IO/ci-policy: ci / node-playwright-11 (push) Skipped Details QRun-IO/ci-policy: ci / repository-policy-12 (push) Skipped Details QRun-IO/ci-policy: ci / source-config-13 (push) Skipped Details QRun-IO/ci-policy: ci / source-config-14 (push) Skipped Details QRun-IO/ci-policy: ci / not-enrolled (push) Skipped Details QRun-IO/ci-policy: native / fork-deny (push) Skipped Details QRun-IO/ci-policy: native / dotnet-0 (push) Skipped Details Shared Java Maven CI with Docker / secrets (push) Successful in 11s Details QRun-IO/ci-policy: Shared Java Maven CI with Docker / secrets (push) Successful in 10s Details QRun-IO/ci-policy: ci / repository-policy (push) Skipped Details QRun-IO/ci-policy: ci / java-core-2-head (push) Skipped Details QRun-IO/ci-policy: ci / java-docker-3-head (push) Skipped Details QRun-IO/ci-policy: ci / java-maven-6-head (push) Skipped Details QRun-IO/ci-policy: ci / java-maven-7-head (push) Skipped Details QRun-IO/ci-policy: native / native-result (push) Successful in 5s Details Shared Java Maven CI with Docker / verify (push) Successful in 48s Details Shared Java Maven CI with Docker / gate (push) Successful in 11s Details qrun-release / release (push) Successful in 1h56m34s Details QRun-IO/ci-policy: Shared Java Maven CI with Docker / verify (push) Successful in 1m0s Details QRun-IO/ci-policy: Shared Java Maven CI with Docker / gate (push) Successful in 15s Details QRun-IO/ci-policy: ci / java-docker-3 (push) Successful in 1h57m40s Details QRun-IO/ci-policy: ci / ci-result (push) Successful in 6s Details	2026-11-02 18:58:37 +00:00
forge-recovery Claude Sonnet 5.5 Codex	ab8358a41f	ci: add the isolated postpublish job to the QRun release caller QRun-IO/ci-policy: ci / fork-guard (pull_request) Skipped Details QRun-IO/ci-policy: ci / head-profile (pull_request) Skipped Details QRun-IO/ci-policy: ci / application-template-0 (pull_request) Skipped Details QRun-IO/ci-policy: ci / gradle-1 (pull_request) Skipped Details QRun-IO/ci-policy: ci / java-docker-4 (pull_request) Skipped Details QRun-IO/ci-policy: ci / java-frontend-browser-5 (pull_request) Skipped Details QRun-IO/ci-policy: ci / java-maven-6 (pull_request) Skipped Details QRun-IO/ci-policy: ci / java-maven-7 (pull_request) Skipped Details QRun-IO/ci-policy: ci / node-8 (pull_request) Skipped Details QRun-IO/ci-policy: ci / node-9 (pull_request) Skipped Details QRun-IO/ci-policy: ci / node-10 (pull_request) Skipped Details QRun-IO/ci-policy: ci / node-playwright-11 (pull_request) Skipped Details QRun-IO/ci-policy: ci / repository-policy-12 (pull_request) Skipped Details QRun-IO/ci-policy: ci / source-config-13 (pull_request) Skipped Details QRun-IO/ci-policy: ci / source-config-14 (pull_request) Skipped Details QRun-IO/ci-policy: ci / not-enrolled (pull_request) Skipped Details QRun-IO/ci-policy: native / fork-deny (pull_request) Skipped Details QRun-IO/ci-policy: native / dotnet-0 (pull_request) Skipped Details Shared Java Maven CI with Docker / secrets (push) Successful in 13s Details QRun-IO/ci-policy: Shared Java Maven CI with Docker / secrets (pull_request) Successful in 11s Details QRun-IO/ci-policy: ci / repository-policy (pull_request) Skipped Details QRun-IO/ci-policy: ci / java-core-2-head (pull_request) Skipped Details QRun-IO/ci-policy: ci / java-docker-3-head (pull_request) Skipped Details QRun-IO/ci-policy: ci / java-maven-6-head (pull_request) Skipped Details QRun-IO/ci-policy: ci / java-maven-7-head (pull_request) Skipped Details QRun-IO/ci-policy: native / native-result (pull_request) Successful in 8s Details Shared Java Maven CI with Docker / gate (push) Canceled after 0s Details Shared Java Maven CI with Docker / verify (push) Canceled after 0s Details qrun-release / release (push) Canceled after 2h37m39s Details qrun-release / postpublish (push) Canceled after 0s Details QRun-IO/ci-policy: Shared Java Maven CI with Docker / verify (pull_request) Successful in 40s Details QRun-IO/ci-policy: Shared Java Maven CI with Docker / gate (pull_request) Successful in 10s Details QRun-IO/ci-policy: ci / java-docker-3 (pull_request) Successful in 2h55m52s Details QRun-IO/ci-policy: ci / ci-result (pull_request) Successful in 4s Details Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Co-Authored-By: Codex <noreply@openai.com>	2026-11-02 15:49:21 +00:00
