63 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
james.maes	b879a1ac1a	Merge pull request 'build(deps): align with Gitea registry (parent 2.2.1, QQQ 4.1.0-RC.26)' (#37) from deps/align-gitea into develop	2026-11-07 18:05:25 +00:00
james.maesandClaude Opus 5.5	fc4375adb5	build(deps): align with Gitea registry (parent 2.2.1, QQQ 4.1.0-RC.26) ... pom.xml: parent -> 2.2.1 pom.xml: qqq.snapshot.version: 4.1.0-RC.5 -> 4.1.0-RC.26 pom.xml: qbit-object-storage: 0.1.0-RC.2 -> 0.1.0-RC.10 pom.xml: qqq-frontend-next: 1.0.0-RC.14 -> 1.0.0-RC.38 pom.xml: added qqq.version=4.1.0-RC.26 (parent BOM import) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 17:56:03 +00:00
james.maes	e89ea02b22	Merge pull request 'ci: pin shared workflow to v1' (#36) from ci/pin-v1-develop into develop	2026-11-06 16:13:13 +00:00
james.maesandClaude Opus 5.5	b904359bea	ci: pin shared workflow to v1 ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-06 14:17:16 +00:00
james.maes	bb015dcc1d	Merge pull request 'ci: use shared ci-workflows Maven workflow' (#35) from ci/ci-workflows into develop	2026-11-05 23:19:01 +00:00
CI	54bef4a36b	ci: rerun shared workflow	2026-11-05 16:28:51 -06:00
james.maesandClaude Opus 5.5	db2c2b6755	ci: use shared ci-workflows Maven workflow ... Replace the platform-ci release callers with one caller of KofTwentyTwo/ci-workflows maven.yaml (qqq-orb port). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-05 22:10:41 +00:00
forge-recovery	b2d9b536e7	ci: enroll shared Gitea lifecycle	2026-11-02 22:27:47 +00:00
forge-recovery	e157ff5038	ci: enroll shared Gitea lifecycle	2026-11-02 21:37:27 +00:00
forge-recoveryandCodex	29fc15a10a	ci: enroll shared Gitea release-candidate lifecycle ... Co-Authored-By: Codex <noreply@openai.com>	2026-11-02 20:23:20 +00:00
3 people	dc6361b4c2	ci: add the isolated postpublish job to the QRun release caller ... Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Co-Authored-By: Codex <noreply@openai.com>	2026-11-02 15:57:08 +00:00
3 people	2eaf49eccb	ci: move the QRun release caller to the thin v2 contract ... Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Co-Authored-By: Codex <noreply@openai.com>	2026-11-02 06:22:56 +00:00
forge-recoveryandCodex	e1d3986acc	ci: add the identical QRun release caller ... Co-Authored-By: Codex <noreply@openai.com>	2026-11-02 04:18:20 +00:00
james.maesandCodex	be0d49d9db	ci: adopt managed orb 0.8 patch track (#30) ... Co-authored-by: Codex <noreply@openai.com>	2026-10-21 15:29:03 -05:00
james.maesandCodex	d93b279629	ci: adopt shared orb 0.7.18 (#29) ... Co-authored-by: Codex <noreply@openai.com>	2026-10-21 14:46:57 -05:00
james.maesandCodex	2c470560a3	ci: adopt shared orb 0.7.17 (#28) ... Co-authored-by: Codex <noreply@openai.com>	2026-10-21 14:16:40 -05:00
james.maesandCodex	c8ea4b627b	ci: use the shared branch-aware CodeQL worker (#26) ... Co-authored-by: Codex <noreply@openai.com>	2026-10-21 10:47:40 -05:00
james.maesandCodex	0ce28313f9	ci: adopt central orb 0.7.12 and stable gates (#24) ... Co-authored-by: Codex <noreply@openai.com>	2026-10-21 08:52:48 -05:00
james.maesandCodex	a8980eec0f	ci: centralize rc release completion in qqq orb (#23) ... Co-authored-by: Codex <noreply@openai.com>	2026-10-21 02:24:23 -05:00
james.maesandCodex	082f3b95f0	ci: adopt shared orb 0.7.11 (#22) ... Co-authored-by: Codex <noreply@openai.com>	2026-10-21 00:56:21 -05:00
james.maes	c681b2c0e7	Merge pull request #21 from QRun-IO/feature/central-ci ... ci: adopt shared QQQ orb standard	2026-10-20 19:21:02 -05:00
james.maesandCodex	558effe85f	ci: adopt verified central QQQ orb 0.7.3 ... Co-Authored-By: Codex <noreply@openai.com>	2026-10-20 19:07:42 -05:00
