qqq-all C9: publish 4.1 after QQQ GA and full smoke #10

New Issue

2026-09-26T00:14:30Z

KofTwentyTwo commented

2026-09-26 00:14:30 +00:00

(Migrated from github.com)

Part of #1. Publish only after QQQ 4.1 GA, the accepted Next default, and the complete qqq-all smoke gate are green. The owner has authorized the release after those gates; no separate C9 approval is needed.

RC8 update (2026-10-01): PR26, signed aafc96a, pins public Next1.0.0-RC.8. The owner accepted its documented RC limitations (decision); local Java/Python/core/full smoke passed with two existing opt-in Java skips retained. Hosted checks are pending. This updates snapshot integration, not final GA acceptance. MaterialRC2 publication is now started through normally merged PR161; the historical provider-proof publication hold was corrected, while #892's secret disposition remains unresolved. See corrected release tracking. Earlier checkpoint facts below remain historical.

Current checkpoint: 2026-10-01 07:36 UTC. Release preparation #20, runtime completion #22/combined #19, documentation PR23 and notice packaging PR25 are merged. Current verified develop is signed 59e606418c26b58b3d44b7bf89c1767d10377e8f, tree d496620fb45f35c498510f6bb31993059aea01e7, matching reviewed PR25. Exact postmerge Smoke36817821008 passed core/full, and Circle30 passed. Image36817820987 passed application verification but skipped Docker login/build/push at the public-visibility gate. No image or GA artifacts were published.

Framework backend ESB implementation children are closed, and its docs/packaging integration at 9e322b3337259e890f61399aba014a7318c86d49 passed all postmerge prerequisites and snapshot publisher4597. Framework #943 and Material #942 have actual public snapshot notice/signature proof. These results do not replace immutable RC/GA dependencies or accepted Next integration. At 07:34 UTC, eight supporting PRs still require eligible GitHub reviews, #892 still lacks provider revocation evidence, and anonymous GHCR access returns403 with no package-write scope available through the CLI. Next remains separately owned; its current PR14 Firefox and mobile/tablet acceptance checks fail. Keep all release conditions below.

The previous public ESB-package/process-publishing blocker is resolved: public ESB 4.1.0-20260930.034648-22 matches merged QQQ e0d57dd and includes the required APIs. Fresh public-only, initially empty-cache verification passed 28 executed Java tests (two existing opt-in skips), 24 Python tests, and core/full Compose, including real OIDC, OpenSearch, Artemis and RabbitMQ completion publication. Independent review passed. #22 head 6df9f086 passed all hosted core/full/CircleCI checks; its signed squash ce464ffb has the same source tree. #19 passed Smoke 36740809979 (core/full) and CircleCI job 25 before merging. Exact develop push Smoke36741556295 passed core/full, and CircleCI26 passed. Image workflow36741556319 passed application verification but skipped image publication at its package-visibility gate; this is not published-image evidence. C7 #8 and runtime assembly #21 are closed. Snapshot compatibility and the selected Next 1.0.0-RC.1 do not establish GA/full UI acceptance.

Release order and remaining acceptance:

Consume released QQQ 4.1 BOM with ESB and an accepted Next default. QQQ 4.1 GA remains required; coordinate framework release gates in QRun-IO/qqq#790/#798, including supporting license disposition QRun-IO/qqq#923.
#19 is merged and exact develop push Smoke36741556295 passed both profiles; #8/#21 are complete. Repeat the release smoke on the final released-dependency commit. RabbitMQ process-completion publication is proven with public snapshot artifacts.
Release a successor of qbit-build-parent:2.0.0 importing the released 4.1 BOM (QRun-IO/qbit-bom#4). Re-pin, verify and release all eight included qbits against it: quick-search, user-role-permissions, customizable-table-views, standard-process-trace, webhooks, workflows, geo-data and sftp-data-integration. Record every published artifact/version before updating qqq-all. All nine parent/qbit CI updates to qqq-orb0.6.8 passed hosted checks; geo-data#5 and workflows#8 are merged. The other six qbits and qbit-bom#5 require eligible GitHub approving reviews. Future GA POM proposals remain uncommitted.
Replace the snapshot BOM and parent/qbit pins with released versions. Verify the complete reactor and a fresh public consumer. Publish both qqq-all-parent and qqq-all-bom so the BOM works outside this repository.
The gated manual release workflow and Central publication profile are implemented in #20. Bootstrap the first GHCR image, set the package public and verify an unauthenticated pull before enabling publication. Verify the existing workflow controls and secrets; do not treat their implementation as a successful release. The develop workflow currently requires an already-public package.
After all release gates pass, create the annotated 4.1.0 tag, run the gated release workflow against the exact successful develop smoke, publish the versioned image and GitHub release with compose.yaml, and verify public artifacts and a fresh Compose startup using the published image.

