test(bom): resolve every stack artifact in qqq-all-bom-test (#3 )

Add a module that depends on each artifact the BOM manages and checks the effective POM, so the build fails if one stops resolving. Part of #1
build(bom): manage the qqq-all stack in qqq-all-bom (#3 )
2026-09-26 02:18:34 -05:00 · 2026-09-26 02:18:34 -05:00 · 2026-09-26 01:50:43 -05:00 · 2026-09-25 19:48:15 -05:00 · 2026-09-25 19:47:46 -05:00 · 2026-09-25 19:31:29 -05:00
19 changed files with 1425 additions and 0 deletions
@@ -0,0 +1,28 @@
+---
+
+version: 2.1
+
+orbs:
+  qqq-orb: kingsrook/qqq-orb@0.6.5
+
+commands:
+  configure-package-install:
+    steps:
+      - run:
+          name: Keep package installation unattended
+          command: |
+            # These build machines are discarded after the job.
+            # Use Ubuntu's archive mirror, which also carries the signed security suite.
+            sudo sed -i 's|http://security.ubuntu.com/ubuntu|https://archive.ubuntu.com/ubuntu|g' /etc/apt/sources.list
+            sudo install -d /etc/needrestart/conf.d
+            printf '%s\n' '$nrconf{restart} = "l";' | sudo tee /etc/needrestart/conf.d/99-qqq-ci.conf >/dev/null
+
+workflows:
+
+  # Build and unit tests on every branch push. Dependencies are public
+  # (Maven Central and the Central snapshot repository), so no context is needed.
+  test_only:
+    jobs:
+      - qqq-orb/mvn_test_only:
+          pre-steps:
+            - configure-package-install
@@ -0,0 +1,48 @@
+---
+name: Bug Report
+about: Report something in qqq-all that does not work
+title: "[BUG] "
+labels: bug
+assignees: ''
+
+---
+
+## Bug Description
+
+**Clear and concise description of what the bug is.**
+
+## Expected vs Actual Behavior
+
+**What you expected to happen:**
+- Expected behavior description
+
+**What actually happened:**
+- Actual behavior description
+
+## Steps to Reproduce
+
+1. Start the stack with '...'
+2. Go to '...'
+3. Click on '...'
+4. See error
+
+## Environment
+
+**qqq-all Version:** [e.g., 4.1.0-SNAPSHOT, 4.1.0]
+**Profile:** [core or full]
+**Java Version:** [e.g., 21]
+**Docker Version:** [if using the full profile]
+**OS:** [e.g., macOS 15, Ubuntu 24.04, Windows 11 with WSL]
+
+## Additional Context
+
+**Add any other context about the problem here:**
+
+- Screenshots (if applicable)
+- Error logs or stack traces
+- Related issues or pull requests
+
+## Before Submitting
+
+- [ ] Searched [existing issues](https://github.com/QRun-IO/qqq-all/issues) for duplicates
+- [ ] Checked whether this is a framework bug that belongs in [QRun-IO/qqq](https://github.com/QRun-IO/qqq/issues)
@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: QQQ Framework Issues
+    url: https://github.com/QRun-IO/qqq/issues
+    about: Bugs and feature requests for the QQQ framework itself
+  - name: QQQ Documentation Wiki
+    url: https://github.com/QRun-IO/qqq/wiki
+    about: Complete documentation, guides, and tutorials for QQQ
+  - name: GitHub Discussions
+    url: https://github.com/QRun-IO/qqq/discussions
+    about: Ask questions and discuss QQQ with the community
@@ -0,0 +1,42 @@
+---
+name: Documentation Issue
+about: Report documentation problems or suggest improvements
+title: "[DOCS] "
+labels: documentation
+assignees: ''
+
+---
+
+## Documentation Issue
+
+**What documentation issue are you reporting?**
+
+- [ ] **Missing Documentation** - Something is not documented
+- [ ] **Outdated Information** - Documentation is incorrect or outdated
+- [ ] **Unclear Content** - Documentation is confusing or hard to understand
+- [ ] **Missing Examples** - Need more examples or code samples
+- [ ] **Broken Links** - Links don't work or go to wrong places
+- [ ] **Other** - Please describe below
+
+## Description
+
+**Clear and concise description of the documentation issue:**
+
+## Location
+
+**Where is this documentation issue located?**
+- **File/Page**: [e.g., README.md, CONTRIBUTING.md]
+- **Section**: [e.g., "Quick Start"]
+- **URL**: [if applicable]
+
+## Suggested Improvement
+
+**How would you improve this documentation?**
+- What information should be added?
+- How could it be made clearer?
+- What examples would be helpful?
+
+## Before Submitting
+
+- [ ] Searched [existing issues](https://github.com/QRun-IO/qqq-all/issues) for similar documentation requests
+- [ ] Checked whether this is about framework docs that belong in the [QQQ Wiki](https://github.com/QRun-IO/qqq/wiki)
@@ -0,0 +1,37 @@
+---
+name: Feature Request
+about: Suggest something qqq-all should configure or demonstrate
+title: "[FEATURE] "
+labels: enhancement
+assignees: ''
+
+---
+
+## Feature Description
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like:**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered:**
+A clear and concise description of any alternative solutions or features you've considered.
+
+## Use Case
+
+**What is the use case for this feature?**
+- Which QQQ feature, backend, or qBit does it involve?
+- Which profile does it affect (`core`, `full`, or both)?
+- Who would benefit from it?
+
+## Implementation Ideas
+
+**Do you have any ideas about how this could be implemented?**
+- Technical approach suggestions
+- Any constraints or considerations
+
+## Before Submitting
+
+- [ ] Searched [existing issues](https://github.com/QRun-IO/qqq-all/issues) for similar requests
+- [ ] Checked whether this is a framework feature that belongs in [QRun-IO/qqq](https://github.com/QRun-IO/qqq/issues)
@@ -0,0 +1,52 @@
+# Pull Request
+
+## Description
+
+**What does this PR do?**
+A clear and concise description of what this pull request accomplishes.