james.maes	93f6f86f2d	Merge pull request #18 from QRun-IO/feature/clearer-alert-titles ... fix(alerts): stable chain break alert title	2026-10-19 10:05:18 -05:00
james.maes	7e15fb92e0	Merge pull request #20 from QRun-IO/feature/embedded-audit-app ... feat: allow host-owned Audit app composition	2026-10-19 10:05:14 -05:00
james.maesandCodex	a5d7192b95	feat: allow host-owned Audit app composition ... Keep standalone defaults while permitting embedded WORM metadata and authorized widgets without replacing host navigation or help. Co-Authored-By: Codex <noreply@openai.com> Signed-off-by: James Maes <james@kof22.com>	2026-10-19 10:01:20 -05:00
james.maesandClaude Opus 5.5	05fcbdd8b8	fix(alerts): stable chain break alert title ... The wormaudit.chain.break title was the first break reason, so the bell text changed on every run. The title is now "Audit chain verification found N problems"; the first reasons move to the summary. Dedupe key and severity are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-16 15:33:59 -05:00
james.maes	d78ecc1bc4	Merge pull request #17 from QRun-IO/ci/release-rc-secrets-inherit ... ci(release-rc): pass secrets so the shared workflow can sign the RC tag	2026-10-16 08:04:06 -05:00
james.maesandClaude Opus 5.5	e81c8ba37e	ci(release-rc): pass secrets to the shared workflow so it can sign the RC tag ... QRun-IO/.github#2 adds a tag-and-release job that signs vX with the QRUN_TAG_SIGNING_KEY secret after Maven Central confirms the artifact. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-15 16:20:12 -05:00
james.maes	a9e985a86c	Merge pull request #16 from QRun-IO/feature/purge-replace-as-owner ... fix(ddl): replace worm_audit_purge when the owner revoked its own EXECUTE	2026-10-15 09:16:36 -05:00
james.maesandClaude Opus 5.5	bde8ff416f	fix(ddl): replace worm_audit_purge when the owner revoked its own EXECUTE ... PostgreSQL refuses CREATE OR REPLACE FUNCTION when the owning role has no EXECUTE on it, which is the CNPG shape (the runtime role owns the schema and worm-audit:6 revokes its EXECUTE). worm-audit:13 now grants EXECUTE back to the migrating role only when missing, replaces the function, and revokes it again inside the same changeset transaction. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-15 09:13:59 -05:00
james.maes	92c5fc9ca4	Merge pull request #15 from QRun-IO/feature/ddl-comment-not-changeset ... fix(ddl): no comment line may start with -- changeset	2026-10-15 07:58:54 -05:00
james.maesandClaude Opus 5.5	86f9929cd2	fix(ddl): no comment line may start with -- changeset ... Liquibase formatted SQL parses any line beginning with '-- changeset' as a directive, so the worm-audit:13 comment broke the changelog. Reword it and guard the rendered DDL in CanonicalAndCryptoTest. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-15 07:56:47 -05:00
james.maes	4842cb174d	Merge pull request #14 from QRun-IO/feature/chain-coverage-perf ... perf(chain): normalized detail coverage table and sweep floors	2026-10-15 07:42:38 -05:00
james.maesandClaude Opus 5.5	18ae80740b	perf(chain): normalized detail coverage table and sweep floors ... The chain writer re-read the whole late-detail lookback every 30 s and probed the GIN array index once per detail (18.4 s, 1.78M buffer hits per tick in production), and the coverage trigger's EXISTS overlap check ran as a cached generic plan that sequentially scanned worm_audit_chain for every inserted link. - worm-audit:13: worm_audit_chain_detail (detail_id PK, chain_id), one append-only row per covered detail, written by the chain trigger in the same statement as the link and backfilled under the chain advisory lock. WORM guards and grants like the other tables; no foreign keys. - The trigger inserts coverage rows and lets the primary key reject a detail covered twice. The purge deletes coverage before its links. - lateDetails probes the coverage primary key; both sweeps read only ids above per-JVM sweep floors, with a full sweep after restart and hourly. - Verification aggregates the chain's own detail lists once and breaks if the coverage table disagrees. Link hash inputs are unchanged. - Memory and H2 backends: the writer records coverage rows itself. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-15 07:40:33 -05:00
