* ci: centralize All builds smoke checks and releases
Use orb 0.7.9 and its immutable shared release worker. Build once, preserve core/full verification and conditional public GHCR delivery, and consume public Circle provenance without exporting a token.
Co-Authored-By: Codex <noreply@openai.com>
* fix: use shared SDK v2 S3 support for MinIO
Replace obsolete SDK v1 client overrides with upstream endpoint and path-style metadata. Preserve endpoint coverage for every filesystem action and local HTTP listing/write assertions.
Co-Authored-By: Codex <noreply@openai.com>
* test: verify the HttpOnly OIDC session contract
Current QQQ omits the session UUID from JSON for HttpOnly cookies. Require the nonempty HttpOnly cookie and reject exposed UUIDs, retaining authenticated backend and permission checks.
Co-Authored-By: Codex <noreply@openai.com>
* fix: accept leading-dash Mongo credentials in Compose
Use explicit username/password option assignments in health and replica-set initialization. Reproduced the original failure and verified authenticated ping with the corrected arguments against mongo:7 and a leading-dash fixture password.
Co-Authored-By: Codex <noreply@openai.com>
---------
Co-authored-by: Codex <noreply@openai.com>
james.maesandCodex
cc89f73680