58 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
james.maes	4cd0fd1f54	Merge pull request 'perf: keep the access fingerprint for the request and read rule rows once per change' (#41) from perf/request-scoped-resolver-and-cached-rules into develop	2026-11-10 21:37:13 +00:00
james.maesandClaude Fable 5.2	ab283c79b9	perf: keep the access fingerprint for the request and read rule rows once per change ... Core asks the field access resolver for its fingerprint before every field decision (FieldAccessHelper.getDecision), that is once per field of every record of a result and of every table in the metaData document. Each call recomputed it: a JSON key, a permission lookup for every table, another JSON document and a digest. Core also asks for the retention rules of a field on every audited field and every filter criterion, and each question was a query. - getAccessFingerprint keeps its value in the request context (QContext) and returns it while the session, its permission set, the channel, the policy and classification versions are unchanged and no active break-glass grant has expired. Nothing outlives the request. - RetentionRules.active answers from the active rules the runtime read once (SecuredDataRuntime.activeRetentionRules). A rule write clears them after commit; a thread that edits rules inside a transaction reads its own edits. - Policy, classification and retention changes are announced on QQQ's cluster bus (ClusterCaches, memo-invalidate), so every node reads again. Before, the versions were node-local and another node kept old rules until restart. - No node uses rule rows older than 30 seconds without reading them again (the safety net for a lost event). - A read that fails throws and replaces nothing: never an empty rule list. Measured in one JVM with GG Forge's composed instance (222 tables, secured data and collaboration wired, in-memory backend, platform administrator), released 0.1.0-RC.4 against this change, same machine, back to back: metaData request 866.6 ms to 125.3 ms (930 MB to 74 MB allocated, 96 to 34 queries); a 300-row list 1,566 ms to 24 ms; a 27-row list 174 to 230 ms down to 13 to 17 ms; queries per list 23 to 8. Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>	2026-11-10 15:22:22 -06:00
james.maes	eb98ec5fd0	Merge pull request 'build(deps): align with Gitea registry (parent 2.2.1, QQQ 4.1.0-RC.26)' (#39) from deps/align-gitea into develop	2026-11-07 18:16:02 +00:00
james.maesandClaude Opus 5.5	f09fe866ad	build(deps): align with Gitea registry (parent 2.2.1, QQQ 4.1.0-RC.26) ... pom.xml: parent -> 2.2.1 pom.xml: qqq.snapshot.version: 4.1.0-RC.15 -> 4.1.0-RC.26 pom.xml: qqq-frontend-next: 1.0.0-RC.14 -> 1.0.0-RC.38 pom.xml: added qqq.version=4.1.0-RC.26 (parent BOM import) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 18:08:54 +00:00
james.maes	c4ebc6833c	Merge pull request 'ci: pin shared workflow to v1' (#38) from ci/pin-v1-develop into develop	2026-11-06 16:10:31 +00:00
james.maesandClaude Opus 5.5	2431b4723a	ci: pin shared workflow to v1 ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-06 14:13:29 +00:00
james.maes	9fb168b96d	Merge pull request 'ci: use shared ci-workflows Maven workflow' (#37) from ci/ci-workflows into develop	2026-11-05 23:17:59 +00:00
CI	e0459a99ff	ci: rerun shared workflow	2026-11-05 16:26:50 -06:00
james.maesandClaude Opus 5.5	84e2311d84	ci: use shared ci-workflows Maven workflow ... Replace the platform-ci release callers with one caller of KofTwentyTwo/ci-workflows maven.yaml (qqq-orb port). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-05 22:08:11 +00:00
forge-recovery	5987cb53ac	ci: enroll shared Gitea lifecycle	2026-11-03 18:10:35 +00:00
forge-recovery	a087988f11	ci: enroll shared Gitea lifecycle	2026-11-02 22:35:22 +00:00
forge-recoveryandCodex	894c3023b4	ci: enroll shared Gitea release-candidate lifecycle ... Co-Authored-By: Codex <noreply@openai.com>	2026-11-02 20:19:48 +00:00
3 people	15c2906fc1	ci: add the isolated postpublish job to the QRun release caller ... Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Co-Authored-By: Codex <noreply@openai.com>	2026-11-02 15:52:40 +00:00
3 people	45015b6912	ci: move the QRun release caller to the thin v2 contract ... Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Co-Authored-By: Codex <noreply@openai.com>	2026-11-02 06:20:41 +00:00
forge-recoveryandCodex	0f94818084	ci: add the identical QRun release caller ... Co-Authored-By: Codex <noreply@openai.com>	2026-11-02 04:14:35 +00:00
james.maesandCodex	7b302ed2b1	ci: adopt managed orb 0.8 patch track (#30) ... Co-authored-by: Codex <noreply@openai.com>	2026-10-21 15:29:10 -05:00
james.maesandCodex	b917b51656	ci: adopt shared orb 0.7.18 (#29) ... Co-authored-by: Codex <noreply@openai.com>	2026-10-21 14:47:03 -05:00
