docs: update shared snapshot publication handoff

Co-Authored-By: Codex <noreply@openai.com>

.circleci/config.yml

@@ -1,16 +1,14 @@
 version: 2.1
 setup: true
 orbs:
-  qqq-orb: kingsrook/qqq-orb@0.7.18
+  qqq-orb: kingsrook/qqq-orb@0.8
 workflows:
   setup:
     jobs:
     - qqq-orb/generate_pipeline:
-        orb_version: 0.7.18
+        orb_version: '0.8'
         filters:
           branches:
             ignore: automation/qbit-rc-pending
           tags:
-            only:
-            - /^v\d+\.\d+\.\d+$/
-            - /publish.*/
+            only: /^v\d+\.\d+\.\d+$/

.github/workflows/codeql.yml

@@ -0,0 +1,23 @@
+name: CodeQL
+'on':
+  push:
+    branches:
+    - main
+    - develop
+    - release/**
+    - hotfix/**
+  pull_request: {}
+  schedule:
+  - cron: 41 16 * * 0
+  workflow_dispatch: {}
+permissions:
+  contents: read
+  actions: read
+  security-events: write
+  packages: read
+concurrency:
+  group: codeql-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+jobs:
+  analyze:
+    uses: QRun-IO/qqq-orb/.github/workflows/qbit-codeql.yml@c288a8864fe9054f68410e1d78f5863aea4c4d22

.github/workflows/release-rc.yml

@@ -0,0 +1,74 @@
+name: Release candidate
+'on':
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: Plan a cut without changing release state
+        type: boolean
+        default: false
+      finalize:
+        description: Retry finalization of an existing cut; do not cut another RC
+        type: boolean
+        default: false
+      recover:
+        description: Recover the same published RC after a deployment timeout; never
+          reupload
+        type: boolean
+        default: false
+      circle_build:
+        description: Original Circle publisher build number (recovery only)
+        type: string
+        default: ''
+      merge_sha:
+        description: Existing cut merge_sha (finalize retry only)
+        type: string
+        default: ''
+      bump_sha:
+        description: Existing cut bump_sha (finalize retry only)
+        type: string
+        default: ''
+      branch:
+        description: Existing cut branch (finalize retry only)
+        type: string
+        default: ''
+      version:
+        description: Existing cut version (finalize retry only)
+        type: string
+        default: ''
+  pull_request:
+    types:
+    - closed
+    branches:
+    - develop
+  repository_dispatch:
+    types:
+    - qbit-rc-published
+permissions:
+  contents: write
+  actions: read
+  checks: read
+jobs:
+  release-rc:
+    if: github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch'
+      || (github.event_name == 'pull_request' && github.event.pull_request.merged
+      == true && github.event.pull_request.base.ref == 'develop' && contains(github.event.pull_request.labels.*.name,
+      'release:rc'))
+    uses: QRun-IO/qqq-orb/.github/workflows/qbit-release-rc.yml@cc30f599e63c8e41629c99d23395bac1adb8bc44
+    with:
+      dry_run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || false
+        }}
+      finalize: ${{ github.event_name == 'repository_dispatch' || (github.event_name
+        == 'workflow_dispatch' && inputs.finalize) }}
+      recover: ${{ github.event_name == 'workflow_dispatch' && inputs.recover || false
+        }}
+      circle_build: ${{ github.event_name == 'workflow_dispatch' && inputs.circle_build
+        || '' }}
+      merge_sha: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.merge_sha
+        || inputs.merge_sha || '' }}
+      bump_sha: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.bump_sha
+        || inputs.bump_sha || '' }}
+      branch: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.branch
+        || inputs.branch || '' }}
+      version: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.version
+        || inputs.version || '' }}
+    secrets: inherit

.qqq-ci.yml

@@ -1,5 +1,5 @@
 profile: qbit
-orb_version: 0.7.18
+orb_version: '0.8'
 default_branch: develop
 java_version: '21'
 browsers: false
@@ -10,7 +10,6 @@ release_tag_policy: stable
 test_branch_policy: non-release
 publish:
   snapshot: true
-  feature: true
   release_candidate: true
   release: true
   asciidoc: false