+
+**Related Issue:**
+Closes #[issue_number]
+
+## Type of Change
+
+- [ ] **Bug Fix** - Fixes an existing issue
+- [ ] **New Feature** - Adds new functionality
+- [ ] **Breaking Change** - Fix or feature that would cause existing functionality to not work as expected
+- [ ] **Documentation Update** - Updates documentation
+- [ ] **Refactoring** - Code change that neither fixes a bug nor adds a feature
+- [ ] **Build / CI** - Changes to the Maven build, CircleCI, compose, or image
+- [ ] **Test Addition** - Adding missing tests or correcting existing tests
+
+## Testing
+
+**How has this been tested?**
+- [ ] **Unit Tests**: All unit tests pass
+- [ ] **Integration Tests**: Integration tests pass
+- [ ] **Profiles**: Checked the affected profile(s) (`core`, `full`)
+- [ ] **Manual Testing**: Tested manually in a development environment
+
+**Test Commands:**
+```bash
+# Commands used for testing, and their results
+mvn -B verify
+```
+
+## Checklist
+
+**Before submitting this PR, please ensure:**
+
+- [ ] **Code Style**: Follows QQQ's [Code Review Standards](https://github.com/QRun-IO/qqq/wiki/Code-Review-Standards)
+- [ ] **Tests**: All tests pass
+- [ ] **Documentation**: Updated the README or docs where behavior changed
+- [ ] **Secrets**: No secrets committed; any demo credentials are marked demo-only and overridable by env
+- [ ] **Breaking Changes**: Documented any breaking changes
+- [ ] **Commit Messages**: Follow conventional commit format
+- [ ] **Self Review**: Code has been reviewed by the author
+
+## Additional Information
+
+**Any additional information that reviewers should know:**
+- Screenshots (if applicable)
+- Dependencies added/removed
+- Migration notes
@@ -0,0 +1,50 @@
+target/
+*.iml
+.env
+/.env.local
+
+.idea
+.vscode
+.claude/
+CLAUDE.md
+
+#####################################
+## Eclipse / NVIM Modules for Java ##
+#####################################
+**/.settings/
+**/.classpath
+**/.factorypath
+**/.project
+
+#############################################
+## Original contents from github template: ##
+#############################################
+# Compiled class file
+*.class
+
+# Log file
+*.log
+
+# BlueJ files
+*.ctxt
+
+# Mobile Tools for Java (J2ME)
+.mtj.tmp/
+
+# Package Files #
+*.jar
+*.war
+*.nar
+*.ear
+*.zip
+*.tar.gz
+*.rar
+
+# virtual machine crash logs, see http://www.java.com/en/download/help/error_hotspot.xml
+hs_err_pid*
+
+.DS_Store
+*.swp
+.flattened-pom.xml
+dependency-reduced-pom.xml
+/.cache/
@@ -0,0 +1,78 @@
+# Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our community include:
+
+- **Demonstrating empathy and kindness** toward other people
+- **Being respectful** of differing opinions, viewpoints, and experiences
+- **Giving and gracefully accepting** constructive feedback
+- **Accepting responsibility** and apologizing to those affected by our mistakes
+- **Focusing on what is best** for the overall community
+
+Examples of unacceptable behavior include:
+
+- **The use of sexualized language or imagery**, and sexual attention or advances of any kind
+- **Trolling, insulting or derogatory comments**, and personal or political attacks
+- **Public or private harassment**
+- **Publishing others' private information**, such as a physical or email address, without their explicit permission
+- **Other conduct which could reasonably be considered inappropriate** in a professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of acceptable behavior and will take appropriate and fair corrective action in response to any behavior that they deem inappropriate, threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when an individual is officially representing the community in public spaces.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the community leaders responsible for enforcement at **contact@qrun.io**. All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+**Community Impact**: Use of inappropriate language or other behavior deemed unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing clarity around the nature of the violation and an explanation of why the behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+**Community Impact**: A violation through a single incident or series of actions.
+
+**Consequence**: A warning with consequences for continued behavior. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period of time. This includes avoiding interactions in community spaces as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban.
+
+### 3. Temporary Ban
+**Community Impact**: A serious violation of community standards, including sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public communication with the community for a specified period of time. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+**Community Impact**: Demonstrating a pattern of violation of community standards, including sustained inappropriate behavior, harassment of an individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org), version 2.0, available at [https://www.contributor-covenant.org/version/2/0/code_of_conduct.html](https://www.contributor-covenant.org/version/2/0/code_of_conduct.html).
+
+Community Impact Guidelines were inspired by [Mozilla's code of conduct enforcement ladder](https://github.com/mozilla/diversity).
+
+For answers to common questions about this code of conduct, see the FAQ at [https://www.contributor-covenant.org/faq](https://www.contributor-covenant.org/faq). Translations are available at [https://www.contributor-covenant.org/translations](https://www.contributor-covenant.org/translations).
+
+## Contact Information
+
+- **Community Leaders**: contact@qrun.io
+- **Security Issues**: security@qrun.io (see [SECURITY.md](SECURITY.md))
+- **Company**: QRunIO, LLC
+- **Website**: https://qrun.io
@@ -0,0 +1,46 @@
+# Contributing to qqq-all
+
+qqq-all is open source and welcomes contributions. It is the reference build of [QQQ](https://github.com/QRun-IO/qqq) with every feature configured, so most framework changes belong in QQQ or the relevant qBit; changes here wire those pieces together, add demo data, or fix the build. For framework guides, see the [QQQ Wiki](https://github.com/QRun-IO/qqq/wiki).
+
+## How to Contribute
+
+1. **Report issues.** Found a bug or want a feature in the demo stack? [Open an issue](https://github.com/QRun-IO/qqq-all/issues/new/choose). Framework bugs go to [QRun-IO/qqq](https://github.com/QRun-IO/qqq/issues).
+2. **Contribute code.** Branch from `develop` as `feature/<issue>-<short-description>` and open the pull request against `develop`.
+3. **Improve docs.** Documentation fixes are welcome in the same way as code.
+
+**Key requirements:**
+- Java 21 and Maven 3.8+
+- Follow QQQ's [Code Review Standards](https://github.com/QRun-IO/qqq/wiki/Code-Review-Standards)
+- Add or update tests for any behavior you change
+- Use [conventional commit](https://www.conventionalcommits.org/) messages
+- Never commit secrets; demo credentials must be marked demo-only and overridable by environment variables
+
+## Development Setup
+
+```bash
+git clone git@github.com:QRun-IO/qqq-all.git
+cd qqq-all
+mvn -B verify
+```
+
+qqq-all tracks the QQQ version. Until QQQ 4.1 ships, the build uses `4.1.0-SNAPSHOT` artifacts from the [Sonatype Central snapshot repository](https://central.sonatype.com/repository/maven-snapshots/), which the parent `pom.xml` already declares.
+
+## Contribution Checklist
+
+- [ ] `mvn -B verify` passes locally
+- [ ] Tests cover the change
+- [ ] Code follows QQQ's code style
+- [ ] Commit messages follow the conventional commit format
+- [ ] Docs updated where behavior changed
+
+## Getting Help
+
+- **[QQQ Wiki](https://github.com/QRun-IO/qqq/wiki)**: framework guides
+- **[Issues](https://github.com/QRun-IO/qqq-all/issues)**: search existing issues or open a new one
+- **[Discussions](https://github.com/QRun-IO/qqq/discussions)**: ask questions
+
+## Legal Notice
+
+When contributing to this project, you must agree that you have authored 100% of the content, that you have the necessary rights to the content, and that the content you contribute may be provided under the project license ([Apache-2.0](LICENSE)).
+
+Please follow our [Code of Conduct](CODE_OF_CONDUCT.md). Report security issues privately as described in [SECURITY.md](SECURITY.md).
@@ -0,0 +1,30 @@
+QQQ All
+Copyright 2026 QRunIO, LLC
+
+This product includes software developed at QRunIO, LLC (https://qrun.io/).
+
+Licensed under the Apache License, Version 2.0.
+
+================================================================================
+
+This software contains contributions from:
+
+- James Maes
+
+================================================================================
+
+Third-Party Licenses:
+
+This software depends on and may redistribute third-party open source software
+components, including the QQQ framework, qBits, JDBC drivers, and message broker
+clients. Each component has its own license. Please see the individual component
+documentation for license details.
+
+================================================================================
+
+Trademarks:
+
+QQQ, qBits, qRun, qStudio, and the QRunIO logo are trademarks of QRunIO, LLC.
+Use of these trademarks must comply with QRunIO's Trademark Guidelines.
+
+================================================================================
@@ -0,0 +1,28 @@
+# qqq-all
+
+QQQ with every feature configured and working out of the box: every storage backend, quick search, the ESB (ActiveMQ Artemis and RabbitMQ), OIDC, and the Next dashboard. It runs in two profiles: `core` (no containers, `java -jar`) and `full` (`docker compose --profile full up`).