james.maesandCodex	dc4734eef1	ci: adopt shared orb 0.7.17 (#28) ... Co-authored-by: Codex <noreply@openai.com>	2026-10-21 14:16:47 -05:00
james.maesandCodex	eb912ebf07	ci: use the shared branch-aware CodeQL worker (#26) ... Co-authored-by: Codex <noreply@openai.com>	2026-10-21 10:56:24 -05:00
james.maesandCodex	9091f26dd7	ci: adopt central orb 0.7.12 and stable gates (#24) ... Co-authored-by: Codex <noreply@openai.com>	2026-10-21 08:53:36 -05:00
james.maesandCodex	4942b7e994	ci: centralize rc release completion in qqq orb (#23) ... Co-authored-by: Codex <noreply@openai.com>	2026-10-21 02:25:10 -05:00
james.maesandCodex	0875069488	ci: adopt shared orb 0.7.11 (#22) ... Co-authored-by: Codex <noreply@openai.com>	2026-10-21 00:59:13 -05:00
james.maes	bf81c587bc	Merge pull request #21 from QRun-IO/feature/central-ci ... ci: adopt shared QQQ orb standard	2026-10-20 19:19:22 -05:00
james.maesandCodex	70058c1ef6	ci: adopt verified central QQQ orb 0.7.3 ... Co-Authored-By: Codex <noreply@openai.com>	2026-10-20 19:08:13 -05:00
james.maes	af62471cf6	Merge pull request #19 from QRun-IO/feature/access-log-lifecycle ... fix: the access logger no longer keeps its instance alive	2026-10-16 11:41:27 -05:00
james.maesandClaude Opus 5.5	325150a938	fix: the access logger no longer keeps its instance alive ... The worker thread's task and the JVM shutdown hook referenced the logger (and through it the QInstance) strongly for the life of the JVM, so every instance a host or test built and dropped stayed in memory (kof22's suite ran out of heap in CI). Both now hold the logger weakly: a dropped instance can be collected and its worker stops at the next tick. - withRegisterShutdownHook(false) for hosts that close the runtime themselves (default true, unchanged behaviour). - isWorkerRunning() for hosts and tests. - README and CHANGELOG (also notes #18). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-16 11:39:12 -05:00
james.maes	72ec4a08be	Merge pull request #18 from QRun-IO/feature/virtual-fields-and-idle-flush ... fix: resolve virtual fields; keep the access-log worker off unfinished instances	2026-10-16 11:35:24 -05:00
james.maesandClaude Opus 5.5	ef5c096e84	fix: resolve virtual fields and keep the access-log worker off unfinished instances ... - SecuredDataClassifications.effective looked fields up with QTableMetaData.getField, which throws for a virtual (computed) field, so any user read of a table with one failed (kof22's permalink sitePath and siteUrl on every content table, and API validation). Virtual fields now take the table classification. - The access-log worker opened a QContext on every tick, even with an empty queue. QContext validates an unvalidated instance, and the worker starts while the host is still building it, so the first tick validated (and enriched) a half-built instance on another thread; one failure cancelled every later tick for good. Idle ticks now return before opening a context, and a failed tick is logged and retried. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-16 08:42:05 -05:00
james.maes	75b5f0b64f	Merge pull request #17 from QRun-IO/ci/release-rc-secrets-inherit ... ci(release-rc): pass secrets so the shared workflow can sign the RC tag	2026-10-16 08:05:16 -05:00
james.maesandClaude Opus 5.5	2cb37a067d	ci(release-rc): pass secrets to the shared workflow so it can sign the RC tag ... QRun-IO/.github#2 adds a tag-and-release job that signs vX with the QRUN_TAG_SIGNING_KEY secret after Maven Central confirms the artifact. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-15 16:18:59 -05:00
james.maes	971ddbed2d	Merge pull request #16 from QRun-IO/feature/ui-api-1.6 ... feat(ui-api): extension for QQQ UI API 1.6.0 (operationIds, BasicErrorResponseV1, QQQ 4.1.0-RC.15)	2026-10-15 16:17:33 -05:00
james.maesandClaude Opus 5.5	e2f5199e06	test(retention): canary leak scan without false positives ... The canary was 16 random letters g-v and any 5-letter window counted as a leak, so ordinary JSON words built from those letters (options, joins) matched by chance and RetentionProofTest failed intermittently. The canary now has 24 random letters and a leak is the whole marker or a 12-letter window of its random part (16^12 values): chance matches are impossible, truncated or re-encoded fragments of a real leak are still caught. A new test pins both directions. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-15 16:15:09 -05:00
james.maesandClaude Opus 5.5	214bd75298	chore: target QQQ 4.1.0-RC.15 (UI API 1.6.0) ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-15 12:27:07 -05:00
