Preserve both pre-cutoff dependency branch histories #19

Merged

forge-recovery merged 42 commits from migration/cutoff-7bedb1016fa9-a854c1 into dependabot/maven/org.apache.maven.plugins-maven-surefire-plugin-3.6.1 2026-11-02 00:31:57 +00:00

Conversation 0 Commits 42 Files Changed 150

+26147 -200

forge-recovery commented 2026-11-02 00:16:18 +00:00

Owner

Copy link

Copy source

Import the existing frozen GitHub branch history into dependabot/maven/org.apache.maven.plugins-maven-surefire-plugin-3.6.1 while retaining the current Gitea work. Exact old source parents: Gitea 68b7f40ff6 and GitHub 7bedb1016f. Original GitHub tip is preserved under refs/heads/archive/qrun-github-cutover-20261101/7bedb1016fa9/dependabot/maven/org.apache.maven.plugins-maven-surefire-plugin-3.6.1. This is a normal history merge on the existing dependency branch, not a new upgrade or default-branch change. No force/prune, CI retirement or release claim. AI-assisted by Codex.

Import the existing frozen GitHub branch history into dependabot/maven/org.apache.maven.plugins-maven-surefire-plugin-3.6.1 while retaining the current Gitea work. Exact old source parents: Gitea 68b7f40ff64e41143813e2bba1cbbfa99c168ded and GitHub 7bedb1016fa97f5a24bb685741b11d316ba0f0f8. Original GitHub tip is preserved under refs/heads/archive/qrun-github-cutover-20261101/7bedb1016fa9/dependabot/maven/org.apache.maven.plugins-maven-surefire-plugin-3.6.1. This is a normal history merge on the existing dependency branch, not a new upgrade or default-branch change. No force/prune, CI retirement or release claim. AI-assisted by Codex.

forge-recovery added 41 commits 2026-11-02 00:16:19 +00:00

docs: record profile and history release verification ... 37f2ccddcb

Co-authored-by: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

feat: add branded warehouse print diagnostics ... a6266fe2bb

Co-authored-by: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

docs: record branded diagnostic verification ... ff4f328781

Co-authored-by: Codex (GPT-6) <noreply@openai.com>

docs: confirm laser and Zebra diagnostic output ... 33148b94d5

Co-authored-by: Codex (GPT-6) <noreply@openai.com>

fix(printing): harden queue and isolate document retention ... 1655d4e811

Co-authored-by: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

ci: reject missing security scan evidence ... 0028bfdfdc

Co-authored-by: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

fix: bound print resource admission and inventory history ... aeac1a6842

Co-authored-by: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

feat: connect authenticated QQQ screens to the local printing host ... 78e09115cb

Use native table authentication and scheduling with preserved paired H2 data, tenant authorization and strict browser-origin checks. Verify both H2 identifier conventions and account/session boundaries.

Co-authored-by: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

ci: verify the complete printing host runtime inventory ... 60ce6e4f93

Resolve the selected UI profile once into a Maven CycloneDX graph and fail closed when Trivy or OSV omits packages or returns malformed evidence. Keep existing vulnerability and malicious-package gates.

Co-authored-by: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

fix: consume device request bodies before queue mutations ... d52dfd722b

Claim and cancel could complete before reading valid JSON, causing Jetty to close the persistent connection before a subsequent status event. Consume the bounded body after authentication. A split-body HTTP regression fails before this change; full isolated UI-profile verification passes 66 tests and Checkstyle.

Co-authored-by: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

fix: use H2 with durable close-time compaction ... fb99fafbbf

Pin H2 2.4.240 for upstream compaction data loss. A closed legacy fixture lost newly created audit tables after reopening with 2.3.232; replacing only the driver preserves them. Add cold-reopen durability coverage and document backup/runtime qualification. Full isolated verification passes 67 tests and all 204 dependency inventories agree.

Co-authored-by: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

fix(ci): constrain reviewed H2 license scope ... d1821bedf2

Require the reviewed H2 runtime in the selected Maven inventory and reject absent or different versions. Record unchanged H2 licensing and exact-artifact native cold-restart acceptance while keeping the central license exception and live deployment pending.

Validation: 11 inventory guard tests and 6 SARIF guard tests pass; workflow lint and independent review passed. Production Java remains the verified 67-test H2-fixed candidate.

Co-authored-by: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

fix(build): package license and attribution notices ... 00dd2dda2d

Use standard Maven resources to include root LICENSE and NOTICE under META-INF while retaining existing runtime assets. No implementation or dependency changes.

