Ordinary Sign out cleared only the QQQ session; the provider session left in the
browser silently signed the same person back in (prompt=login alone was already
observed reusing retained SSO on real Authentik). Sign out now runs the provider
end-session flow when the server supports it, and every sign-in also sends
max_age=0. Stored-session restore after sign-out was checked: not a cause.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
GET /qqq/v1/metaData returns about 1.7 MB and takes the server 4 to 8 s to
build; the default 10 s read timeout surfaced as 'Error loading QInstance:
timeout' on handhelds. Only the metadata call gets the long limit.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Core serializes QWidgetMetaData.icon as a string and QHelpContent may carry only a summary; the strict models failed loading the whole instance and echoPrint.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Commit 1d3847d deleted the entire tree (2584 files) and added nothing, so main was empty. This restores main to dc43a6a (the PR 22 merge) exactly.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Source checks, JVM unit tests, scanner lint, debug and QA APK assembly and
connected emulator tests run on every push via ci-workflows android.yaml.
vX.Y.Z tags publish the SDK AARs to the QRun-IO Gitea Maven registry.
Removes the retired CircleCI/qqq-orb configuration and the legacy GitHub
workflows.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Company sign-out on the MC9400 (production APK, real Authentik) never opened
the browser: QViewModel.performLogout ran the host beforeLogout hook (scanner
device-session end, which runs the core logout server-side) before the
provider logout request, so POST /qqq/v1/logout found no session and returned
no nativeLogoutData. Company sign-out now requests the provider material
first, then ends the host session (401 tolerated), then clears local state.
Ordinary sign-out keeps the host-hook-first order.
Browser login now adopts the server-reported values.user.name so Account no
longer shows a blank current user.
Adds QViewModelLogoutTest (ordering, failing host end, ordinary order, user
name adoption, ManageSessionResponse.userName parsing) and documents the
finding in AUTHENTICATION.md and SESSION-STATE.md.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Reset per-process widget state with the rest of the process view model.
A regression proves that step transitions retain feedback while reset drops it.
Verified 57 mobileapp JVM tests, scanner lint, debug assembly and source standards.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Add scan value and symbology feedback, optional status wallpaper and managed server/orientation configuration, proven AIM profile readback, and administrator-controlled viewing UI. Extend native Echo acceptance for per-scan copies and add an opt-in real-provider Authentik harness isolated to the disposable test package.
Verified: 222 JVM tests, lint with zero errors/warnings, debug/E2E/test APK builds, 23 Node tests and source standards. Updated TC22 Echo acceptance passes ten stages with simulated input/printing. Actual Authentik desktop acceptance passes; native Authentik and physical trigger/print validation remain pending. Normal TC22 updated with the matching signer and data preserved.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Capture exact SDK bytes before callback return and submit them through the existing process API only after same-server mobile-scanners 1.5 discovery. Preserve legacy server payloads and pending event retries; redact capture string representations. Verify 185 JVM tests, zero lint errors or warnings, debug/E2E builds and QA test compilation. Hardware AIM extraction and native delivery qualification remain open; the operator installation is unchanged.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Codex <noreply@openai.com>
Derive Origin from each QQQ request URL after caller headers so strict same-origin servers accept session heartbeats and process actions. Verify 174 JVM tests, lint, APK build, and actual TC22 sign-in, Echo setup and cancellation without clearing data.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Load named possible values through the published process API, honor dependent fields, discard stale responses and keep errors retryable. Add isolated native Echo coverage for setup, two accepted scans, recreation and Apps cancellation.
Validation: 169 JVM tests, zero-warning lint, 8 guard tests, source standards and real TC22 simulated Echo E2E pass; all 86 requests match the published semantic API. Physical printing remains pending.
Co-Authored-By: Claude <noreply@anthropic.com>
Preserve ownership notices, replace wildcard imports, document source contracts, enforce source checks and strict Kotlin warnings, and apply the repository native formatter policy. Correct typed widget state and callback registration with regression coverage.