+
+**Status:** under construction. qqq-all versions track QQQ and build on `4.1.0-SNAPSHOT` until QQQ 4.1 ships. See the [design](docs/design.md), the [plan](docs/plan.md), and the epic [#1](https://github.com/QRun-IO/qqq-all/issues/1). It is a local demo and reference build, not a production deployment.
+
+## Modules
+
+| Module | Purpose |
+|---|---|
+| `qqq-all-bom` | One tested version set for QQQ, the ESB, the Next dashboard, the included qBits, JDBC drivers, and broker clients |
+| `qqq-all-app` | The reference application with every backend, qBit, and the ESB wired, plus seeded demo data |
+
+## Build
+
+Requires Java 21 and Maven.
+
+```bash
+mvn -B verify
+```
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md), the [Code of Conduct](CODE_OF_CONDUCT.md), and the [security policy](SECURITY.md).
+
+## License
+
+Apache-2.0. See [LICENSE](LICENSE) and [NOTICE](NOTICE).
@@ -0,0 +1,53 @@
+# Security Policy
+
+## Supported Versions
+
+qqq-all versions track QQQ versions.
+
+| Version | Supported | Notes |
+| ------- | --------- | ----- |
+| 4.1.x   | Yes       | In development on `develop` (`4.1.0-SNAPSHOT`) until QQQ 4.1 ships |
+
+## Scope
+
+qqq-all is a local demo and reference build. It is not a production deployment: production still needs DNS, TLS, backups, monitoring, and highly available brokers. Any demo credentials in this repository are for local use only and must be overridden before exposing a stack to a network.
+
+Vulnerabilities in the QQQ framework or a qBit should be reported to that project. If you are unsure where an issue belongs, report it here and it will be routed.
+
+## Reporting a Vulnerability
+
+**Security vulnerabilities should NEVER be reported publicly.**
+
+### Private Reporting
+
+Use GitHub's private vulnerability reporting:
+**[Report a vulnerability](https://github.com/QRun-IO/qqq-all/security/advisories/new)**
+
+Or email: **security@qrun.io**
+
+### What to Include
+
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact
+- qqq-all version and profile (`core` or `full`), Java version, OS, and Docker version if relevant
+
+### Response Timeline
+
+| Stage | Timeline |
+|-------|----------|
+| Initial response | 24 hours |
+| Assessment | 3 business days |
+| Resolution | Based on severity |
+
+## For Contributors
+
+- Dependencies must not introduce HIGH or CRITICAL vulnerabilities
+- Secrets must never be committed
+- Follow QQQ's secure coding practices ([CODE_STYLE.md](https://github.com/QRun-IO/qqq/blob/develop/CODE_STYLE.md))
+
+## Contact
+
+- **Security issues**: security@qrun.io
+- **General contact**: contact@qrun.io
+- **Organization**: [QRun-IO](https://github.com/QRun-IO)
@@ -0,0 +1,33 @@
+# qqq-all — Design (approved 2026-09-25)
+
+## Goal
+One repo that gives a fully running QQQ app with every feature configured and working out of the box. New public repo `QRun-IO/qqq-all`, Apache-2.0. Version tracks qqq (4.1.x); builds on 4.1.0-SNAPSHOT until 4.1 ships.
+
+## What's in it
+- **Stack BOM** — one tested version set: qqq modules, `qqq-esb`, `qqq-frontend-next`, the included qbits, JDBC drivers, broker clients.
+- **Reference app** — every backend, qbit, and the ESB wired, with seeded demo data.
+- **Compose file** with two profiles.
+- **Image** on GHCR; CI boots the stack and runs smoke tests plus the ESB conformance suite.
+
+## Profiles
+- **`core`** — no containers, `java -jar`: H2, SQLite, local filesystem, embedded Artemis, mock auth.
+- **`full`** — `docker compose --profile full up`: Postgres, MySQL, MongoDB (replica set), MinIO (S3), SFTP, OpenSearch, ActiveMQ Artemis, RabbitMQ, Mailpit, Keycloak (demo admin and user accounts).
+
+## Qbits (v1)
+- **In:** quick-search, user-role-permissions, customizable-table-views, standard-process-trace, webhooks, workflows, geo-data, sftp-data-integration.
+- **Deferred:** crm (being rehabilitated for the Business Platform), wms (large), session-store (alpha), middleware-mcp (no auth), easypost / custom-apps / worm-audit (external keys or stubs).
+- Each included qbit is re-pinned to `qbit-build-parent` 2.0.0 (qqq 4.0.0) and verified against 4.1.0-SNAPSHOT (one PR per qbit repo); it moves to a 4.1 parent at 4.1 GA. Quick-search also gets its index-drift fix and repo cleanup.
+
+## Core prerequisites (qqq 4.1)
+- **Launcher** — one entry point that starts the web server, scheduler, and ESB when configured. Every app gets it, not just qqq-all.
+- **Fail-fast option** — a metadata producer that throws stops startup instead of logging a warning.
+
+## Demo
+- A small orders/customers domain that touches every feature: a table per backend, quick search on customers, order events on the ESB triggering a process, a workflow, webhooks, geo data, an SFTP import.
+- Admin sees everything, including the ESB app; the demo user sees a permission-limited view.
+
+## Limits
+Local demo and reference only. Production still needs DNS, TLS, backups, monitoring, and HA brokers.
+
+## Next
+Approve → issues (qqq-all epic, 2 core issues in qqq, one re-pin issue per qbit) → agents, after ESB wave 1 lands.
@@ -0,0 +1,136 @@
+# qqq-all Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: superpowers:subagent-driven-development. Each task is one GitHub issue and one PR. Work test-first; list the commands you ran and their results in the PR.
+
+**Goal:** A public repo that runs QQQ with every feature configured and working out of the box, published once qqq 4.1 ships with the ESB and the Next dashboard as default.
+
+**Design:** `docs/design.md` (approved 2026-09-25).
+
+**Depends on:** ESB epic QRun-IO/qqq#739 and Next-as-default QRun-IO/qqq#649, both in qqq 4.1.
+
+**Licensing:** do not change LICENSE files or source headers in any repo. Header/license alignment (several repos still carry AGPL headers and LICENSE files) is a separate owner decision.
+
+## Global Constraints
+
+- Java 21. qqq `4.1.0-SNAPSHOT` until 4.1 GA, then `4.1.x`. qqq-all version tracks qqq.
+- Repos use gitflow: branch from and PR to `develop` (qqq-frontend-next: `main`). Never force-push; never delete branches you didn't create.
+- Maven: never `mvn install` while other agents build; use `-pl … -am verify`.
+- QQQ code style and checkstyle of the target repo. New files in `qqq-all` use the Apache-2.0 header; in other repos copy a neighboring file's header.
+- No secrets in the repo. Demo credentials live only in `compose.yaml` and the Keycloak realm file, are marked demo-only, and are overridable by env.
+- Releases, tags, and Maven Central or GHCR publishing of release versions: ask James first.
+
+## Tasks
+
+### Core prerequisites (QRun-IO/qqq, ship in 4.1)
+
+**A1. Application launcher.** One entry point that starts everything configured.