Validation: isolated frontend-profile verify passes 67 tests with zero Checkstyle violations. JAR inspection verifies exact notice bytes, all 38 implementation classes unchanged, font/license/logo resources retained, and unchanged dependency declarations. Independent review found no issue.

Co-authored-by: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

fix(storage): preserve documents when S3 key layouts change ... 45261d5508

Bind external print documents to the reviewed native S3 key layout and separator. Serialize destination components as ordered JSON so valid multiline prefixes cannot collide. Refuse incompatible reads, retries and cleanup while preserving content availability and retained-byte accounting; validate new retries before upload reservation and keep existing retry receipts and inline documents compatible.

Validation: isolated Java 21 verify passes 72 tests and zero Checkstyle violations. The multiline-prefix regression fails before the fix; independent review found no remaining issue. Actual Windows-to-Linux S3 qualification returns 409 before read/retry/cleanup IO, preserves the exact object and counters, and records zero transmissions with a positive-control observer. Five documentation files pass Markdown lint. Fresh hosted checks and the existing H2 metadata approval remain pending.

Co-authored-by: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

fix(ci): apply approved H2 license metadata exception ... 09e099501b

Reference merged standards EX-0013 while preserving the required reviewed-version inventory guard and every other license and vulnerability check.

Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

docs(printing): record verified local host deployment ... 31d1bc1cab

Record the approved H2 exception, passing complete CI and exact artifact
comparison, verified recovery/cold-copy checks, and the state-preserving
local native QQQ cutover. Keep remote S3 and physical-output limits explicit.

Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

fix: use official Query mascot on diagnostic prints ... c34883da07

Preserve the official artwork aspect ratio in every PDF and thermal profile.
Record provenance and the completed local test and installed-client acceptance.

Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

Merge pull request #10 from QRun-IO/audit/storage-retention-hardening-20261030 ... 412ffbbca1

fix(printing): harden queue and isolate document retention

docs: update published printing release guidance ... c3e37a548e

Align installation examples and acceptance notes with the verified release.
Keep physical-output and production deployment qualification limits explicit.

Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

Merge pull request #11 from QRun-IO/docs/published-014-20261031 ... 3c1283c05e

docs: update published printing release guidance

feat: add native printing device controls and session authorization ... 3062fc8e84

Add record/selection actions, per-device printers/jobs/queue/history and observed
connection/control status. Persist bounded device actions and immutable receipts,
serialize queue clearing against claims, and cancel only owned Windows jobs.

Register semantic printing extension 1.0.0 with standard QQQ sessions, secondary
bound-device proof, current native table/process/record checks and explicit
permission enforcement. Preserve legacy compatibility without primary fallback.
Pin protocol cc3c4e50e8f6f4fbc93d351fb51edb4f5438bbd3 and prepare 0.2.0-rc.1.

Validation: Java21 verify passes 106 tests with zero failures/errors/skips and
zero Checkstyle. All204 runtime dependency hashes match frozen inputs. Native
HTTP/OpenAPI, authority denial, FIFO eligibility, queue races, selection replay
and offline command expiry covered; cross-runtime/provider/install acceptance
remain separate gates. Independent source review findings are corrected.

Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

fix: enforce native permissions during printing selections ... 3435686e7e

Wrap standard extraction with explicit current-user enforcement after callbacks,
and authorize preview counts before the standard tenant-filtered count. Apply
the wrapper to all14 printing selection processes so trusted internal defaults
cannot skip table policies before Transform/Load checks.

Validation:109 Java tests pass with zero failures/errors/skips and zero
Checkstyle. New regressions exercise count/query denial, callback weakening,
selected/filter tenant isolation and process registrations. Native API classes
remain byte-identical to the23-check real client/server interop artifact.

Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

docs: explain standard QQQ session freshness policy ... 23fccbb326

Record verified RC20 behavior: OAuth2 caching defaults off and reruns supported
host authorization hooks; explicitly cached sessions require normal invalidation
or a qualified freshness policy. Table-based sessions reread user rows but do
not automatically interpret arbitrary enabled fields.

Validation: exact frozen source and a10-check synthetic reproduction. No product
code or provider/runtime configuration changes. Long-lived provider renewal and
configured native grants remain deployment qualifications.

Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

fix: prevent legacy downgrade of native device credentials ... 3b73808650

Reject bound device tokens on every legacy device route. Native proof verification
continues through standard QQQ sessions and current user permissions. Disable
legacy enrollment by default and explicitly in the native host; legacy-only demo
and fixtures opt in, preserving eligible unbound-device migration.

Validation: 110 Java tests pass with zero failures/errors/skips and zero Checkstyle.
Actual native-bind HTTP regressions reject bearer-only claim/content/queue/control;
legacy enrollment denial preserves the code for successful native enrollment.
Independent review found no remaining blocker. No schema or dependency changes.

Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

Merge pull request #12 from QRun-IO/feat/server-device-controls-20261031 ... a5b2cd29a3

feat: add native printing device controls and session authorization

docs: prepare native printing 0.2.0 prerelease ... ad53b69c0f

Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

Merge pull request #13 from QRun-IO/docs/release-020-20261031 ... f6a1402f58

docs: prepare native printing 0.2.0 prerelease

docs: document the published 0.2.0 prerelease ... 696c623b4d

Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

Merge pull request #14 from QRun-IO/docs/published-020-20261031 ... 0199391dfc

docs: document the published 0.2.0 prerelease

feat(printing): add authenticated realtime device transport ... 2ed454301e

Replace native job/control polling with client-initiated WebSockets, durable
state and receipt reconciliation, independent verified document streams and
native administrator settings for transfer, connection and admission limits.
Preserve QQQ current-user authorization and device binding on every operation.

Validation: Maven verify passes 117 tests with zero Checkstyle violations;
OpenAPI generation/check and diff checks pass. Consumer CI pins protocol
67be986cb76d6b5d9a9f72cad054193b0d11b0d5. Installation is separate.

Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

fix(printing): version realtime claims and align connection freshness ... e793b09922

Advertise native printing API 2.0.0 because mandatory synchronized WebSocket
claims are incompatible with the published HTTP-only native API. Keep the
framework path and wire envelope unchanged. Derive dashboard freshness from
the configured heartbeat timeout and record authorized control-channel liveness.

Validation: final Maven verify passed118 tests with zero Checkstyle violations.

Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

chore(ci): pin the verified printing API 2 contract ... 55f4266735

Use signed protocol df3729ac632d4a34a3fb8423acef465042a624fc for
reproducible consumer checks and record the successful final API 2 cross-runtime
qualification. The deployed 0.2 package remains unchanged.

Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

docs(release): finalize coordinated realtime candidate metadata ... 82fc5e5f8a

Prepare0.3.0-rc.1 notes for native printingAPI2.0, outbound realtime delivery
and coordinated server-first upgrade. Pin the merged protocol contract and
preserve the distinction between source/release and installed acceptance.

Validation: changedMarkdown, diff and actionlint checks pass. Application,
schema and test behavior are unchanged.

Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

Merge pull request #16 from QRun-IO/feat/realtime-printing-20261031 ... 2dd1afba41

feat: deliver print work and controls over authenticated WebSockets

feat(printing): print records of host tables as record sheets (#18) ... ea3ba0d698

PrintingRecordProcesses.register(instance, table) adds a Print process per host table: each selected record is rendered as a one-page record sheet and queued as its own PDF job, job ids returned in printingJobIds. Also fixes selection actions whose first step is a form losing the record selection over the UI API (the prepare steps now keep it), which affected the existing test-page action.

Refs QRun-IO/qqq#1366
Signed-off-by: James Maes <jmaes@greatergoods.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

feat(printing): print any table's records, table lists and text pages (#20) ... 2b2ad3346a

PrintingRecordProcesses.registerAll adds Print to every readable table (opt-out per table); record sheets are built from table metadata; printingPrintTableList prints a grid's columns, widths, filter and sort for all rows (1,000 at a time up to 10,000, truncation reported) or the current page with repeated headers and page footers; printingPrintText prints monospace text pages with a shrinking font. Version 0.4.0-SNAPSHOT, extension 2.1.0 (additive). The new processes' inputs are editable so user values are accepted over the UI API.

Refs QRun-IO/qqq#1366
Signed-off-by: James Maes <jmaes@greatergoods.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

feat(dev): add isolated Docker printing and provider qualification (#21) ... 3592decba8

* feat(dev): add isolated Docker printing and provider qualification

Provide owned local QQQ, MinIO and optional Authentik development fixtures with pinned inputs, protected synthetic state and ownership-checked cleanup. Exercise real Core/Java WebSocket jobs, S3 retention/isolation and opt-in native PKCE/provider renewal and revocation. Add cross-platform script gates and hosted Docker smoke CI.

