qbit-mobile-scanners/docs/PRODUCTION-READINESS.md

Production readiness

Status (2026-11-05): not released as production 1.0. The local demo works and is accepted by the operator; the gates below decide whether the project can be called production-ready. This is a checklist, not a score. The detailed evidence ledger, with per-gate tables and the architecture review findings A1–A11, is archived in history; present status is in session state.

Delivered and verified

Area	Evidence (see session state for revisions and counts)
Server source and development publication	PR 19 merged as 9e8685f, including record/photo UX support and earlier PR 17/18 changes; the storage/recovery patch is based on that source. Earlier PR 12 snapshot 0.1.0-20261103.233448-3645 was read back anonymously and matched its reviewed source.
Android host libraries	Published development libraries from source 0ae2101: SDK run 3634 passed and artifacts verified. The scanner application's newer source and signed candidate are recorded below.
Current cohort tests	Combined five-module verify (2026-11-05): 196 server tests (53 / 8 / 22 / 74 / 39), zero failures, errors and skips, zero Checkstyle violations, with qualified private owner dependencies. Android 232 unit tests and lint pass. Inherited report-only guardrail findings remain visible.
Storage integrity and recovery	PrivateObjectFilesTest concurrent-writer and dot-bucket regressions; EchoDemoAcceptanceTest.restoredSnapshotKeepsScanAndRetainedFileAndRevertedApprovalStateIsReaudited is the isolated local-demo recovery acceptance (stopped H2 plus object snapshot/restore, RecordFilesTables.FILE relationship and byte hashes). See operations.
Local runtime	One server using the tested development aggregate: public QQQ SNAPSHOT, current Collaboration, scoped local Record Files and qualified document inputs, plus Printing 1.0.0. API 1.10, mobile 1.5, printing 2.3, mobile-record-files 1.0; existing data preserved. Final immutable public-cohort qualification remains open.
Device and admin processes	Enrollment, approval and revocation work from a single record and from bulk selection (checked rows, select-all, first N), with confirmation and visible results, covered by HTTP and browser E2E tests. Earlier browser run: 15 cases.
Approved-scanner photos	Host-only quarantineCapturedFiles=false makes an approved device's captured JPEG/PNG AVAILABLE; other intake stays QUARANTINED. record-files.release is admin-only. Root-reported: 69 owner and 197 scanner/Echo tests passed, 13 focused Android tests passed, Checkstyle passed. A synthetic gallery PNG from the signed MC9400 app was AVAILABLE with exact parent/type/size/SHA-256. No camera-hardware or new full-preview proof. Depends on the unmerged Record Files owner PR 1.
Hardware	TC22 manual tests: operator-reported pass on November 4 (no per-case artifacts). MC9400 physical trigger done: Saved scan with backend EMDK CODE128/AIM/raw bytes and attribution confirmed (the barcode was not the requested literal).

Open gates

The maintained server and existing TC22 app now run the GS1, rich test-data and record UX changes. Actions → Add photo, grouped/related records, search/filter/Back state and the saved-photo gallery are implemented and verified by isolated native acceptance plus an actual TC22 visual pass. Existing data and enrollment were preserved. See current evidence. This supersedes the earlier undeployed status; physical GS1 print/rescan and signed-build production deployment remain open. The user authorized the final release, signing and publication for this bounded goal; Android PR 15 (c782aaaaba3f62422232436a9000af9d4b38fc82) merged after all CI.

Gate	What is still required
Public dependency cohort	Public, coherent Generation/bridges/Record Files/Scripting artifacts from their owner; adoption of the Core/Collaboration/Next UI foundations when released. Today these are qualified owner inputs, and the current local aggregate uses public Core SNAPSHOT, current Collaboration and a local Record Files change, not a final public cohort.
Release	Retest the full gate when the final public dependency cohort is adopted, with a reviewed release manifest; Maven publication stays disabled until then. Redesign of the shared CI pipeline is outside this scope.
Signing and distribution	Done: QRun key with backup, signed Android 1.0.1 (code 3) built from the merged PR 15 source tree and installed in place on an MC9400 (installed bytes match; login/enrollment preserved; Scan Capture reopened; HTTPS connected). Open: public dependencies, signing-APK download publication and final distribution. No signing CI.
Deployment	HTTPS and the host's identity provider. Single-instance procedure, recovery and default-indefinite, host-owned retention guidance is in operations; isolated local-demo recovery acceptance has passed. Enterprise object-store/HA and non-H2 databases are unsupported and unqualified options, not release tasks. The HTTP loopback demo is not a production deployment.
Provider authentication	Native OAuth2 requires UI API 1.10 native-session and nonce-validation support on the server (verified in the Android source). Shared Authenticator server configuration is verified (trusted HTTPS, API 1.10, scanner and printing extensions and channels, exact callbacks, REQUIRED nonce). Still open: native Authentik login, logout and account switching on a handheld (needs the MC9400 wireless-debugging endpoint). No native-auth pass is claimed. The Printing client nonce fix (PR 11, 443f642; 352 tests and build passed) awaits hosted Core.
Further device qualification	MDM-applied managed configuration remain unverified. Company profile/wallpaper is separate tracked scope, not a blocker for this release goal. The TC22 camera, GPS and screen-viewing checks are covered by the accepted operator group report; no separate per-case evidence is claimed or required again for that demo.
Barcode fidelity	Echo's supported profiles are documented (limits); The committed source supports bounded GS1-128; physical print/rescan remains open. Other GS1, ECI, structured and binary profiles remain refused. No universal barcode-reproduction claim.
Final reviews	Reconcile the dated security, architecture and standards reports to the final revision; they are scoped historical reviews, not a fresh exhaustive scan. A dated static review of base a9eae04, its supplement and its scope and limits are in review reconciliation; it is not an audit rating.

Rules that stay in force

• Do not describe a passing build, an emulator run or a demo as production acceptance.
• Never reset or overwrite the user's demo or scanner data to run a test; use isolated accounts, databases and application IDs.
• Keep device credentials, passwords, device identifiers and workstation paths out of the repository.