feat(runtime): run qbit work as the release-notes service principal #3

2026-10-16T13:33:08Z

KofTwentyTwo commented

2026-10-16 13:33:08 +00:00

(Migrated from github.com)

Part of the service-identity work, QRun-IO/qqq#1248. Draft: it needs the QQQ RC that contains qqq#1255. Bump qqq.snapshot.version once the release captain cuts it.

ReleaseNotesRuntime.asSystem now runs as the host's declared release-notes principal (ReleaseNotesQBitConfig.servicePrincipal) instead of QSystemUserSession:

it uses the principal's granted permissions;
it is audited as service:release-notes;
an unavailable principal fails, with no fallback.

With no principal declared, nothing changes.

Tests: ReleaseLifecycleTest.detectsAsTheDeclaredPrincipal passes, along with the rest of the suite (25 tests) against a local install of qqq#1256, except ReleaseNotesMetaDataTest.uiApiContract. That test also fails without this change: the committed OpenAPI predates the newer core's UI API output, so the regeneration belongs to the RC bump.

🤖 Generated with Claude Code

Part of the service-identity work, QRun-IO/qqq#1248. **Draft:** it needs the QQQ RC that contains qqq#1255. Bump `qqq.snapshot.version` once the release captain cuts it. `ReleaseNotesRuntime.asSystem` now runs as the host's declared `release-notes` principal (`ReleaseNotesQBitConfig.servicePrincipal`) instead of `QSystemUserSession`: - it uses the principal's granted permissions; - it is audited as `service:release-notes`; - an unavailable principal fails, with no fallback. With no principal declared, nothing changes. **Tests:** `ReleaseLifecycleTest.detectsAsTheDeclaredPrincipal` passes, along with the rest of the suite (25 tests) against a local install of qqq#1256, except `ReleaseNotesMetaDataTest.uiApiContract`. That test also fails without this change: the committed OpenAPI predates the newer core's UI API output, so the regeneration belongs to the RC bump. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-release-notes#3