Include the opt-in 10000-job pooled-SQL/reopen regression and scoped evidence. The experimental API1.9 source remains explicitly unreleased and separate from the released runtime dependency set.

Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

* fix(dev): report early workload failures before server waiting

Preserve bounded client diagnostics privately and emit only allowlisted stage and exception classifications. Early failed clients no longer hide behind the server completion timeout; ownership-checked cleanup remains in finally.

Five actual-entrypoint regression cases pass; all33script tests and parser/analyzer checks pass. This exposes the still-unknown hosted client failure without changing production behavior.

Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

* fix(dev): accept compatible realtime printing API minor versions

Use production Core discovery's strict stable SemVer validation and the realtime major2 compatibility gate instead of requiring exactly2.0.0. Protected main now advertises compatible2.1.0; the old fixture rejected it before login.

Pinned-Core build reproduced2.1.0 rejection before the fix and passes all9positive/negative HTTP discovery cases after it. Docker builds run these checks. No production client, server, dependency or runtime change.

Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

---------

Signed-off-by: James Maes <james@kof22.com>
Co-authored-by: Codex (GPT-6) <noreply@openai.com>

docs: record published Docker qualification (#22) ... bfba557b66

Record protected PR21 publication and passing hosted Docker, script and Java results. Keep the experimental upstream candidate distinct from released-runtime adoption and the unchanged live installation. Both Markdown files and diff checks pass; no runtime changes. Prepared and reviewed with Codex (GPT-6).

Signed-off-by: James Maes <james@kof22.com>
Co-authored-by: Codex (GPT-6) <noreply@openai.com>

fix(dev): accept compatible printing discovery in native provider tests (#23) ... 02b922aa11

Reuse production Core strict discovery and the shared printing-major-2 gate while retaining the exact experimental API 1.9/native-session requirement. Add build-time fake-HTTP boundary cases without changing PKCE, TLS, provider or permission handling.

The old native gate fails compatible 2.1.0; the fix passes 12 native and nine default discovery cases with zero compiler warnings/errors. One fresh current-source Docker provider run passes all eight checks with verified owned cleanup. Preserve unreleased-upstream and installed-browser limitations; no live runtime or physical printing changes.

Signed-off-by: James Maes <james@kof22.com>
Co-authored-by: Codex (GPT-6) <noreply@openai.com>

chore: enforce owned source copyright notices (#25) ... 1a0964ef23

* chore(standards): preserve owned-source copyright notices

Add accurate repository copyright and license comments to 50 owned source/build/configuration files. Preserve existing holders, upstream wrappers, legal payloads and schema/data exemptions. Exact inverse-byte reconstruction and applicable parser/token/AST checks prove comment-only changes; existing relevant regressions pass.

Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

* chore: enforce owned source copyright notices

Check real leading comments against explicit repository provenance and retain existing native style gates.

Co-Authored-By: Codex GPT-6 <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

---------

Signed-off-by: James Maes <james@kof22.com>
Co-authored-by: Codex (GPT-6) <noreply@openai.com>

chore(deps-dev): Bump org.apache.maven.plugins:maven-surefire-plugin ... 7bedb1016f

Bumps [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) from 3.5.4 to 3.6.1.
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](https://github.com/apache/maven-surefire/compare/surefire-3.5.4...surefire-3.6.1)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-surefire-plugin
  dependency-version: 3.6.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

james.maes added 1 commit 2026-11-02 00:30:45 +00:00

chore(migration): reconcile printing history for PR19 ... a7530d6612

Preserve both existing source histories and the bot branch plugin version; retain resources and JAR metadata. Only the POM conflict was resolved; no main branch update or CI/release qualification claimed.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

forge-recovery merged commit a1b93c708a into dependabot/maven/org.apache.maven.plugins-maven-surefire-plugin-3.6.1 2026-11-02 00:31:57 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Something isn't working

dependencies

documentation

Improvements or additions to documentation

duplicate

This issue or pull request already exists

enhancement

New feature or request

github_actions

Pull requests that update GitHub Actions code

good first issue

Good for newcomers

help wanted

Extra attention is needed

invalid

This doesn't seem right

java

Pull requests that update java code

question

Further information is requested

secuurity

wontfix

This will not be worked on

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

forge-recovery (Forge Recovery) james.maes (James Maes)

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-printing#19