Add bundled Query artwork, public Dogfooding and Query links, version and license access under Settings About. Validation:163 JVM cases,46 TC22 sample native cases, QA compilation, APK builds and lint0errors/0warnings. Full formatter CI and actual external-provider Android acceptance remain explicit.
Co-Authored-By: Codex <noreply@openai.com>
Use the optional device-provided EMDK service for normal scanner input,
with exact compile-only SDK provenance and no shipped vendor classes.
Keep synthetic scan broadcasts confined to the disposable E2E variant.
Pause input behind overlays and lost focus, and share live drawer-first
Back routing across every process/application handler and toolbar arrow.
Replace inherited Auth0/Coil prereleases with reviewed stable versions.
Invalidate standard generated notices on dependency graph changes and
retain strict runtime/license checks. Pin hosted acceptance to the
source-qualified API 1.9 core/server tuple with runtime provenance.
Validation: 127 JVM tests, 34 TC22 shared native cases, eight-overlay
native regression, and ordinary-UID/distinct-signer injection rejection
pass. Eight forged broadcasts cause no process/record mutation; a real
manual positive control saves through the API. All package/lint gates,
four-APK notice/DEX/native/manifest inspection, focused independent
source review, workflow syntax and staged secret checks pass.
Actual hardware triggers, configured provider, optional files deployment
and final signing/distribution remain separate documented release gates.
No normal operator installation or data was changed by these tests.
Co-Authored-By: OpenAI GPT-6.1 (Codex) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Bind password and legacy Auth0 responses to their initiating origin,
metadata and generation. Defer cookie adoption, consume exchanges once,
and revoke known abandoned sessions at their original server. Make
local logout independent of provider callbacks and idempotent across
overlapping calls, delayed storage and screen remounts.
Exclude sample session storage from backup and transfer, and restrict
sample cleartext environments to debug builds. Document the remaining
trusted-scanner input finding and the real-provider acceptance boundary.
Validation:109 JVM tests and scanner lint pass;32 selected TC22 native
tests pass, including ten new authentication lifecycle regressions.
Packaged unsigned sample release denies cleartext and backup, with all
ten cloud/device-transfer exclusions. Operator installation is unchanged.
Co-Authored-By: OpenAI GPT-6.1 (Codex) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Replace the permanent settled-scan navigation block with an explicit warning.
Keep the original retry identity through failed cancellation, and provide a
separate Leave anyway choice only after cancellation fails. In-flight work,
pending photos and complete receipt checks remain protected.
Add JVM and native regressions for lost or malformed acknowledgments, Stay,
cancel retries and explicit local exit without replaying a scan.
Co-Authored-By: GPT-6.1 Codex <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Consume Back when the drawer targets Open so a quick hardware press does not
exit the signed-out activity. Settle the native navigation test before Back
and retain the successful TC22 rerun: all 20 selected cases passed, including
seven synthetic AppAuth scenarios. Actual provider acceptance stays pending.
Co-Authored-By: GPT-6.1 Codex <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Use one hamburger drawer for apps, Settings and Diagnostics while preserving
guarded process Back, account access and approval restrictions.
Negotiate native OAuth2 login through the explicit UI API 1.9 capability,
server-advertised issuer/callback/prompt policy and AppAuth PKCE. Exchange
codes through QQQ with deferred cookie adoption and bounded cleanup of known
abandoned sessions. Keep TABLE_BASED and shared Auth0 behavior intact.
Add protocol and native regressions, retain bundled AppAuth attribution,
and pin the companion server heartbeat revocation correction in CI.
Co-Authored-By: GPT-6.1 Codex <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Discover compatible API versions, client channels and mobile extensions before login. Follow server process completion, metadata updates, form rules and cancellation, with isolated native OpenAPI conformance coverage.
Co-Authored-By: OpenAI GPT-6 (Codex) <noreply@openai.com>
james.maesandClaude Sonnet 5.5