Quick-search is public. The stable orb prerequisite is resolved through qqq-orb0.6.8; supporting license choices, formal branch reviews and the public release chain remain explicit gates. Historical comments below are retained as earlier checkpoints, not current failure claims.

Part of #1. Publish only after QQQ 4.1 GA, the accepted Next default, and the complete qqq-all smoke gate are green. The owner has authorized the release after those gates; no separate C9 approval is needed. RC8 update (2026-10-01): [PR26](https://github.com/QRun-IO/qqq-all/pull/26), signed `aafc96a`, pins public Next1.0.0-RC.8. The owner accepted its documented RC limitations ([decision](https://github.com/QRun-IO/qqq/issues/798#issuecomment-5930629521)); local Java/Python/core/full smoke passed with two existing opt-in Java skips retained. Hosted checks are pending. This updates snapshot integration, not final GA acceptance. MaterialRC2 publication is now started through normally merged PR161; the historical provider-proof publication hold was corrected, while #892's secret disposition remains unresolved. See [corrected release tracking](https://github.com/QRun-IO/qqq/issues/921#issuecomment-5930824088). Earlier checkpoint facts below remain historical. Current checkpoint: 2026-10-01 07:36 UTC. Release preparation #20, runtime completion #22/combined #19, documentation PR23 and notice packaging PR25 are merged. Current verified develop is signed `59e606418c26b58b3d44b7bf89c1767d10377e8f`, tree `d496620fb45f35c498510f6bb31993059aea01e7`, matching reviewed PR25. Exact postmerge [Smoke36817821008](https://github.com/QRun-IO/qqq-all/actions/runs/36817821008) passed core/full, and Circle30 passed. Image36817820987 passed application verification but skipped Docker login/build/push at the public-visibility gate. No image or GA artifacts were published. Framework backend ESB implementation children are closed, and its docs/packaging integration at `9e322b3337259e890f61399aba014a7318c86d49` passed all postmerge prerequisites and snapshot publisher4597. Framework #943 and Material #942 have actual public snapshot notice/signature proof. These results do not replace immutable RC/GA dependencies or accepted Next integration. At 07:34 UTC, eight supporting PRs still require eligible GitHub reviews, #892 still lacks provider revocation evidence, and anonymous GHCR access returns403 with no package-write scope available through the CLI. Next remains separately owned; its current PR14 Firefox and mobile/tablet acceptance checks fail. Keep all release conditions below. The previous public ESB-package/process-publishing blocker is resolved: public ESB 4.1.0-20260930.034648-22 matches merged QQQ e0d57dd and includes the required APIs. Fresh public-only, initially empty-cache verification passed 28 executed Java tests (two existing opt-in skips), 24 Python tests, and core/full Compose, including real OIDC, OpenSearch, Artemis and RabbitMQ completion publication. Independent review passed. #22 head 6df9f086 passed all hosted core/full/CircleCI checks; its signed squash ce464ffb has the same source tree. #19 passed Smoke 36740809979 (core/full) and CircleCI job 25 before merging. Exact develop push [Smoke36741556295](https://github.com/QRun-IO/qqq-all/actions/runs/36741556295) passed core/full, and CircleCI26 passed. Image workflow36741556319 passed application verification but skipped image publication at its package-visibility gate; this is not published-image evidence. C7 #8 and runtime assembly #21 are closed. Snapshot compatibility and the selected Next 1.0.0-RC.1 do not establish GA/full UI acceptance. Release order and remaining acceptance: 1. Consume released QQQ 4.1 BOM with ESB and an accepted Next default. QQQ 4.1 GA remains required; coordinate framework release gates in QRun-IO/qqq#790/#798, including supporting license disposition QRun-IO/qqq#923. 2. #19 is merged and exact develop push Smoke36741556295 passed both profiles; #8/#21 are complete. Repeat the release smoke on the final released-dependency commit. RabbitMQ process-completion publication is proven with public snapshot artifacts. 3. Release a successor of qbit-build-parent:2.0.0 importing the released 4.1 BOM (QRun-IO/qbit-bom#4). Re-pin, verify and release all eight included qbits against it: quick-search, user-role-permissions, customizable-table-views, standard-process-trace, webhooks, workflows, geo-data and sftp-data-integration. Record every published artifact/version before updating qqq-all. All nine parent/qbit CI updates to qqq-orb0.6.8 passed hosted checks; geo-data#5 and workflows#8 are merged. The other six qbits and qbit-bom#5 require eligible GitHub approving reviews. Future GA POM proposals remain uncommitted. 4. Replace the snapshot BOM and parent/qbit pins with released versions. Verify the complete reactor and a fresh public consumer. Publish both qqq-all-parent and qqq-all-bom so the BOM works outside this repository. 5. The gated manual release workflow and Central publication profile are implemented in #20. Bootstrap the first GHCR image, set the package public and verify an unauthenticated pull before enabling publication. Verify the existing workflow controls and secrets; do not treat their implementation as a successful release. The develop workflow currently requires an already-public package. 6. After all release gates pass, create the annotated 4.1.0 tag, run the gated release workflow against the exact successful develop smoke, publish the versioned image and GitHub release with compose.yaml, and verify public artifacts and a fresh Compose startup using the published image. Quick-search is public. The stable orb prerequisite is resolved through qqq-orb0.6.8; supporting license choices, formal branch reviews and the public release chain remain explicit gates. Historical comments below are retained as earlier checkpoints, not current failure claims.

