SessionCredentialsClient is gone: the session token now rides core
S3BackendMetaData.sessionToken, and the presigner takes its credentials from
core S3ClientFactory.buildCredentialsProvider. SecretRefs keeps only the
qbit's allow-list; ${file.PATH} resolution is core QMetaDataVariableInterpreter
(read-only, allowed roots /var/run/secrets and /run/secrets by default).
Tests point qqq.fileReference.roots at their temp dirs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ConnectionRuntime maps StorageConnectionConfig to S3BackendMetaData and
builds clients with core S3ClientFactory.buildClient, which is uncached.
The per-connection cache keyed by the settings hash is unchanged.
The duplicated HTTP, TLS and trust-manager code is deleted.
Still local:
- the presigner;
- a session-credentials bridge, because core has no session-token or
credentials-provider hook;
- ${file.PATH} secret refs.
The last two are tagged STAND-IN(core=QRun-IO/qqq#1165, removeBy=4.1.0-RC.7).
Retries now follow core and SDK defaults instead of a forced ADAPTIVE_V2.
Unused SFTP/SSH transitive dependencies of the filesystem module are
excluded.
Closes#10 (architecture review QRun-IO/qqq#1150, finding F3).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Maven scaffold (qbit-build-parent 2.0.0, com.kingsrook.qbits, <revision>
versioning, qqq 4.1.0-RC.4 BOM, JaCoCo gate), QBit config and producer,
CircleCI qqq-orb pipeline, and the standard repository files.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
james.maesandClaude Opus 5.5