james.maesandClaude Opus 5.5	6bb55f332a	feat(ui-api): extension for QQQ UI API 1.6.0 (operationIds, BasicErrorResponseV1, QQQ 4.1.0-RC.14) ... Regenerated against UI API 1.6.0: every operation has an operationId and the standard error responses (BasicErrorResponseV1: error, code, message, fieldErrors, traceId); the extension's own error schema is kept but deprecated; hand-written error bodies go through QJavalinUtils so they carry code/message/traceId. Extension MINOR bumped. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-15 11:48:13 -05:00
james.maes	781bae3efe	Merge pull request #15 from QRun-IO/feature/remove-standins ... build: QQQ 4.1.0-RC.7; remove core stand-ins	2026-10-14 16:33:33 -05:00
james.maesandClaude Opus 5.5	677d611b15	build: start on the 0.1 version line, like the other new qbits ... The UI API extension keeps its own semver (secured-data 1.0.0). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 16:27:45 -05:00
james.maesandClaude Opus 5.5	527ee4fc96	build: pin QQQ 4.1.0-RC.7 ... RC.7 ships field access (#1172) and audit value protection (#1182), so the qbit builds on the released core with no stand-ins. Also repairs a non-UTF-8 character in the changelog. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 16:25:17 -05:00
james.maes	c0a2d67026	Merge remote-tracking branch 'origin/develop' into feature/remove-standins	2026-10-14 16:22:15 -05:00
james.maes	f415f2cc8d	Merge pull request #14 from QRun-IO/feature/orb-0.6.9 ... ci: qqq-orb 0.6.9 (refresh SNAPSHOT dependencies)	2026-10-14 10:46:31 -05:00
james.maesandClaude Opus 5.5	0dec9463a6	chore: use core field access and audit-token APIs directly; remove stand-ins ... QQQ #1172 and #1182 are released, so the standin package and the reflective core bridges go; the resolver, key source and audit protector register through core metadata, and the core-dependent tests run unconditionally. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 10:10:18 -05:00
james.maesandClaude Opus 5.5	e9b8a05f87	ci: qqq-orb 0.6.9 (refresh SNAPSHOT dependencies) ... Moves qqq-orb@0.6.8 to qqq-orb@0.6.9, which passes --update-snapshots so cached SNAPSHOT dependencies are re-checked on every build (QRun-IO/qqq-orb#22). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 10:07:46 -05:00
james.maes	f2736311da	Merge pull request #13 from QRun-IO/chore/standin-rc8 ... chore: retag stand-ins removeBy=RC.8	2026-10-14 07:57:01 -05:00
james.maesandClaude Opus 5.5	d8e3cb976d	chore: stand-ins are removed with the first QQQ RC that ships #1172 and #1182 (RC.8) ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 07:52:48 -05:00
james.maes	9b2d8fd182	Merge pull request #11 from QRun-IO/feature/retention-and-wipe ... feat: retention and wipe with crypto-shredding; QQQ RC.6 (phase f)	2026-10-14 07:42:39 -05:00
james.maesandClaude Opus 5.5	470b0bd214	feat: retention and wipe with crypto-shredding; move to QQQ RC.6 (phase f) ... Moves the pin to QQQ 4.1.0-RC.6 and removes the stand-ins RC.6 provides (classification, client channels, table features, the UI API extension point). Adds retention rules, wipe markers, legal holds, wipe runs and the per-record-per-field audit key table; the wipe process (null with marker, overwrite, keyed hash, delete, archive then wipe) runs in one transaction per batch, destroying the audit keys with the field updates; the audit protector and key source (AES-GCM wrapped DEKs, AAD-bound); the backups warning; canary and wipe-proof tests. Fixes a key-source bug that zeroed each DEK after returning it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 07:35:45 -05:00
james.maes	9801c6b4d1	Merge pull request #9 from QRun-IO/feature/app-home ... feat: app home and anomaly alerts (phase e)	2026-10-14 07:16:04 -05:00
james.maes	0ce1723019	Merge pull request #8 from QRun-IO/feature/reveal-and-break-glass ... feat: reveal, break-glass and the secured-data UI API extension (phase c)	2026-10-14 07:15:51 -05:00
james.maesandClaude Opus 5.5	6606bf3e90	test: demo server uses MOCK auth so the demo administrator's permissions apply ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-13 21:30:48 -05:00
james.maesandClaude Opus 5.5	3457481841	feat: app home and anomaly alerts (phase e) ... One Secured Data home: KPIs, recent reveals, top revealers and reasons, break-glass events, policy and classification changes and anomaly flags, as full-width tables. Anomaly rules (3x daily median, distinct records per hour, exact-match volume, break-glass) raise secured_data.anomaly and flag the log row. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-13 21:20:16 -05:00
james.maesandClaude Opus 5.5	e26ba2b4ad	feat: reveal, break-glass and the secured-data UI API extension (phase c) ... Reveal service (options, reason validation, daily cap, grants, audit), break-glass start/end/expiry with alerts and admin notification, status, the secured-data 1.0.0 UI API extension (compiled under the uiapi profile until RC.6) and a contingent field picker for classification rows. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-13 20:47:31 -05:00