f0d695ec97
QRun-IO/ci-policy: ci / fork-guard (push) Skipped
QRun-IO/ci-policy: ci / head-profile (push) Skipped
QRun-IO/ci-policy: ci / application-template-0 (push) Skipped
QRun-IO/ci-policy: ci / gradle-1 (push) Skipped
QRun-IO/ci-policy: ci / java-docker-3 (push) Skipped
QRun-IO/ci-policy: ci / java-docker-4 (push) Skipped
QRun-IO/ci-policy: ci / java-frontend-browser-5 (push) Skipped
QRun-IO/ci-policy: ci / java-maven-6 (push) Skipped
QRun-IO/ci-policy: ci / java-maven-7 (push) Skipped
QRun-IO/ci-policy: ci / node-8 (push) Skipped
QRun-IO/ci-policy: ci / node-9 (push) Skipped
QRun-IO/ci-policy: ci / node-10 (push) Skipped
QRun-IO/ci-policy: ci / node-playwright-11 (push) Skipped
QRun-IO/ci-policy: ci / repository-policy-12 (push) Skipped
QRun-IO/ci-policy: ci / source-config-13 (push) Skipped
QRun-IO/ci-policy: ci / source-config-14 (push) Skipped
QRun-IO/ci-policy: ci / android-0 (push) Skipped
QRun-IO/ci-policy: ci / original-business (push) Skipped
QRun-IO/ci-policy: ci / original-mcp (push) Skipped
QRun-IO/ci-policy: ci / original-voyage (push) Skipped
QRun-IO/ci-policy: ci / original-cli (push) Skipped
QRun-IO/ci-policy: ci / repository-policy (push) Skipped
QRun-IO/ci-policy: ci / java-core-2-head (push) Skipped
QRun-IO/ci-policy: ci / java-docker-3-head (push) Skipped
QRun-IO/ci-policy: ci / java-maven-6-head (push) Skipped
QRun-IO/ci-policy: ci / java-maven-7-head (push) Skipped
QRun-IO/ci-policy: ci / not-enrolled (push) Failing after 7s
QRun-IO/ci-policy: native / fork-deny (push) Skipped
QRun-IO/ci-policy: native / dotnet-0 (push) Skipped
QRun-IO/ci-policy: ci / ci-result (push) Failing after 6s
QRun-IO/ci-policy: native / native-result (push) Successful in 6s
Save the current implementation and README, status, and known-issue documentation at the user-requested stop. No completed release or deployment is claimed. Co-Authored-By: Claude <noreply@anthropic.com> Co-Authored-By: GPT-6 Codex <noreply@openai.com>
30 lines
2.9 KiB
Markdown
30 lines
2.9 KiB
Markdown
# qbit-scripting standalone status
|
|
|
|
This replaces the pre-extraction session notes, TODO list and private-host evidence logs, which were not carried into this repository (see `PROVENANCE.md`).
|
|
|
|
## Release blocker: core API gap
|
|
|
|
The source in this repository was developed and reviewed against a reviewed private QQQ core/RDBMS build. It does **not** compile against public `qqq-backend-core:4.1.0-RC.21`. Missing from RC.21 (found by compiling, not by inspection): `ScriptExecutionIsolation` / `ScriptExecutionMode`, `TableCustomizerInterface.whenToRunPreUpdate` / `PreUpdatePhase`, `TransactionalRecordChangeMetaData` / `TransactionalRecordChangeScope`, `DurableProcessMetaData.get/withTransactionalRevision`, `BoundedIntentData`, `FixedProcessRequest`, `ScriptTableCustomizer`, `requireEnlistedExecution`. Eight main source files are affected (hooks, service and the QBit producer). Publishing the Maven modules therefore needs a public QQQ release that contains those APIs, or a reviewed source change; neither is done here.
|
|
|
|
## What the code is
|
|
|
|
A control plane: script projects, immutable strict-TypeScript builds, capability broker, native record hooks. It never compiles or runs script code in the JVM. With no qualified worker configured, every build and execution fails closed.
|
|
|
|
## Runtime source (not part of the Maven QBit artifacts)
|
|
|
|
`worker/` (Node/TypeScript), `supervisor/` (Java, Extism/Javy host), `wasm-runtime/` (Rust, pinned Wasm), `deploy/` (qualification packaging). They are source only. No worker image was built, rebuilt, signed or deployed for this extraction, and `qualified=false` / `productionQualified=false` / `redistributionCleared=false` stay as written. See `worker/QUALIFICATION.md`, `deploy/NOTICE-GAPS.md`, `wasm-runtime/docs/release-license-review.md`.
|
|
|
|
## Production gates still open
|
|
|
|
- Independent qualification of a real worker image and runsc deployment (escape/exhaustion/CPU/memory/process/fd/output/wall controls, no ambient network/secrets/mounts).
|
|
- Durable ownership journal and reaper proven across coordinator/host death.
|
|
- Host-managed HMAC key lifecycle (rotation, revocation); no signing keys in records or workers.
|
|
- Supported schema is MySQL 8.4 / file H2 only; PostgreSQL and Aurora are unsupported by the current adapter. Immutable-trigger migration and restore need qualification on the target host.
|
|
- Audit pool capacity and reconciliation of unresolved STARTED events; no exactly-once execution guarantee.
|
|
- Broker integration review under permission changes; GitHub access wiring to a managed credential provider.
|
|
- Upstream SPDX attestation and residual advisory/license review for the worker image.
|
|
|
|
## Build
|
|
|
|
Use the wrapper. `./mvnw verify` builds the base module (Checkstyle incl. tests, tests, JaCoCo 85%/65%). Optional modules are separate POMs that need the base module installed first: `./mvnw install`, then `./mvnw -f rdbms/pom.xml verify` (and `middleware`, `github`). `supervisor/pom.xml` is a standalone, non-QBit runtime build.
|