+- `qqq-backend-core`: `QRuntimeServiceInterface { String getName(); void start(QInstance); void stop(); }`, `QInstance.withRuntimeService(QCodeReference)` / `getRuntimeServices()`.
+- `qqq-middleware-javalin`: `QApplicationLauncher.run(AbstractQQQApplication, QApplicationLauncherConfig)`. It creates `QApplicationJavalinServer` for the app and reuses the instance that server builds (never a second instance; add a `getQInstance()` getter to the server if it lacks one), then starts:
+  - `QApplicationJavalinServer`;
+  - `QScheduleManager` when the instance has schedules or scheduled jobs;
+  - each registered runtime service.
+  A JVM shutdown hook stops them in reverse order.
+- `qqq-esb`: `EsbInstanceMetaData.enrich` registers `QEsbRuntime` as a runtime service. This part waits for ESB task 10 (QRun-IO/qqq#748).
+- Tests: start order, reverse stop order, a service failing to start stops the ones already started and fails the launch, and the scheduler is skipped when nothing is scheduled.
+
+**A2. Fail-fast metadata producers.** With `QInstance.withFailOnMetaDataProducerError(true)` (or system property `qqq.metaData.failOnProducerError=true`), `MetaDataProducerHelper` throws wherever it currently logs a warning and drops a producer (evaluating a candidate producer class during discovery, and executing a producer). The default is unchanged. Tests cover both modes.
+
+### Qbit re-pins (one per repo)
+
+**B1–B8.** Repos: `qbit-quick-search`, `qbit-user-role-permissions`, `qbit-customizable-table-views`, `qbit-standard-process-trace`, `qbit-webhooks`, `qbit-workflows`, `qbit-geo-data`, `qbit-sftp-data-integration`.
+
+Each:
+1. If `main` has commits not in `develop`, open a back-merge PR (`main` → `develop`) first. Resolve conflicts keeping develop's features and main's fixes; no force-push.
+2. Parent → `com.kingsrook:qbit-build-parent:2.0.0` (imports `qqq-bom-pom` 4.0.0). Remove child `qqq-bom-pom` imports that shadow the parent. Java 21. Leave LICENSE files and headers as they are.
+3. Build and test green on the parent's qqq 4.0.0. Also add an opt-in Maven profile `qqq-snapshot` that imports `qqq-bom-pom:${qqq.snapshot.version}` (default `4.1.0-SNAPSHOT`) ahead of the parent's BOM and adds the Central snapshots repository (`https://central.sonatype.com/repository/maven-snapshots/`); `-Pqqq-snapshot` must also build and test green. (The parent has no qqq-version property to override.) The move to a 4.1 parent happens at 4.1 GA (task C9).
+4. Integration tests that need Docker fail, not skip, when `CI=true`.
+5. Remove explicit qqq module `<version>`s in the child pom so the BOM (or the `qqq-snapshot` profile) controls them — `qbit-workflows` pins them explicitly on develop.
+
+**B1 extra (quick-search):**
+- Fix index drift: update and delete re-index or remove documents, and add a reconcile process that rebuilds the index from the source table.
+- Remove the stray root `com/` directory and `.claude/settings.local.json`, and add `.claude/settings.local.json` to `.gitignore`.
+
+### qqq-all repo (QRun-IO/qqq-all)
+
+**C1. Bootstrap.**
+- README, NOTICE, CODE_OF_CONDUCT, CONTRIBUTING, SECURITY (adapted from qqq), `.github` issue and PR templates, `.gitignore`.
+- CircleCI using `qqq-orb`: build plus unit tests on PRs.
+- Maven reactor: parent `pom.xml` with modules `qqq-all-bom` and `qqq-all-app`.
+
+**C2. Stack BOM (`qqq-all-bom`).**
+- Imports `qqq-bom-pom`.
+- Manages: `qqq-esb`, `qqq-frontend-next`, the 8 qbits, JDBC drivers (PostgreSQL, MySQL, SQLite, H2), the ActiveMQ Artemis Jakarta client, and `rabbitmq-jms` 3.9.0.
+- A test resolves every managed artifact.
+
+**C3. Reference app, `core` profile (`qqq-all-app`).**
+- `QqqAllApplication` starts through `QApplicationLauncher` (A1) with fail-fast producers on (A2).
+- Demo domain: customers, orders, order lines, products, with seed data. Backends: H2, SQLite, and the local filesystem. Embedded Artemis for the ESB. Mock auth with admin and demo users.
+- ESB: `order` publishes to topic `orderEvents`, and process `syncOrder` is triggered from it.
+- Serves the Next dashboard.
+- Tests: boots with `java -jar`, health returns 200, every table queries, and the ESB round trip works.
+
+**C4. `full` profile wiring.**
+- Env-driven backends: PostgreSQL, MySQL, MongoDB (replica set), S3 (MinIO), SFTP.
+- ESB on both Artemis and RabbitMQ (one destination each).
+- SMTP to Mailpit.
+- OIDC through Keycloak (the OAuth2 module), with roles mapped to permissions via `qbit-user-role-permissions`.
+- Profile selected by `QQQ_ALL_PROFILE=core|full`.
+
+**C5. Qbits wired.** All 8 qbits are wired into the app and used by the demo:
+- quick search on customers (OpenSearch in `full`, disabled with a notice in `core`);
+- a table view, a process trace, a webhook, a workflow, geo data on addresses, and an SFTP import.
+
+**C6. Compose and image.**
+- `compose.yaml` with profiles `core` and `full`, healthchecks, and `.env.example`.
+- Keycloak realm JSON (demo admin and user). Mongo replica-set init. MinIO bucket init. SFTP (atmoz/sftp). OpenSearch single-node. Artemis with Jolokia. RabbitMQ management.
+- `Dockerfile`: Java 21 JRE, non-root user, healthcheck.
+- CI publishes `ghcr.io/qrun-io/qqq-all:develop` (public) on develop merges.
+
+**C7. CI smoke and conformance.**
+- CI boots `core` via `java -jar` and `full` via `docker compose --profile full up -d --wait`.
+- Assertions: health 200; the Next UI is served; each backend's table queries; quick search finds a seeded customer; the ESB round trip works on both brokers; OIDC login works for the demo users.
+- The ESB round trip runs against both compose brokers (the qqq-esb conformance suite itself starts its own containers and stays in qqq CI).
+
+**C8. Docs.**
+- README quick start (one command per profile) and a feature tour mapping each QQQ feature to where the demo shows it.
+- Limits: local demo and reference only; production needs DNS, TLS, backups, monitoring, HA brokers.
+
+**C9. Publish (after qqq 4.1 GA with ESB and Next default; ask James first).**
+- Release a `qbit-build-parent` that imports the 4.1 BOM, re-pin the 8 qbits to it, and release them.
+- Pin qqq 4.1.x.
+- Tag `4.1.0`.
+- Publish the image and `qqq-all-bom` release.
+- GitHub release with `compose.yaml`.
+
+## Issues
+
+Epic: QRun-IO/qqq-all#1.
+
+| Task | Issue | Task | Issue |
+|---|---|---|---|
+| A1 | QRun-IO/qqq#762 | C1 | QRun-IO/qqq-all#2 |
+| A2 | QRun-IO/qqq#763 | C2 | #3 |
+| B1 quick-search | QRun-IO/qbit-quick-search#6 | C3 | #4 |
+| B2 user-role-permissions | QRun-IO/qqq#764 | C4 | #5 |
+| B3 customizable-table-views | #765 (qqq) | C5 | #6 |
+| B4 standard-process-trace | #766 (qqq) | C6 | #7 |
+| B5 webhooks | #767 (qqq) | C7 | #8 |
+| B6 workflows | #768 (qqq) | C8 | #9 |
+| B7 geo-data | #769 (qqq) | C9 | #10 |
+| B8 sftp-data-integration | #770 (qqq) | | |
+
+Most qbit repos have issues disabled, so their tasks are tracked in QRun-IO/qqq.