README.md

@@ -1,10 +1,10 @@
 # QBit Redis
 
 Reusable Redis connections and bounded shared caches for QQQ applications.
-**Coordinated feature snapshot published; not a stable/GA release.** Track
-[QQQ #1295](https://github.com/QRun-IO/qqq/issues/1295) and [completed milestone and follow-ups](docs/TODO.md).
-See [published snapshot](docs/SNAPSHOT-RELEASE.md) for current normal-flow evidence,
-exact compatible versions and the explicitly deferred optional scenarios.
+**Development candidate; not released or production-certified.** Track
+[QQQ #1295](https://github.com/QRun-IO/qqq/issues/1295) and [remaining gates](docs/TODO.md).
+See [snapshot preparation](docs/SNAPSHOT-RELEASE.md) for current normal-flow evidence,
+publication order and the explicitly deferred optional scenarios.
 
 ## Host integration
 

docs/SNAPSHOT-RELEASE.md

@@ -1,35 +1,32 @@
-# Coordinated published snapshot
+# Coordinated candidate snapshot
 
-The main-line milestone is complete. These feature snapshots are published and verified together; this is not a stable/GA release or a production deployment.
+Status, 2026-10-22: source is uploaded, canonical branch CI is verified and enforced, and the required Core snapshot is published. Publication of Redis `0.1.0-SNAPSHOT` through the canonical `develop` pipeline remains to be verified. This is not a production deployment checklist or an RC certification.
 
-| Component | Version |
-| --- | --- |
-| QQQ BOM/modules | `4.1.0-collab-33464d37e-SNAPSHOT` |
-| qbit-redis | `0.1.0-redis-7fe5492-SNAPSHOT` |
-| qbit-collaboration | `0.1.0-collab-8f348da-SNAPSHOT` |
-| qbit-session-store | `0.1.0-session-b5276ab-SNAPSHOT` |
-| Next frontend source | `8d372142f8af0c41a75a353edc6d150c33ccf613` |
+## Local evidence
 
-Use the public Maven snapshot repository https://central.sonatype.com/repository/maven-snapshots/ and import the candidate QQQ BOM. All four publishers succeeded. Independent JAR/POM downloads and a standalone consumer using an initially empty Maven cache passed; all five QQQ modules align and only Jedis7.2.0 is resolved.
+- Collaboration default verify:179tests, no failures/errors/skips, coverage and guardrails passed.
+- UI focused34 plus Chromium normal-flow suites16 passed; TypeScript passed.
+- Live browser with mocks disabled: two independent QQQ JVMs share presence; editing focus, drafts, table projection and departure verified.
+- Redis admin shows live pool/realtime metrics and real framework-persisted health results, with navigation to the standard health check.
+- Standalone Maven consumer built and ran packaged collaboration/Redis candidates without source paths or a reactor; Redis-absent consumer uses the new issued-lease protocol successfully.
 