james.maes	3c083c996e	Merge pull request #13 from QRun-IO/feature/no-tokenless-session-at-produce ... fix(startup): read startup settings as the system user, not a tokenless session	2026-10-14 18:18:21 -05:00
james.maesandClaude Opus 5.5	6c3acb7e53	fix(startup): read startup settings as the system user, not a tokenless session ... produce() switched QContext to a plain new QSession() around addProcesses, which reads worm_audit_settings for the startup schedules. Token-based default authentication (OAuth2, Auth0) rejects any tokenless session that is not a QSystemUserSession, so on kof22 the read failed with JWTDecodeException: The token is null and the host could not start. Run the startup read as core QSystemUserSession(qInstance), the same pattern as qbit-object-storage#18. The persisted schedule settings still take effect at restart, as documented. TokenRequiredHostTest builds the host with a test authentication module that rejects tokenless sessions; it fails without this fix. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 18:14:50 -05:00
james.maes	ff0e5cbe73	Merge pull request #11 from QRun-IO/feature/foreign-keys ... feat(ddl): RESTRICT foreign keys for chain, export and verification	2026-10-14 18:00:28 -05:00
james.maesandClaude Opus 5.5	2b66492571	Merge origin/develop into feature/foreign-keys ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 17:48:16 -05:00
james.maes	062a95e30a	Merge pull request #12 from QRun-IO/feature/tables-populated-defaults ... feat(help): guided empty states for every worm_audit table; remove dead seed()	2026-10-14 17:15:42 -05:00
james.maesandClaude Opus 5.5	4d2a735992	fix(settings): keep seed() as deprecated API, fix docs ... Restore WormAuditSettings.seed() (public since RC.2) as @Deprecated: still the way memory and H2 hosts create row 1. Fix README, CHANGELOG order and UPGRADE. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 17:09:42 -05:00
james.maesandClaude Opus 5.5	a2fad5103d	feat(help): guided empty states for every worm_audit table ... Add help/qbit-worm-audit.yaml for the app and all six tables, applied by the WormAuditHelp stand-in. Remove the dead WormAuditSettings.seed(): the database script is the single seed and read() falls back to the configured values. Add WormAuditTablesGuardrailTest and a settings-seed test on H2. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 16:52:15 -05:00
james.maesandClaude Opus 5.5	4194837610	feat(ddl): RESTRICT foreign keys for chain, export and verification ... worm-audit:11 indexes and worm-audit:12 adds foreign keys, ON DELETE RESTRICT only, so nothing cascades into or out of audit evidence: - worm_audit_chain.audit_id -> core audit header. worm_audit_purge deletes details, then links, then headers (links and headers in one statement), which the constraint allows; the purge acceptance test passes with it. - worm_audit_export.from/to_checkpoint_id -> worm_audit_checkpoint and worm_audit_verification.export_id -> worm_audit_export: neither parent is ever deleted, and both are written before the row that names them. References to chain links (checkpoint/export/verification ranges, first_break_link_id, the purge anchor) stay unconstrained: the retention purge