+
+## Waves
+
+| Wave | Tasks | Needs |
+|---|---|---|
+| Q1 | A2, B1–B8, C1 | — |
+| Q2 | C2 | B1–B8 merged, C1 |
+| Q3 | A1 | ESB task 10 (qqq#748) merged |
+| Q4 | C3 | A1, A2, C2; ESB tasks 8, 10, 14 (qqq#746, #748, #751) |
+| Q5 | C4 | C3 |
+| Q6 | C5 | C4 |
+| Q7 | C6, C8 | C5 |
+| Q8 | C7 | C6; ESB epic complete |
+| Q9 | C9 | qqq 4.1 GA (ESB + Next default); James's go-ahead |
@@ -0,0 +1,125 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+   <modelVersion>4.0.0</modelVersion>
+
+   <groupId>com.kingsrook.qqq</groupId>
+   <artifactId>qqq-all-parent</artifactId>
+   <version>${revision}</version>
+   <packaging>pom</packaging>
+
+   <name>QQQ All</name>
+   <description>QQQ with every feature configured and working out of the box: a tested stack BOM and a reference application.</description>
+   <url>https://github.com/QRun-IO/qqq-all</url>
+   <licenses>
+      <license>
+         <name>Apache License, Version 2.0</name>
+         <url>https://www.apache.org/licenses/LICENSE-2.0.txt</url>
+         <distribution>repo</distribution>
+      </license>
+   </licenses>
+   <scm>
+      <connection>scm:git:https://github.com/QRun-IO/qqq-all.git</connection>
+      <developerConnection>scm:git:ssh://git@github.com/QRun-IO/qqq-all.git</developerConnection>
+      <url>https://github.com/QRun-IO/qqq-all</url>
+      <tag>HEAD</tag>
+   </scm>
+   <developers>
+      <developer>
+         <id>kingsrook</id>
+         <name>Kingsrook, LLC</name>
+         <email>pub@qrun.io</email>
+         <organization>Kingsrook, LLC</organization>
+         <organizationUrl>https://qrun.io</organizationUrl>
+      </developer>
+   </developers>
+
+   <modules>
+      <module>qqq-all-bom</module>
+      <module>qqq-all-bom-test</module>
+      <module>qqq-all-app</module>
+   </modules>
+
+   <properties>
+      <!-- qqq-all versions track QQQ versions. -->
+      <revision>4.1.0-SNAPSHOT</revision>
+
+      <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+      <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
+      <maven.compiler.release>21</maven.compiler.release>
+   </properties>
+
+   <repositories>
+      <!-- QQQ 4.1.0-SNAPSHOT and other QRun-IO snapshots are published here until 4.1 ships. -->
+      <repository>
+         <id>central-portal-snapshots</id>
+         <name>Sonatype Central Portal Snapshots</name>
+         <url>https://central.sonatype.com/repository/maven-snapshots/</url>
+         <releases>
+            <enabled>false</enabled>
+         </releases>
+         <snapshots>
+            <enabled>true</enabled>
+            <updatePolicy>always</updatePolicy>
+         </snapshots>
+      </repository>
+   </repositories>
+
+   <build>
+      <pluginManagement>
+         <!-- Pinned because CI's system Maven (3.6.3) defaults to plugins that predate maven.compiler.release and JUnit 5. -->
+         <plugins>
+            <plugin>
+               <groupId>org.apache.maven.plugins</groupId>
+               <artifactId>maven-resources-plugin</artifactId>
+               <version>3.3.1</version>
+            </plugin>
+            <plugin>
+               <groupId>org.apache.maven.plugins</groupId>
+               <artifactId>maven-compiler-plugin</artifactId>
+               <version>3.14.1</version>
+            </plugin>
+            <plugin>
+               <groupId>org.apache.maven.plugins</groupId>
+               <artifactId>maven-surefire-plugin</artifactId>
+               <version>3.5.4</version>
+            </plugin>
+            <plugin>
+               <groupId>org.apache.maven.plugins</groupId>
+               <artifactId>maven-jar-plugin</artifactId>
+               <version>3.4.2</version>
+            </plugin>
+         </plugins>
+      </pluginManagement>
+      <plugins>
+         <!-- Resolve ${revision} in installed and deployed POMs (CI sets it per branch). -->
+         <plugin>
+            <groupId>org.codehaus.mojo</groupId>
+            <artifactId>flatten-maven-plugin</artifactId>
+            <version>1.7.3</version>
+            <configuration>
+               <updatePomFile>true</updatePomFile>
+               <flattenMode>resolveCiFriendliesOnly</flattenMode>
+            </configuration>
+            <executions>
+               <execution>
+                  <id>flatten</id>
+                  <phase>process-resources</phase>
+                  <goals>
+                     <goal>flatten</goal>
+                  </goals>
+               </execution>
+               <execution>
+                  <id>flatten.clean</id>
+                  <phase>clean</phase>
+                  <goals>
+                     <goal>clean</goal>
+                  </goals>
+               </execution>
+            </executions>
+         </plugin>
+      </plugins>
+   </build>
+
+</project>
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+   <modelVersion>4.0.0</modelVersion>
+
+   <parent>
+      <groupId>com.kingsrook.qqq</groupId>
+      <artifactId>qqq-all-parent</artifactId>
+      <version>${revision}</version>
+   </parent>
+
+   <artifactId>qqq-all-app</artifactId>
+   <packaging>jar</packaging>
+
+   <name>QQQ All - Reference Application</name>
+   <description>Reference QQQ application with every backend, qBit, and the ESB wired, plus seeded demo data.</description>
+
+</project>
@@ -0,0 +1,254 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ Copyright 2026 QRunIO, LLC
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~     http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+   <modelVersion>4.0.0</modelVersion>
+
+   <parent>
+      <groupId>com.kingsrook.qqq</groupId>
+      <artifactId>qqq-all-parent</artifactId>
+      <version>${revision}</version>
+   </parent>
+
+   <artifactId>qqq-all-bom-test</artifactId>
+   <packaging>jar</packaging>
+
+   <name>QQQ All - Stack BOM Test</name>
+   <description>Resolves every artifact the stack BOM manages. Build-time check only; not published.</description>
+
+   <properties>
+      <maven.deploy.skip>true</maven.deploy.skip>
+   </properties>
+
+   <dependencyManagement>
+      <dependencies>
+         <dependency>
+            <groupId>com.kingsrook.qqq</groupId>
+            <artifactId>qqq-all-bom</artifactId>
+            <version>${project.version}</version>
+            <type>pom</type>
+            <scope>import</scope>
+         </dependency>
+      </dependencies>
+   </dependencyManagement>
+
+   <!-- One versionless dependency per artifact the BOM manages, so resolving this -->
+   <!-- module's test classpath resolves each of them. StackBomTest fails if one is missing. -->
+   <dependencies>
+      <!-- QQQ modules, qqq-esb, and qqq-frontend-next (from qqq-bom-pom) -->
+      <dependency>
+         <groupId>com.kingsrook.qqq</groupId>
+         <artifactId>qqq-backend-core</artifactId>
+         <scope>test</scope>
+      </dependency>
+      <dependency>
+         <groupId>com.kingsrook.qqq</groupId>
+         <artifactId>qqq-backend-module-rdbms</artifactId>
+         <scope>test</scope>
+      </dependency>
+      <dependency>
+         <groupId>com.kingsrook.qqq</groupId>