-## Verification
+## Publication order and remaining checks
 
-Redis23, collaboration177 and session-store96 tests passed against published prerequisites, with zero failures/errors/skips and configured coverage gates passing. Core verification4209 and frontend acceptance39683690943 passed. Frontend local3664 tests and TypeScript passed. The frontend acceptance run contains the tested export; no dashboard container image was published by that run.
+1. Capture reviewed source revisions for the coordinated core, Redis, collaboration, session-store and frontend candidates. Preserve unrelated worktrees and edits.
+2. Publish the corresponding QQQ4.1.0-SNAPSHOT parent/BOM and required core modules first. The consumer graph currently includes backend-core, backend-module-rdbms, middleware-javalin and openapi.
+3. The public [Redis repository](https://github.com/QRun-IO/qbit-redis) has canonical `main` and `develop` branches; `develop` is the default. [PR #1](https://github.com/QRun-IO/qbit-redis/pull/1) installed the shared orb declarations at `33b21f9c0a1ea316f7f720bbde2465ac11d81af0`. CircleCI pipelines 10 and 11 passed on that revision. Both branches enforce the `setup` and `verify` checks from CircleCI app 18001, including for administrators.
+4. Publish `0.1.0-SNAPSHOT` through the shared QBit profile declared in `.qqq-ci.yml`. The canonical caller tracks `kingsrook/qqq-orb@0.8`; the orb owns verification, version calculation, signing and deployment. Normal `develop` changes select snapshot publication. CI-only declaration changes intentionally verify without publishing, so pipelines 10 and 11 do not prove artifact publication. Follow the actual publisher to success and resolve its timestamped POM/JAR from the remote repository before marking this step complete. Do not add a repository-specific publishing workflow.
+5. Run and publish collaboration0.1.0-SNAPSHOT and the coordinated session-store/frontend candidates as applicable. Frontend and collaboration lease endpoints require coordinated rollout; do not pair the new frontend with an older backend.
+6. Resolve exact published artifacts in a fresh consumer cache, repeat normal host startup/presence/admin checks, and record remote coordinates, source SHAs and artifact checksums. Local cache success is insufficient for this step.
 
-Final browser checks used the downloaded published JARs, exact CI frontend export, two independent JVMs and one Redis endpoint. Cross-node avatars, self exclusion, editor focus, preserved drafts, table presence and departure passed. Redis admin metrics, subscription state, persisted framework UP health history and health-record navigation passed. The fixtures use mock users and independent memory records; database concurrency and authentication have separate core/frontend tests. Test-owned processes were stopped afterward.
+## Verified dependency baseline
 
-Exact release receipts and evidence: [QQQ #1293](https://github.com/QRun-IO/qqq/issues/1293#issuecomment-6329618640). Host integration and migration guide: [coordinated candidate](https://github.com/QRun-IO/qbit-collaboration/blob/c3182e2/docs/CANDIDATE-RELEASE.md).
+Core commit `47eb326c4a36e481a8cf36b93c2e022760d08c76` completed publisher job 9606. Its published `4.1.0-SNAPSHOT` artifacts were checked remotely: 19 resolved POMs and the backend-core/Javalin JAR APIs needed by Redis (`getIfStarted`, message audience accessors, audience-provider configuration and hub audience filtering). Redis pipeline 8 then passed against the published dependency before PR #1 merged.
 
-## Supported milestone
+This baseline establishes the Core dependency and Redis CI path. It does not certify the coordinated collaboration/session-store/frontend deployment or a stable Redis release. Retain the separate consumer and host checks in steps 5 and 6.
 
-Multiple QQQ web nodes share one configured Redis endpoint. Collaboration owns presence semantics; Redis owns connection/cache infrastructure; session-store retains session semantics. Browser delivery uses SSE plus HTTP lease writes, and Redis Pub/Sub carries invalidation hints. Configure node affinity for SSE subscription updates. Shared Redis does not make connection IDs portable. Presence is advisory; versioned database compare-and-write protects saves.
+## Operational scope
 
-Before host adoption, configure authoritative identity/tenant scope, unique deployment/application namespaces, TLS/authentication, bounded pools/timeouts, explicit QInstance session registration, owner-scoped shutdown, and schema migrations. Upgrade the frontend/backend lease protocol together. Existing hosts are not automatically migrated by library publication; rollout is tracked in [#1315](https://github.com/QRun-IO/qqq/issues/1315).
+Initial path: multiple QQQ web nodes, one configured Redis endpoint, host-provided authentication/tenant scope, HTTP lease writes, SSE browser delivery and Redis Pub/Sub invalidation. Presence is advisory; database version checks protect saves.
 
