Add strict Python and checked JavaScript tooling, explicit source-scope
checks and real rejection probes to CI. Preserve existing runtime
behavior and document the limited bundle and test portability changes.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Codex GPT-6 <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Preserve the rendering changes from main while assigning operator,
media and retained-source support to printing 2.3. Wait for channel
workers before stopping the host so they cannot recreate a closed store.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
Add current-user printer media catalog, stable request recovery and atomic retained-source acceptance. Recheck native authority through admission and commit, bind history to the accepted printer record, and gate selected media on the current client capability.
Co-Authored-By: Codex GPT-6 <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Reuse production Core strict discovery and the shared printing-major-2 gate while retaining the exact experimental API 1.9/native-session requirement. Add build-time fake-HTTP boundary cases without changing PKCE, TLS, provider or permission handling.
The old native gate fails compatible 2.1.0; the fix passes 12 native and nine default discovery cases with zero compiler warnings/errors. One fresh current-source Docker provider run passes all eight checks with verified owned cleanup. Preserve unreleased-upstream and installed-browser limitations; no live runtime or physical printing changes.
Signed-off-by: James Maes <james@kof22.com>
Co-authored-by: Codex (GPT-6) <noreply@openai.com>
Record protected PR21 publication and passing hosted Docker, script and Java results. Keep the experimental upstream candidate distinct from released-runtime adoption and the unchanged live installation. Both Markdown files and diff checks pass; no runtime changes. Prepared and reviewed with Codex (GPT-6).
Signed-off-by: James Maes <james@kof22.com>
Co-authored-by: Codex (GPT-6) <noreply@openai.com>
* feat(dev): add isolated Docker printing and provider qualification
Provide owned local QQQ, MinIO and optional Authentik development fixtures with pinned inputs, protected synthetic state and ownership-checked cleanup. Exercise real Core/Java WebSocket jobs, S3 retention/isolation and opt-in native PKCE/provider renewal and revocation. Add cross-platform script gates and hosted Docker smoke CI.
Include the opt-in 10000-job pooled-SQL/reopen regression and scoped evidence. The experimental API1.9 source remains explicitly unreleased and separate from the released runtime dependency set.
Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
* fix(dev): report early workload failures before server waiting
Preserve bounded client diagnostics privately and emit only allowlisted stage and exception classifications. Early failed clients no longer hide behind the server completion timeout; ownership-checked cleanup remains in finally.
Five actual-entrypoint regression cases pass; all33script tests and parser/analyzer checks pass. This exposes the still-unknown hosted client failure without changing production behavior.
Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
* fix(dev): accept compatible realtime printing API minor versions
Use production Core discovery's strict stable SemVer validation and the realtime major2 compatibility gate instead of requiring exactly2.0.0. Protected main now advertises compatible2.1.0; the old fixture rejected it before login.
Pinned-Core build reproduced2.1.0 rejection before the fix and passes all9positive/negative HTTP discovery cases after it. Docker builds run these checks. No production client, server, dependency or runtime change.
Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
---------
Signed-off-by: James Maes <james@kof22.com>
Co-authored-by: Codex (GPT-6) <noreply@openai.com>
Prepare0.3.0-rc.1 notes for native printingAPI2.0, outbound realtime delivery
and coordinated server-first upgrade. Pin the merged protocol contract and
preserve the distinction between source/release and installed acceptance.
Validation: changedMarkdown, diff and actionlint checks pass. Application,
schema and test behavior are unchanged.
Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Use signed protocol df3729ac632d4a34a3fb8423acef465042a624fc for
reproducible consumer checks and record the successful final API 2 cross-runtime
qualification. The deployed 0.2 package remains unchanged.
Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Advertise native printing API 2.0.0 because mandatory synchronized WebSocket
claims are incompatible with the published HTTP-only native API. Keep the
framework path and wire envelope unchanged. Derive dashboard freshness from
the configured heartbeat timeout and record authorized control-channel liveness.
Validation: final Maven verify passed118 tests with zero Checkstyle violations.
Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Replace native job/control polling with client-initiated WebSockets, durable
state and receipt reconciliation, independent verified document streams and
native administrator settings for transfer, connection and admission limits.
Preserve QQQ current-user authorization and device binding on every operation.
Validation: Maven verify passes 117 tests with zero Checkstyle violations;
OpenAPI generation/check and diff checks pass. Consumer CI pins protocol
67be986cb76d6b5d9a9f72cad054193b0d11b0d5. Installation is separate.
Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Reject bound device tokens on every legacy device route. Native proof verification
continues through standard QQQ sessions and current user permissions. Disable
legacy enrollment by default and explicitly in the native host; legacy-only demo
and fixtures opt in, preserving eligible unbound-device migration.