+         <artifactId>qqq-backend-module-mongodb</artifactId>
+         <scope>test</scope>
+      </dependency>
+      <dependency>
+         <groupId>com.kingsrook.qqq</groupId>
+         <artifactId>qqq-backend-module-api</artifactId>
+         <scope>test</scope>
+      </dependency>
+      <dependency>
+         <groupId>com.kingsrook.qqq</groupId>
+         <artifactId>qqq-backend-module-filesystem</artifactId>
+         <scope>test</scope>
+      </dependency>
+      <dependency>
+         <groupId>com.kingsrook.qqq</groupId>
+         <artifactId>qqq-backend-module-sqlite</artifactId>
+         <scope>test</scope>
+      </dependency>
+      <dependency>
+         <groupId>com.kingsrook.qqq</groupId>
+         <artifactId>qqq-backend-module-postgres</artifactId>
+         <scope>test</scope>
+      </dependency>
+      <dependency>
+         <groupId>com.kingsrook.qqq</groupId>
+         <artifactId>qqq-middleware-javalin</artifactId>
+         <scope>test</scope>
+      </dependency>
+      <dependency>
+         <groupId>com.kingsrook.qqq</groupId>
+         <artifactId>qqq-middleware-slack</artifactId>
+         <scope>test</scope>
+      </dependency>
+      <dependency>
+         <groupId>com.kingsrook.qqq</groupId>
+         <artifactId>qqq-middleware-api</artifactId>
+         <scope>test</scope>
+      </dependency>
+      <dependency>
+         <groupId>com.kingsrook.qqq</groupId>
+         <artifactId>qqq-openapi</artifactId>
+         <scope>test</scope>
+      </dependency>
+      <dependency>
+         <groupId>com.kingsrook.qqq</groupId>
+         <artifactId>qqq-middleware-picocli</artifactId>
+         <scope>test</scope>
+      </dependency>
+      <dependency>
+         <groupId>com.kingsrook.qqq</groupId>
+         <artifactId>qqq-middleware-lambda</artifactId>
+         <scope>test</scope>
+      </dependency>
+      <dependency>
+         <groupId>com.kingsrook.qqq</groupId>
+         <artifactId>qqq-middleware-health</artifactId>
+         <scope>test</scope>
+      </dependency>
+      <dependency>
+         <groupId>com.kingsrook.qqq</groupId>
+         <artifactId>qqq-language-support-javascript</artifactId>
+         <scope>test</scope>
+      </dependency>
+      <dependency>
+         <groupId>com.kingsrook.qqq</groupId>
+         <artifactId>qqq-utility-lambdas</artifactId>
+         <scope>test</scope>
+      </dependency>
+      <dependency>
+         <groupId>com.kingsrook.qqq</groupId>
+         <artifactId>qqq-esb</artifactId>
+         <scope>test</scope>
+      </dependency>
+      <dependency>
+         <groupId>com.kingsrook.qqq</groupId>
+         <artifactId>qqq-frontend-next</artifactId>
+         <scope>test</scope>
+      </dependency>
+
+      <!-- qBits -->
+      <dependency>
+         <groupId>com.kingsrook.qbits</groupId>
+         <artifactId>qbit-quick-search</artifactId>
+         <scope>test</scope>
+      </dependency>
+      <dependency>
+         <groupId>com.kingsrook.qbits</groupId>
+         <artifactId>qbit-user-role-permissions</artifactId>
+         <scope>test</scope>
+      </dependency>
+      <dependency>
+         <groupId>com.kingsrook.qbits</groupId>
+         <artifactId>qbit-customizable-table-views</artifactId>
+         <scope>test</scope>
+      </dependency>
+      <dependency>
+         <groupId>com.kingsrook.qbits</groupId>
+         <artifactId>qbit-standard-process-trace</artifactId>
+         <scope>test</scope>
+      </dependency>
+      <dependency>
+         <groupId>com.kingsrook.qbits</groupId>
+         <artifactId>qbit-webhooks</artifactId>
+         <scope>test</scope>
+      </dependency>
+      <dependency>
+         <groupId>com.kingsrook.qbits</groupId>
+         <artifactId>qbit-workflows</artifactId>
+         <scope>test</scope>
+      </dependency>
+      <dependency>
+         <groupId>com.kingsrook.qbits</groupId>
+         <artifactId>qbit-geo-data</artifactId>
+         <scope>test</scope>
+      </dependency>
+      <dependency>
+         <groupId>com.kingsrook.qbits</groupId>
+         <artifactId>qbit-sftp-data-integration</artifactId>
+         <scope>test</scope>
+      </dependency>
+
+      <!-- JDBC drivers -->
+      <dependency>
+         <groupId>org.postgresql</groupId>
+         <artifactId>postgresql</artifactId>
+         <scope>test</scope>
+      </dependency>
+      <dependency>
+         <groupId>com.mysql</groupId>
+         <artifactId>mysql-connector-j</artifactId>
+         <scope>test</scope>
+      </dependency>
+      <dependency>
+         <groupId>org.xerial</groupId>
+         <artifactId>sqlite-jdbc</artifactId>
+         <scope>test</scope>
+      </dependency>
+      <dependency>
+         <groupId>com.h2database</groupId>
+         <artifactId>h2</artifactId>
+         <scope>test</scope>
+      </dependency>
+
+      <!-- Broker clients -->
+      <dependency>
+         <groupId>org.apache.artemis</groupId>
+         <artifactId>artemis-jakarta-client</artifactId>
+         <scope>test</scope>
+      </dependency>
+      <dependency>
+         <groupId>com.rabbitmq.jms</groupId>
+         <artifactId>rabbitmq-jms</artifactId>
+         <scope>test</scope>
+      </dependency>
+
+      <!-- Test framework (not part of the stack) -->
+      <dependency>
+         <groupId>org.junit.jupiter</groupId>
+         <artifactId>junit-jupiter</artifactId>
+         <version>6.0.2</version>
+         <scope>test</scope>
+      </dependency>
+   </dependencies>
+
+   <build>
+      <plugins>
+         <!-- Writes the effective POM (BOM imports expanded) for StackBomTest to read. -->
+         <plugin>
+            <groupId>org.apache.maven.plugins</groupId>
+            <artifactId>maven-help-plugin</artifactId>
+            <version>3.5.2</version>
+            <executions>
+               <execution>
+                  <id>effective-pom</id>
+                  <phase>generate-test-resources</phase>
+                  <goals>
+                     <goal>effective-pom</goal>
+                  </goals>
+                  <configuration>
+                     <output>${project.build.directory}/effective-pom.xml</output>
+                  </configuration>
+               </execution>
+            </executions>
+         </plugin>
+      </plugins>
+   </build>
+
+</project>
@@ -0,0 +1,225 @@
+/*
+ * Copyright 2026 QRunIO, LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qqq.all.bom;
+
+
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.TreeSet;
+import java.util.stream.Collectors;
+import javax.xml.parsers.DocumentBuilderFactory;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.w3c.dom.Document;
+import org.w3c.dom.Element;
+import org.w3c.dom.Node;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+
+/*******************************************************************************
+ ** Checks qqq-all-bom through this module's effective POM, which Maven writes
+ ** with the BOM imports expanded: the BOM manages the whole stack, and this
+ ** module depends on every stack artifact the BOM manages, so the build
+ ** resolves each one.