KofTwentyTwo commented

2026-09-26 18:03:33 +00:00

(Migrated from github.com)

Current eight-qbit develop POM audit (2026-09-26; recheck at release): each still inherits qbit-build-parent:2.0.0 and has a snapshot revision. Present next-version candidates are quick-search 0.2.1, user-role-permissions 0.33.0, customizable-table-views 0.5.0, standard-process-trace 0.3.0, webhooks 0.4.0, workflows 0.114.0, geo-data parent 0.2.0, and sftp-data-integration 0.4.0. These are source revisions, not published release evidence. The parent must first import the public QQQ 4.1 BOM and be released; then each qbit needs a reviewed parent re-pin, build, tag and public artifact verification before qqq-all can replace its snapshot pins. The parent currently uses qqq-orb 0.5.0, so qqq-orb#12/PR #13 and a stable pin are also on the critical path.

Current eight-qbit develop POM audit (2026-09-26; recheck at release): each still inherits `qbit-build-parent:2.0.0` and has a snapshot revision. Present next-version candidates are quick-search 0.2.1, user-role-permissions 0.33.0, customizable-table-views 0.5.0, standard-process-trace 0.3.0, webhooks 0.4.0, workflows 0.114.0, geo-data parent 0.2.0, and sftp-data-integration 0.4.0. These are source revisions, not published release evidence. The parent must first import the public QQQ 4.1 BOM and be released; then each qbit needs a reviewed parent re-pin, build, tag and public artifact verification before qqq-all can replace its snapshot pins. The parent currently uses qqq-orb 0.5.0, so qqq-orb#12/PR #13 and a stable pin are also on the critical path.

KofTwentyTwo commented

2026-09-26 18:31:23 +00:00

(Migrated from github.com)

C7 full-smoke diagnosis: QQQ #786 does publish the exact syncOrder.completed RabbitMQ JMS TextMessage, with the UUID matching the Artemis trace. Draft PR #19 timed out because RabbitMQ management returns a base64 JMS transport envelope rather than plain JSON. Signed PR #19 commit cd9168f now checks the decoded event through QQQ #788’s permission-scoped ESB browse endpoint, scans pages, and seeds admin ESB grants. All 22 Python smoke tests and Maven verify pass; independent review passes. A combined QQQ #786/#788 full-profile Compose run and PR CI are still required before #19 can merge. Existing volumes need the documented idempotent grant step.