forge-recovery Claude Sonnet 5.5 Codex	d15c4e0ef9	ci: move the QRun release caller to the thin v2 contract Shared Java Maven CI with Docker / gate (push) Canceled after 0s Details QRun-IO/ci-policy: ci / fork-guard (pull_request) Skipped Details QRun-IO/ci-policy: ci / application-template-0 (pull_request) Skipped Details QRun-IO/ci-policy: ci / gradle-1 (pull_request) Skipped Details QRun-IO/ci-policy: ci / java-frontend-browser-3 (pull_request) Skipped Details QRun-IO/ci-policy: ci / java-maven-4 (pull_request) Skipped Details QRun-IO/ci-policy: ci / node-5 (pull_request) Skipped Details QRun-IO/ci-policy: ci / node-6 (pull_request) Skipped Details QRun-IO/ci-policy: ci / node-7 (pull_request) Skipped Details QRun-IO/ci-policy: ci / node-playwright-8 (pull_request) Skipped Details QRun-IO/ci-policy: ci / source-config-9 (pull_request) Skipped Details QRun-IO/ci-policy: ci / not-enrolled (pull_request) Skipped Details QRun-IO/ci-policy: native / fork-deny (pull_request) Skipped Details QRun-IO/ci-policy: native / dotnet-0 (pull_request) Skipped Details QRun-IO/ci-policy: ci / ci-result (pull_request) Failing after 4s Details Shared Java Maven CI with Docker / secrets (push) Successful in 14s Details QRun-IO/ci-policy: Shared Java Maven CI with Docker / secrets (pull_request) Successful in 19s Details QRun-IO/ci-policy: native / native-result (pull_request) Successful in 8s Details QRun-IO/ci-policy: Shared Java Maven CI with Docker / gate (pull_request) Canceled after 0s Details QRun-IO/ci-policy: Shared Java Maven CI with Docker / verify (pull_request) Canceled after 0s Details QRun-IO/ci-policy: ci / java-docker-2 (pull_request) Canceled after 1h2m58s Details Shared Java Maven CI with Docker / verify (push) Canceled after 0s Details qrun-release / release (push) Canceled after 1h3m13s Details Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Co-Authored-By: Codex <noreply@openai.com>	2026-11-02 06:18:13 +00:00
forge-recoveryandCodex	e0b18a6c18	ci: add the identical QRun release caller QRun-IO/ci-policy: Shared Java Maven CI with Docker / verify (pull_request) Failing after 41s Details QRun-IO/ci-policy: Shared Java Maven CI with Docker / gate (pull_request) Failing after 10s Details QRun-IO/ci-policy: ci / java-docker-2 (pull_request) Failing after 53m18s Details QRun-IO/ci-policy: ci / ci-result (pull_request) Failing after 4s Details QRun-IO/ci-policy: ci / fork-guard (pull_request) Skipped Details QRun-IO/ci-policy: ci / application-template-0 (pull_request) Skipped Details QRun-IO/ci-policy: ci / gradle-1 (pull_request) Skipped Details QRun-IO/ci-policy: ci / java-frontend-browser-3 (pull_request) Skipped Details QRun-IO/ci-policy: ci / java-maven-4 (pull_request) Skipped Details QRun-IO/ci-policy: ci / node-5 (pull_request) Skipped Details QRun-IO/ci-policy: ci / node-6 (pull_request) Skipped Details QRun-IO/ci-policy: ci / node-playwright-7 (pull_request) Skipped Details QRun-IO/ci-policy: ci / source-config-8 (pull_request) Skipped Details QRun-IO/ci-policy: ci / not-enrolled (pull_request) Skipped Details QRun-IO/ci-policy: Shared Java Maven CI with Docker / secrets (pull_request) Successful in 14s Details Co-Authored-By: Codex <noreply@openai.com>	2026-11-02 04:11:07 +00:00
james.maesandCodex	58f1bf17ab	ci: enroll in the shared QQQ orb (#42 ) Co-authored-by: Codex <noreply@openai.com>	2026-10-21 19:52:13 -05:00
james.maesandCodex	cf47a9fd89	ci: use the shared orb pipeline on main (#36 ) * ci: use the shared orb pipeline on main Co-Authored-By: Codex <noreply@openai.com> * ci: use the shared branch-aware CodeQL worker Co-Authored-By: Codex <noreply@openai.com> --------- Co-authored-by: Codex <noreply@openai.com>	2026-10-21 10:18:10 -05:00