+ *******************************************************************************/
+class StackBomTest
+{
+   private static final Path EFFECTIVE_POM = Path.of("target", "effective-pom.xml");
+   private static final Path BOM_POM       = Path.of("..", "qqq-all-bom", "pom.xml");
+
+   private static List<Coordinate> managed;
+   private static List<Coordinate> dependencies;
+   private static List<Coordinate> bomDeclared;
+
+
+
+   /*******************************************************************************
+    ** Read the managed and declared dependencies from the effective POM.
+    *******************************************************************************/
+   @BeforeAll
+   static void beforeAll() throws Exception
+   {
+      Element effectivePom = parse(EFFECTIVE_POM);
+      managed = readDependencies(child(effectivePom, "dependencyManagement"));
+      dependencies = readDependencies(effectivePom);
+
+      bomDeclared = readDependencies(child(parse(BOM_POM), "dependencyManagement")).stream()
+         .filter(coordinate -> !"import".equals(coordinate.scope()))
+         .toList();
+   }
+
+
+
+   /*******************************************************************************
+    ** The BOM manages every artifact the qqq-all stack is built from.
+    *******************************************************************************/
+   @Test
+   void testManagesTheStack()
+   {
+      Map<String, String> managedVersions = managed.stream().collect(Collectors.toMap(Coordinate::key, Coordinate::version));
+
+      List<String> required = List.of(
+         "com.kingsrook.qqq:qqq-backend-core",
+         "com.kingsrook.qqq:qqq-esb",
+         "com.kingsrook.qqq:qqq-frontend-next",
+         "com.kingsrook.qbits:qbit-quick-search",
+         "com.kingsrook.qbits:qbit-user-role-permissions",
+         "com.kingsrook.qbits:qbit-customizable-table-views",
+         "com.kingsrook.qbits:qbit-standard-process-trace",
+         "com.kingsrook.qbits:qbit-webhooks",
+         "com.kingsrook.qbits:qbit-workflows",
+         "com.kingsrook.qbits:qbit-geo-data",
+         "com.kingsrook.qbits:qbit-sftp-data-integration",
+         "org.postgresql:postgresql",
+         "com.mysql:mysql-connector-j",
+         "org.xerial:sqlite-jdbc",
+         "com.h2database:h2",
+         "org.apache.artemis:artemis-jakarta-client",
+         "com.rabbitmq.jms:rabbitmq-jms");
+
+      List<String> missing = required.stream().filter(key -> !managedVersions.containsKey(key)).toList();
+      assertEquals(List.of(), missing, "Artifacts the stack BOM does not manage");
+      assertEquals("3.9.0", managedVersions.get("com.rabbitmq.jms:rabbitmq-jms"));
+   }
+
+
+
+   /*******************************************************************************
+    ** This module depends on every stack artifact the BOM manages, so resolving
+    ** its test classpath resolves each one from the configured repositories.
+    **
+    ** Stack artifacts are the managed com.kingsrook artifacts (qqq modules,
+    ** qqq-esb, qqq-frontend-next, qBits) plus everything qqq-all-bom declares
+    ** itself. The third-party entries qqq-bom-pom inherits from its parent
+    ** (Jackson, Netty, Jetty, and others) only align versions, so they are
+    ** resolved when something depends on them rather than here.
+    *******************************************************************************/
+   @Test
+   void testDependsOnEveryStackArtifact()
+   {
+      Set<String> stack = managed.stream()
+         .filter(coordinate -> coordinate.groupId().startsWith("com.kingsrook."))
+         .map(Coordinate::key)
+         .collect(Collectors.toCollection(TreeSet::new));
+      bomDeclared.forEach(coordinate -> stack.add(coordinate.key()));
+
+      Set<String> declared = dependencies.stream().map(Coordinate::key).collect(Collectors.toSet());
+
+      List<String> notResolved = stack.stream().filter(key -> !declared.contains(key)).toList();
+      assertEquals(List.of(), notResolved, "Stack artifacts missing from qqq-all-bom-test's dependencies, so the build does not resolve them");
+   }
+
+
+
+   /*******************************************************************************
+    ** Parse a POM file and return its project element.
+    *******************************************************************************/
+   private static Element parse(Path pom) throws Exception
+   {
+      Document document = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(pom.toFile());
+      return (document.getDocumentElement());
+   }
+
+
+
+   /*******************************************************************************
+    ** Read the dependency elements directly under parent's dependencies element.
+    *******************************************************************************/
+   private static List<Coordinate> readDependencies(Element parent)
+   {
+      List<Coordinate> coordinates = new ArrayList<>();
+      for(Element dependency : children(child(parent, "dependencies"), "dependency"))
+      {
+         coordinates.add(new Coordinate(
+            text(dependency, "groupId", null),
+            text(dependency, "artifactId", null),
+            text(dependency, "version", null),
+            text(dependency, "type", "jar"),
+            text(dependency, "classifier", ""),
+            text(dependency, "scope", "compile")));
+      }
+      return (coordinates);
+   }
+
+
+
+   /*******************************************************************************
+    ** The single child element with the given name.
+    *******************************************************************************/
+   private static Element child(Element parent, String name)
+   {
+      List<Element> matches = children(parent, name);
+      assertEquals(1, matches.size(), "Expected one <" + name + "> under <" + parent.getTagName() + ">");
+      return (matches.get(0));
+   }
+
+
+
+   /*******************************************************************************
+    ** The child elements with the given name (direct children only, so plugin
+    ** dependencies are not mistaken for project dependencies).
+    *******************************************************************************/
+   private static List<Element> children(Element parent, String name)
+   {
+      List<Element> matches = new ArrayList<>();
+      for(Node node = parent.getFirstChild(); node != null; node = node.getNextSibling())
+      {
+         if(node instanceof Element element && element.getTagName().equals(name))
+         {
+            matches.add(element);
+         }
+      }
+      return (matches);
+   }
+
+
+
+   /*******************************************************************************
+    ** Text of the named child element, or defaultValue when it is absent.
+    *******************************************************************************/
+   private static String text(Element parent, String name, String defaultValue)
+   {
+      List<Element> matches = children(parent, name);
+      return (matches.isEmpty() ? defaultValue : matches.get(0).getTextContent().trim());
+   }
+
+
+
+   /*******************************************************************************
+    ** A dependency coordinate; key() is how Maven matches a dependency to its
+    ** managed entry.