C7 full-smoke diagnosis: QQQ #786 does publish the exact `syncOrder.completed` RabbitMQ JMS TextMessage, with the UUID matching the Artemis trace. Draft PR #19 timed out because RabbitMQ management returns a base64 JMS transport envelope rather than plain JSON. Signed PR #19 commit `cd9168f` now checks the decoded event through QQQ #788’s permission-scoped ESB browse endpoint, scans pages, and seeds admin ESB grants. All 22 Python smoke tests and Maven verify pass; independent review passes. A combined QQQ #786/#788 full-profile Compose run and PR CI are still required before #19 can merge. Existing volumes need the documented idempotent grant step.

KofTwentyTwo commented

2026-09-29 01:20:51 +00:00

(Migrated from github.com)

Public-chain readiness checkpoint (2026-09-28; no publication): anonymous Central confirms QQQ BOM4.1.0, proposed qbit-build-parent2.1.0 and all eight C9 candidate qBit versions are unavailable (404). Quick-search is public; its existing0.2.0 POM/JAR download anonymously. All eight audited main tips are ancestors of develop; previous B1–B8 re-pins/geo flattening are merged, so no new back-merge is needed. The existing table-views#5 and orb#13 work was preserved.

Prepared local-only candidate patches at each current remote SHA: parent2.1.0 importsQQQ4.1.0; eight qBits inherit2.1.0 and retain the candidate versions already recorded above; qqq-all sets4.1.0 and all eight release pins. Seven qBit GA jobs currently also accept ordinary main pushes; prepared tag-only filter corrections preserve existing v-tag, snapshot, RC, hotfix and test behavior. XML/YAML scope checks and48 branch/tag checks pass; existing qqq-all release-gate tests4/4 pass. Fresh Maven model validation blocks before compilation on absent publicQQQ4.1.0. None of this claims public-consumer acceptance. Patches remain uncommitted/unpushed for review and real public-dependency gates.

Remaining authorities: QQQ#790 formalGA/Next gates; qqq-orb#12/PR13 reviewed stable release and exact tested pins; qbit-bom#4 parent release; this issue owns all eight subsequent releases and final distribution. PR22 publicActions36497593319 is still a missing-ESB-package compile mismatch, not a test failure; local a511834 +QQQ549 core/full/OIDC/broker proof is separately PASS. GHCR lookup returned404; first-public-image/anonymous-pull and #20 manual publication controls remain outstanding. No default branch, license, source runtime, Next, tag, version, or image was changed remotely. Durable table, exactSHAs and patches are in workspace evidence public-release-chain-20260928/READINESS.md.

Public-chain readiness checkpoint (2026-09-28; no publication): anonymous Central confirms QQQ BOM4.1.0, proposed qbit-build-parent2.1.0 and all eight C9 candidate qBit versions are unavailable (404). Quick-search is public; its existing0.2.0 POM/JAR download anonymously. All eight audited main tips are ancestors of develop; previous B1–B8 re-pins/geo flattening are merged, so no new back-merge is needed. The existing table-views#5 and orb#13 work was preserved. Prepared local-only candidate patches at each current remote SHA: parent2.1.0 importsQQQ4.1.0; eight qBits inherit2.1.0 and retain the candidate versions already recorded above; qqq-all sets4.1.0 and all eight release pins. Seven qBit GA jobs currently also accept ordinary main pushes; prepared tag-only filter corrections preserve existing v-tag, snapshot, RC, hotfix and test behavior. XML/YAML scope checks and48 branch/tag checks pass; existing qqq-all release-gate tests4/4 pass. Fresh Maven model validation blocks before compilation on absent publicQQQ4.1.0. None of this claims public-consumer acceptance. Patches remain uncommitted/unpushed for review and real public-dependency gates. Remaining authorities: QQQ#790 formalGA/Next gates; qqq-orb#12/PR13 reviewed stable release and exact tested pins; qbit-bom#4 parent release; this issue owns all eight subsequent releases and final distribution. PR22 publicActions36497593319 is still a missing-ESB-package compile mismatch, not a test failure; local a511834 +QQQ549 core/full/OIDC/broker proof is separately PASS. GHCR lookup returned404; first-public-image/anonymous-pull and #20 manual publication controls remain outstanding. No default branch, license, source runtime, Next, tag, version, or image was changed remotely. Durable table, exactSHAs and patches are in workspace evidence public-release-chain-20260928/READINESS.md.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qqq-all#10