-## Optional future work
-
-The owner's main-line-only scope leaves attachment failure qualification #1289, capacity/My Work failure qualification #1291, selectable tag/EAV projection #1196, data loss/restore #1300, additional Redis topologies #1301, sustained scale #1302, additional proxy deployments #1316 and admin/client coupling enhancements #1317 open. Tooling/dependency maintenance remains #1304/#1305/#1307/#1309/#1310/#1312/#1314. No measured production capacity or disaster-recovery guarantee is claimed.
-
-## Publication lessons
-
-Use short feature branch names: the help bundle version limit is 50 characters. The first long core candidate failed before publication; unchanged source passed with the short coordinate above. Preserve original worktree branches and failed tags. Feature-enabled QBit setup must use the canonical `/publish.*/` tag filter; schema validation alone does not check that contract. Redis/session-store use orb0.7.18; collaboration uses the managed0.8 track. Pin actual published prerequisite versions before downstream publication and verify remote resolution afterward.
+Optional future work remains QQQ #1300 (loss/restore), #1301 (failover topology) and #1302 (sustained scale/failure injection). No transparent disaster-recovery guarantee is part of this snapshot. If the normal presence/admin flow fails in staging, stop rollout and retain the prior coordinated frontend/backend set; do not downgrade only one side of the lease protocol.

docs/TODO.md

@@ -1,26 +1,63 @@
-# Main-line snapshot complete
+# Production readiness
 
-The owner narrowed this milestone to the main-line happy path. Published versions, evidence and operating requirements are in [SNAPSHOT-RELEASE.md](SNAPSHOT-RELEASE.md).
+Current checklist, 2026-10-21. Historical evidence is tracked on QQQ #1295.
+No production readiness claim or release yet.
 
-- [x] Named bounded Redis connections/cache primitives, framework health and admin metrics.
-- [x] Shared presence across two JVMs, viewer/editor focus, table projection, departures and access filtering.
-- [x] Owned shared session-store integration, application isolation and launcher cleanup.
-- [x] Cache invalidation, OAuth cache and JDBC provider isolation repairs.
-- [x] Atomic versioned saves and frontend stale-save review/retry behavior.
-- [x] Full affected verification, downstream CI and four backend snapshot publishers.
-- [x] Remote JAR/POM receipts and fresh-cache standalone consumer with aligned dependency graph.
-- [x] Published-artifact browser presence/admin/framework health acceptance using the tested frontend export.
-- [x] Release/migration documentation and QQQ Project12 issue reconciliation.
+## Current user-directed milestone
 
-## Future work retained in QQQ Project12
+The user explicitly narrowed this milestone to the main-line happy path on2026-10-21. The historical audit list below is retained for traceability, not as an instruction to resume every optional scenario before this snapshot. Current publication steps and evidence are in [SNAPSHOT-RELEASE.md](SNAPSHOT-RELEASE.md).
 
-- #1315: host inventory and coordinated deployment. Required before each host adopts the candidate; no production rollout has occurred.
-- #1289: complete real-DB attachment rollback/crash/retry qualification.
-- #1196: selectable virtual tag/EAV projection.
-- #1291/#1302: My Work budgets, measured capacity and sustained failure/load qualification.
-- #1300/#1301: data loss/restore and additional Redis failover topologies.
-- #1316: additional standalone/ingress/CDN/reverse-proxy SSE configurations.
-- #1317: additional admin management/aggregation, client-library boundary and credential rotation/mTLS qualification.
-- #1304/#1305/#1307/#1309/#1310/#1312/#1314: tooling, CI, layout and test-dependency maintenance.
+- [x] Live browser presence across two independent QQQ JVMs sharing Redis.
+- [x] Live Redis dashboard metrics, framework-persisted UP health history and health-record navigation.
+- [x] Collaboration normal-flow backend179, UI34 and Chromium16 checks.
+- [x] Packaged standalone Maven consumer and optional Redis-absent issued-lease consumer.
+- [x] Redis POM license/developer/SCM metadata, correct NOTICE and standard CircleCI setup configuration prepared locally.
+- [x] Establish Redis remote repository and CircleCI project (empty; no source uploaded).
+- [ ] Capture reviewed source revisions, set develop default branch, and verify CI context access/actual pipeline execution.
+- [ ] Publish coordinated core/Redis/collaboration/frontend snapshots and verify remote consumer resolution.
 
