Checked against Next UI 1.0.0-RC.14 with a local demo server (H2, real
traffic from the engine): Next's sanitizer removes <style>, so the home
now uses inline styles only, with intrinsic auto-fit grids instead of
media queries; the relation widgets and the payload span the full record
width; deliveries and attempts drop the insert, update and delete
capabilities so the UI offers no Edit or New (they are written only by
the qbit); the home widget is labelled Overview. Screenshots at 390 and
1440 px, light and dark: no page or inner horizontal scroll.
Adds the test-scoped WebhooksDemoServer used for the screenshots.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The README now matches the code. docs/DESIGN.md covers the signing format,
SSRF policy, event sources, delivery semantics, data model and the phase 2
inbound design; docs/RECEIVERS.md has verification code for Java, Node.js
and Python.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Rebuilds the qbit on QQQ 4.1.0-RC.4 per the assessment (QRun-IO/qqq#1105,
decisions D1-D8):
- webhooks_endpoint, webhooks_endpoint_secret, webhooks_subscription,
webhooks_delivery and webhooks_delivery_attempt (snake_case, webhooks_
prefix), permissions webhooks.view / manage / admin
- Standard Webhooks signing with per-endpoint secrets (AES-GCM or env
references) and overlapping rotation
- SSRF-safe client: private, loopback, link-local and metadata ranges
blocked, DNS pinned, no redirects, timeouts, size cap, admin-only
internal allowlist (shared/ is an internal copy of QRun-IO/qqq#1109,
replaced at RC.5)
- event sources: table insert/update/delete (record change listener),
process completed/failed, ESB topics (own events skipped, CloudEvent
id dedup), custom events and a channel API for other qbits
- delivery: unique attempt-row claims with leases (no double sends across
replicas), retries with backoff, Retry-After, dead letters and Replay,
serial mode, per-endpoint rate limits, health with probation and
auto-disable, alerts through the Alerts SPI when present, retention
- subscriptions: record filters, record security, read permission check,
detail levels, include and exclude fields, payload customizer hook
- app home dashboard, actions with the standard review/result screens,
ESB / Quick Search / API integration hooks
- JaCoCo gate, Checkstyle in verify, Maven wrapper, default 4.1 profile,
Postgres DDL in docs/ddl
The 0.x sources stay in the tree, excluded from the build, until their
removal is approved.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
LICENSE and NOTICE in the standard form (F1, F2), pointer files to
QRun-IO/qqq (F4), dependabot (F8), .gitattributes (F11), .editorconfig
(F12) and the reference .gitignore (F10).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
james.maesandClaude Opus 5.5