Validation: 110 Java tests pass with zero failures/errors/skips and zero Checkstyle.
Actual native-bind HTTP regressions reject bearer-only claim/content/queue/control;
legacy enrollment denial preserves the code for successful native enrollment.
Independent review found no remaining blocker. No schema or dependency changes.
Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Record verified RC20 behavior: OAuth2 caching defaults off and reruns supported
host authorization hooks; explicitly cached sessions require normal invalidation
or a qualified freshness policy. Table-based sessions reread user rows but do
not automatically interpret arbitrary enabled fields.
Validation: exact frozen source and a10-check synthetic reproduction. No product
code or provider/runtime configuration changes. Long-lived provider renewal and
configured native grants remain deployment qualifications.
Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Wrap standard extraction with explicit current-user enforcement after callbacks,
and authorize preview counts before the standard tenant-filtered count. Apply
the wrapper to all14 printing selection processes so trusted internal defaults
cannot skip table policies before Transform/Load checks.
Validation:109 Java tests pass with zero failures/errors/skips and zero
Checkstyle. New regressions exercise count/query denial, callback weakening,
selected/filter tenant isolation and process registrations. Native API classes
remain byte-identical to the23-check real client/server interop artifact.
Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Align installation examples and acceptance notes with the verified release.
Keep physical-output and production deployment qualification limits explicit.
Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Preserve the official artwork aspect ratio in every PDF and thermal profile.
Record provenance and the completed local test and installed-client acceptance.
Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Record the approved H2 exception, passing complete CI and exact artifact
comparison, verified recovery/cold-copy checks, and the state-preserving
local native QQQ cutover. Keep remote S3 and physical-output limits explicit.
Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Reference merged standards EX-0013 while preserving the required reviewed-version inventory guard and every other license and vulnerability check.
Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Bind external print documents to the reviewed native S3 key layout and separator. Serialize destination components as ordered JSON so valid multiline prefixes cannot collide. Refuse incompatible reads, retries and cleanup while preserving content availability and retained-byte accounting; validate new retries before upload reservation and keep existing retry receipts and inline documents compatible.
Validation: isolated Java 21 verify passes 72 tests and zero Checkstyle violations. The multiline-prefix regression fails before the fix; independent review found no remaining issue. Actual Windows-to-Linux S3 qualification returns 409 before read/retry/cleanup IO, preserves the exact object and counters, and records zero transmissions with a positive-control observer. Five documentation files pass Markdown lint. Fresh hosted checks and the existing H2 metadata approval remain pending.
Co-authored-by: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Use standard Maven resources to include root LICENSE and NOTICE under META-INF while retaining existing runtime assets. No implementation or dependency changes.
Validation: isolated frontend-profile verify passes 67 tests with zero Checkstyle violations. JAR inspection verifies exact notice bytes, all 38 implementation classes unchanged, font/license/logo resources retained, and unchanged dependency declarations. Independent review found no issue.
Co-authored-by: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Require the reviewed H2 runtime in the selected Maven inventory and reject absent or different versions. Record unchanged H2 licensing and exact-artifact native cold-restart acceptance while keeping the central license exception and live deployment pending.
Validation: 11 inventory guard tests and 6 SARIF guard tests pass; workflow lint and independent review passed. Production Java remains the verified 67-test H2-fixed candidate.
Co-authored-by: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Pin H2 2.4.240 for upstream compaction data loss. A closed legacy fixture lost newly created audit tables after reopening with 2.3.232; replacing only the driver preserves them. Add cold-reopen durability coverage and document backup/runtime qualification. Full isolated verification passes 67 tests and all 204 dependency inventories agree.
Co-authored-by: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Claim and cancel could complete before reading valid JSON, causing Jetty to close the persistent connection before a subsequent status event. Consume the bounded body after authentication. A split-body HTTP regression fails before this change; full isolated UI-profile verification passes 66 tests and Checkstyle.
Co-authored-by: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Resolve the selected UI profile once into a Maven CycloneDX graph and fail closed when Trivy or OSV omits packages or returns malformed evidence. Keep existing vulnerability and malicious-package gates.
Co-authored-by: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Use native table authentication and scheduling with preserved paired H2 data, tenant authorization and strict browser-origin checks. Verify both H2 identifier conventions and account/session boundaries.
Co-authored-by: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Add native QQQ record and table retry/cancel processes plus device test-print, retry, queued listing and cancellation endpoints. Verify with 19 Java tests and zero Checkstyle violations.
Co-authored-by: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Provide durable jobs, enrollment, tenant-scoped printer selectors and record actions, operational home widgets, protocol integration, and release automation.
Co-authored-by: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
james.maes