-All issues are in https://github.com/orgs/QRun-IO/projects/12 and carry the relevant QBit labels. No future scenario above is declared tested merely because the normal flow passes. Worktrees and optional research files remain preserved.
+Optional loss/restore, failover topology and sustained scale work: QQQ #1300, #1301 and #1302 respectively. No claim that those scenarios are supported by the current candidate.
+
+## Implemented with targeted verification
+
+- [x] Named bounded Redis pools, cache primitives, namespaces and runtime lifecycle.
+- [x] Framework health checks, pool metrics and subscription readiness.
+- [x] Authentication/TLS rejection and bounded pool exhaustion tests.
+- [x] Redis presence store/service selection, tenant isolation and explicit unavailable UI.
+- [x] Cross-node Pub/Sub hints, bounded dispatch, reconnect/resync and silent-stall detection.
+- [x] Framework Redis app and local connection/realtime widgets with permission checks.
+- [x] Framework-persisted health history and link to existing check settings/actions.
+- [x] Packaged app/widget help and health read/write permission-contract tests.
+- [x] Metadata-name collision rejection and atomic rejected realtime namespace updates.
+- [x] Source dependency report across 44 canonical qbits, with browser validation.
+
+## Historical broader audit backlog (not the current milestone definition)
+
+- [ ] Browser acceptance of Redis app, widgets, help, health navigation and Run check now.
+- [ ] Complete connection-management requirements and multi-node presentation semantics.
+- [ ] Replace or constrain native-client API exposure and prove resource ownership.
+- [x] Candidate session-store Jedis alignment and optional shared Redis provider integration tests.
+- [x] Shared session-store runtime owns cleanup/restart of registrations with real Redis lifecycle coverage.
+- [x] Actual launcher shutdown/failure/retry acceptance for shared Redis session storage.
+- [x] Real shared Redis OAuth HTTP login/logout, bounded outage failure and retry acceptance.
+- [x] Same-node delayed authentication cache fill after logout rejects the next HTTP request.
+- [ ] Token memoization fill/invalidation race and delayed/lost cross-node logout invalidation acceptance.
+- [ ] Qualify #1297 memoization invalidation repair: focused, HTTP and full core unit rerun pass; earlier canary failure remains unexplained with diagnostics added.
+- [ ] Qualify #1298 application-scoped OAuth token cache; targeted cluster and 14 HTTP acceptance tests pass.
+- [ ] Complete #1299 JDBC ownership: registry/health/launcher/native C3P0 callback isolation tested; deployed-host migration and combined acceptance remain.
+- [ ] Deployment migration and complete multi-node HTTP authentication compatibility.
+- [ ] Clean-consumer tests with optional Redis/email artifacts absent.
+- [ ] Full multi-node collaboration/browser acceptance behind a load balancer.
+- [ ] Redis eviction/restart recovery and delayed request/tombstone semantics.
+- [ ] Supported topology failover, network partition and lifecycle stress tests.
+- [ ] mTLS/credential rotation acceptance for supported deployment configuration.
+- [ ] Measured load, latency percentiles and explicit supported capacity.
+- [ ] Remaining collaboration issues (including durable attachment cleanup and notification leadership).
+- [ ] Complete security review, dependency convergence and compatible full-stack quality gates.
+- [ ] QQQ issue resolution, release notes, clean-consumer verification and snapshot/RC when ready.
+
+Latest full Redis verify: 23 tests, zero failures/errors/skips, 94.50% instruction
+coverage and guardrails pass (%TEMP%/redis-script-boundary-verify.log).
+Collaboration uses script operations instead of the native client. Public credential
+and direct-cache construction types still expose Jedis; complete boundary and
+session-store compatibility remain open. Report browser checks: all eight pass.

pom.xml

@@ -37,7 +37,7 @@
    <properties>
       <revision>0.1.0-SNAPSHOT</revision>
       <maven.compiler.release>21</maven.compiler.release>
-      <qqq.snapshot.version>4.1.0-collab-33464d37e-SNAPSHOT</qqq.snapshot.version>
+      <qqq.snapshot.version>4.1.0-SNAPSHOT</qqq.snapshot.version>
       <jedis.version>7.2.0</jedis.version>
    </properties>
    <dependencyManagement>