deletes the sealed prefix those rows outlive. The guardrail test lists them with reasons and fails on any new unconstrained reference. Rows whose parent is already missing are evidence: they are copied to qqq_fk_quarantine (action KEPT), never changed, and leave that constraint NOT VALID (still enforced for new rows). The block is idempotent, as the rendered DDL is applied more than once. With the key, a plain TRUNCATE of a referenced table is refused by PostgreSQL before the guard trigger; TRUNCATE ... CASCADE reaches the guards. The grants test now checks both. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 16:33:18 -05:00
james.maes	5736bf3e1f	Merge pull request #10 from QRun-IO/feature/settings ... feat: in-app WORM Audit Settings and GOVERNANCE lock mode	2026-10-14 12:26:51 -05:00
james.maesandClaude Opus 5.5	f14a24fdbf	feat: in-app WORM Audit Settings and GOVERNANCE lock mode for sealed exports ... Owner decisions 2026-10-14: - worm_audit_settings: one audited, editable row (changeset worm-audit:10, seeded insert-only) holding audit retention years, export lock mode (GOVERNANCE default, COMPLIANCE), export retention days (30), checkpoint cadence, chain interval, settle horizon, late-detail lookback and the export/verify schedules; edits are FIELD-audited and therefore chained; schedules apply after restart, the rest on the next run (30 s cache); - exporter and verifier honour the recorded lock mode and retain-until; the home shows the mode and warns while GOVERNANCE is in use or the export retention is shorter than audit retention; - README: Settings and Switching sealed exports to COMPLIANCE; DESIGN addendum; screenshots of the home and the Settings record. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 12:23:52 -05:00
james.maes	0fb9e8912c	Merge pull request #9 from QRun-IO/feature/orb-0.6.9 ... ci: qqq-orb 0.6.9 (refresh SNAPSHOT dependencies)	2026-10-14 10:46:49 -05:00
james.maesandClaude Opus 5.5	626e153841	ci: qqq-orb 0.6.9 (refresh SNAPSHOT dependencies) ... Moves qqq-orb@0.6.8 to qqq-orb@0.6.9, which passes --update-snapshots so cached SNAPSHOT dependencies are re-checked on every build (QRun-IO/qqq-orb#22). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 10:08:11 -05:00
james.maes	85de1daf79	Merge pull request #8 from QRun-IO/feature/app-home ... feat: WORM Audit app home, declared alerts and record screens	2026-10-14 07:09:35 -05:00
james.maes	be26a370ac	Merge pull request #7 from QRun-IO/feature/sealed-exports ... feat: sealed exports to S3 Object Lock and the export verifier	2026-10-14 07:09:21 -05:00
james.maes	3c6e7d57a2	Merge pull request #6 from QRun-IO/feature/chain ... feat: append-only audit tables, hash chain, checkpoints and verification	2026-10-14 07:09:09 -05:00
james.maesandClaude Opus 5.5	4b6717ebdd	feat: WORM Audit app home, setup warnings, declared alerts and record screens ... Phase (c) of docs/DESIGN.md: - the WORM Audit app and home: chain status, export status, retention, recent purges and setup warnings (missing triggers, owner role, signing and trusted keys, bucket without Object Lock, stale verification), plus a summary card for host dashboards; no audit content is rendered; - alert types renamed to wormaudit.* (core name pattern) and declared, with daily heartbeat monitors; - full verification holds one page plus one checkpoint range; - plain field labels, record labels, full-width sections and child lists; - a test-scope demo server and screenshots (home and records, light and dark, 390/1440/1920) with overflow checks; - DESIGN.md consistency edits (alert names, object_versions, s3:GetObjectVersion, snake_case columns). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-13 22:05:32 -05:00