+    *******************************************************************************/
+   private record Coordinate(String groupId, String artifactId, String version, String type, String classifier, String scope)
+   {
+      /***************************************************************************
+       **
+       ***************************************************************************/
+      String key()
+      {
+         String key = groupId + ":" + artifactId;
+         if(!type.equals("jar") || !classifier.isEmpty())
+         {
+            key += ":" + type + (classifier.isEmpty() ? "" : ":" + classifier);
+         }
+         return (key);
+      }
+   }
+
+}
@@ -0,0 +1,130 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+   <modelVersion>4.0.0</modelVersion>
+
+   <parent>
+      <groupId>com.kingsrook.qqq</groupId>
+      <artifactId>qqq-all-parent</artifactId>
+      <version>${revision}</version>
+   </parent>
+
+   <artifactId>qqq-all-bom</artifactId>
+   <packaging>pom</packaging>
+
+   <name>QQQ All - Stack BOM</name>
+   <description>One tested version set for QQQ, the ESB, the Next dashboard, the included qBits, JDBC drivers, and broker clients.</description>
+
+   <properties>
+      <qqq.version>4.1.0-SNAPSHOT</qqq.version>
+
+      <!-- qBits: develop builds on qbit-build-parent 2.0.0; none has a release on that parent yet. -->
+      <qbit-quick-search.version>0.2.1-SNAPSHOT</qbit-quick-search.version>
+      <qbit-user-role-permissions.version>0.33.0-SNAPSHOT</qbit-user-role-permissions.version>
+      <qbit-customizable-table-views.version>0.5.0-SNAPSHOT</qbit-customizable-table-views.version>
+      <qbit-standard-process-trace.version>0.3.0-SNAPSHOT</qbit-standard-process-trace.version>
+      <qbit-webhooks.version>0.4.0-SNAPSHOT</qbit-webhooks.version>
+      <qbit-workflows.version>0.114.0-SNAPSHOT</qbit-workflows.version>
+      <qbit-geo-data.version>0.2.0-SNAPSHOT</qbit-geo-data.version>
+      <qbit-sftp-data-integration.version>0.4.0-SNAPSHOT</qbit-sftp-data-integration.version>
+
+      <!-- The versions qqq 4.1 builds and tests its backend modules and qqq-esb with. -->
+      <postgresql.version>42.7.12</postgresql.version>
+      <mysql-connector-j.version>9.5.0</mysql-connector-j.version>
+      <sqlite-jdbc.version>3.51.1.0</sqlite-jdbc.version>
+      <h2.version>2.4.240</h2.version>
+      <artemis.version>2.57.0</artemis.version>
+      <rabbitmq-jms.version>3.9.0</rabbitmq-jms.version>
+   </properties>
+
+   <dependencyManagement>
+      <dependencies>
+         <!-- QQQ modules, qqq-esb, and qqq-frontend-next. -->
+         <dependency>
+            <groupId>com.kingsrook.qqq</groupId>
+            <artifactId>qqq-bom-pom</artifactId>
+            <version>${qqq.version}</version>
+            <type>pom</type>
+            <scope>import</scope>
+         </dependency>
+
+         <!-- qBits -->
+         <dependency>
+            <groupId>com.kingsrook.qbits</groupId>
+            <artifactId>qbit-quick-search</artifactId>
+            <version>${qbit-quick-search.version}</version>
+         </dependency>
+         <dependency>
+            <groupId>com.kingsrook.qbits</groupId>
+            <artifactId>qbit-user-role-permissions</artifactId>
+            <version>${qbit-user-role-permissions.version}</version>
+         </dependency>
+         <dependency>
+            <groupId>com.kingsrook.qbits</groupId>
+            <artifactId>qbit-customizable-table-views</artifactId>
+            <version>${qbit-customizable-table-views.version}</version>
+         </dependency>
+         <dependency>
+            <groupId>com.kingsrook.qbits</groupId>
+            <artifactId>qbit-standard-process-trace</artifactId>
+            <version>${qbit-standard-process-trace.version}</version>
+         </dependency>
+         <dependency>
+            <groupId>com.kingsrook.qbits</groupId>
+            <artifactId>qbit-webhooks</artifactId>
+            <version>${qbit-webhooks.version}</version>
+         </dependency>
+         <dependency>
+            <groupId>com.kingsrook.qbits</groupId>
+            <artifactId>qbit-workflows</artifactId>
+            <version>${qbit-workflows.version}</version>
+         </dependency>
+         <dependency>
+            <groupId>com.kingsrook.qbits</groupId>
+            <artifactId>qbit-geo-data</artifactId>
+            <version>${qbit-geo-data.version}</version>
+         </dependency>
+         <dependency>
+            <groupId>com.kingsrook.qbits</groupId>
+            <artifactId>qbit-sftp-data-integration</artifactId>
+            <version>${qbit-sftp-data-integration.version}</version>
+         </dependency>
+
+         <!-- JDBC drivers -->
+         <dependency>
+            <groupId>org.postgresql</groupId>
+            <artifactId>postgresql</artifactId>
+            <version>${postgresql.version}</version>
+         </dependency>
+         <dependency>
+            <groupId>com.mysql</groupId>
+            <artifactId>mysql-connector-j</artifactId>
+            <version>${mysql-connector-j.version}</version>
+         </dependency>
+         <dependency>
+            <groupId>org.xerial</groupId>
+            <artifactId>sqlite-jdbc</artifactId>
+            <version>${sqlite-jdbc.version}</version>
+         </dependency>
+         <dependency>
+            <groupId>com.h2database</groupId>
+            <artifactId>h2</artifactId>
+            <version>${h2.version}</version>
+         </dependency>
+
+         <!-- Broker clients for qqq-esb -->
+         <dependency>
+            <groupId>org.apache.artemis</groupId>
+            <artifactId>artemis-jakarta-client</artifactId>
+            <version>${artemis.version}</version>
+         </dependency>
+         <dependency>
+            <groupId>com.rabbitmq.jms</groupId>
+            <artifactId>rabbitmq-jms</artifactId>
+            <version>${rabbitmq-jms.version}</version>
+         </dependency>
+      </dependencies>
+   </dependencyManagement>
+
+</project>
Author	SHA1	Message	Date
james.maes	9236276b9c	test(bom): resolve every stack artifact in qqq-all-bom-test (#3 ) Add a module that depends on each artifact the BOM manages and checks the effective POM, so the build fails if one stops resolving. Part of #1	2026-09-26 02:18:34 -05:00
james.maes	d061a61f6b	build(bom): manage the qqq-all stack in qqq-all-bom (#3 ) Import qqq-bom-pom 4.1.0-SNAPSHOT and manage the 8 qBits, JDBC drivers, and the Artemis and RabbitMQ JMS clients. Part of #1	2026-09-26 02:18:34 -05:00
james.maes	8390cfc535	build: bootstrap repo, Maven reactor, and CircleCI (#12 ) Closes #2. Part of #1.	2026-09-26 01:50:43 -05:00
james.maes	d45ee4e4c5	Merge pull request #11 from QRun-IO/feature/GH-1-plan-and-design docs: qqq-all design and implementation plan (#1)	2026-09-25 19:48:15 -05:00
james.maesandClaude Opus 5.5	a5c3651239	docs: apply round-2 review suggestions Apache-2.0 headers for new qqq-all files, launcher getter note, explicit qbit version pins, C7 broker round trip, C4/C5 sequenced, ESB task 14 in C3 dependencies. Part of #1 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-25 19:47:46 -05:00
james.maesandClaude Opus 5.5	730434fa5c	docs: resolve plan review findings Real verification path for qbits on 4.1.0-SNAPSHOT (opt-in profile), design wording aligned to the 4.0.0 parent, launcher reuses the server-built instance, waves split so no task waits on its own wave, licensing left unchanged pending an owner decision. Part of #1 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-25 19:31:29 -05:00
james.maesandClaude Opus 5.5	9192ac5778	docs: add qqq-all design and implementation plan Part of #1 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-25 19:15:09 -05:00