Delete the local shared/signing package (WebhookSigner, WebhookVerifier,
WebhookSecret, WebhookVerificationException) and use core
com.kingsrook.qqq.backend.core.utils.webhooks from QQQ 4.1.0-RC.5.
Delivery signing, inbound verification and secret generation and rotation
all go through core. The wire format is unchanged: same headers, v1,
prefix, whsec_ secrets and timestamp tolerance. Endpoints, secret storage
and delivery stay in this qbit.
Refs QRun-IO/qqq#1160 (this repo has issues disabled), architecture review
QRun-IO/qqq#1150 finding F11.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The owner approved removing the old code. Deletes the 0.x engine
(actions/, model/, tables/, the old processes and registry plugins) and
its tests, which 1.0 replaced, and drops the TEMPORARY compiler and
Checkstyle exclusions from pom.xml and the note in CLAUDE.md/AGENTS.md.
./mvnw clean verify: 144 tests, 0 failures, Checkstyle clean, JaCoCo
gate met.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The README now matches the code. docs/DESIGN.md covers the signing format,
SSRF policy, event sources, delivery semantics, data model and the phase 2
inbound design; docs/RECEIVERS.md has verification code for Java, Node.js
and Python.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
james.maesandClaude Opus 5.5