docs(adr): record the 2.0 multi-server and wizard designs and the audit rubric #25

2026-11-10T19:56:47Z

james.maes commented

2026-11-10 19:56:47 +00:00

Adds the design records the rest of 2.0 is built against, and the audit rubric the release is judged by. Documentation only: three new files under docs/, no source, build or workflow file.

docs/adr/0004-multi-server-runtime.md: server identity and what is per server, stored state and journal scopes, the upgrade from 1.x step by step, the runtime structure, version 2 of the management pipe (error codes, concurrency, snapshot, removal), the command line, the certificate exception, and the decisions taken while working.
docs/adr/0005-connection-wizard-and-server-tree.md: the wizard's five steps, how pairing is tried before a choice is asked for, the tree, status and accessibility rules.
docs/AUDIT-2026-11-10.md: the release rule (9 or better on the eighteen code criteria), what a severity and a score mean, the rubric, the baseline scores and every finding with its status.

Review: an independent reviewer read the records against the code in four passes. The first found nine should-fix items, the second five, the third one (a certificate pin that would have broken at each renewal, withdrawn); the last pass reports nothing at should-fix or above. Its four closing wording notes are applied in the final commit.

Verification: no code changes, so the build and tests were not re-run for this pull request; the source-notice check passes.

🤖 Generated with Claude Code

Adds the design records the rest of 2.0 is built against, and the audit rubric the release is judged by. Documentation only: three new files under `docs/`, no source, build or workflow file. - `docs/adr/0004-multi-server-runtime.md`: server identity and what is per server, stored state and journal scopes, the upgrade from 1.x step by step, the runtime structure, version 2 of the management pipe (error codes, concurrency, snapshot, removal), the command line, the certificate exception, and the decisions taken while working. - `docs/adr/0005-connection-wizard-and-server-tree.md`: the wizard's five steps, how pairing is tried before a choice is asked for, the tree, status and accessibility rules. - `docs/AUDIT-2026-11-10.md`: the release rule (9 or better on the eighteen code criteria), what a severity and a score mean, the rubric, the baseline scores and every finding with its status. Review: an independent reviewer read the records against the code in four passes. The first found nine should-fix items, the second five, the third one (a certificate pin that would have broken at each renewal, withdrawn); the last pass reports nothing at should-fix or above. Its four closing wording notes are applied in the final commit. Verification: no code changes, so the build and tests were not re-run for this pull request; the source-notice check passes. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

james.maes added 9 commits 2026-11-10 19:56:47 +00:00

docs(adr): record the multi-server runtime, state and pipe design f7ecc968d7

ADR-0003 decided that the service keeps up to eight server connections.
ADR-0004 says how: a local identity per server, which state is per server
and which is per computer, where secrets and the journal live, how a 1.x
installation becomes the first server, the host / connection / printer
queue structure, the versioned pipe contract, the command line's server
selector and the companion's tree. It lists the isolation between
connections as a security boundary for the threat model, and the
decisions taken while working under the owner's direction of 2026-11-10.

Design only; nothing here is implemented yet.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
(cherry picked from commit 630532564a9deb94c326311468b1bc531daca5fa)

docs(adr): record the legacy-compat removal and the upgrade-test approval 1c94866b03

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
(cherry picked from commit e74908d20003bb200ad4cc8704eac4d3566e5e84)

docs(adr): record the connection wizard and server tree design 16f35dd426

ADR-0005 says what the wizard's five steps are and what each shows, that
pairing is detected by trying the ordinary bind first rather than chosen
from three options up front, what the tree contains, how status and busy
state are scoped per server, the accessibility rules, and that every
decision lives in the presentation assembly. Design only.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
(cherry picked from commit 9f341cb425d05a9f2a4bcf293a6772f8f35ea568)

docs: record the 2.0 audit rubric, baseline scores and findings 964fda7bc4

The 2.0 release is done only when fresh reviewers score every criterion
under code, design, architecture and security at 9 or better on the rubric
of the 2026-11-10 baseline audit. That rubric, the baseline scores and the
findings existed only in a working session. This file records them, with a
status per finding, so the re-audit is comparable and its result has a
place to go.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
(cherry picked from commit cf00e5a4208c3253d7478a8a27ce8715984268f9)

docs(audit): record findings carried into the wizard work and two open runtime findings baace4f846

The review of the presentation assembly found six shapes that one server and one dialog hide; they are recorded against the wizard and tree work instead of being fixed in the extraction. Two findings from the legacy polling removal and the enrollment reviews are recorded as open.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>

docs(adr): revise the 2.0 design records after independent review 58f9ffb80f

ADR-0004: an address is fixed and a server's scopes are recorded, so
history survives a new pairing and a removed server's rows are pruned;
the upgrade covers the staged session, a session without a pairing, the
certificate exception, interrupted moves and a newer schema; the pipe
contract gains its error codes, concurrency, removal with work in hand,
the snapshot's fields, the polling decision and the rule for the update
helper; the service runs the compatibility check and a server is added
together with its session; cleanup and limits become per server; the
spooler document name does not change. The access statements now match
the code, with the sign-out reply named as the one exception.

ADR-0005: the wizard tries the ordinary pairing and asks only on a
refusal it cannot explain; the check is the service's; browser sign-in
goes through one dispatcher; identifiers carry nothing machine-generated.

Audit: the release rule names its eighteen criteria, severities and
scores are defined, the standards revision is pinned, baseline scores
are separated from the rubric reviewers are given, and statuses cite the
change or branch.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>

docs(adr): close the gaps the second review found in the 2.0 design records cb8728c635

The printer queue keeps a server's claim order and takes servers in turn,
with no new deadline. The certificate exception becomes a pin for the
server's own origin; an exception carried over from 1.x is pinned on the
first connection. Every journal scope has a row, with a defined last use,
and the rules for a current scope, an earlier one and one with no server
are stated. The upgrade covers a pairing and a session for different
servers, gives every file move a terminal outcome, and records the
installer-rollback case as accepted. A newer schema and an unfinished
upgrade each get an error code and a field in the snapshot. Errors may
carry typed details, and operations on one server always name it.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>

docs(adr): keep the certificate exception a switch, and bound it to two origins 32c06f75d1

A pin on the accepted certificate would stop matching whenever a private
authority reissued it, which is the normal case for what the exception is
for, and unattended printing would stop with it. The exception stays a
development-only switch, limited to the server's origin and the sign-in
provider it names; the wizard offers the trusted root store as the lasting
fix; a server with the exception on says so for as long as it is on.

A newer schema and an unfinished upgrade now answer the same set of
operations, and say what servers.add gets.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>

docs(adr): align the wording of the certificate exception across the two records 420be10415

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>

james.maes merged commit 6fed9909be into release/2.0

2026-11-10 19:57:00 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qqq-print-agent#25