QDG Identity change log

Document version: 1.0.0. Updated 6 September 2026.

Identity 0.2.0 and KB MCP 1.2.0 preparation

Added the shared Auth0 token verifier, current subject permissions, stable request identity, exact MCP discovery and a bounded local synthetic pilot. The KB integration preserves all ten tools, adds current tool-level permission checks and commits identity audit with each permitted content write.

Added explicitly activated emergency reads for one approved Robert identity, with an absolute maximum one-hour lifetime, current policy enforcement and durable audit before data release. It is disabled by default and permits no writes or automatic fallback. Added private credential preparation that never activates service access or prints a token.

Added the read-only Odin collector, the reviewed deployment controller and its semantic probes. The workflow binds exact host/configuration/artifact hashes, detects drift, stages offline, protects backups, stops only KB MCP and requires verified canaries. Recovery preserves current denials and refuses an automatic return to retired static authentication.

Confirmed day-one scope: QDG Knowledge Base MCP only, with new OAuth credentials independent of existing QDBAuth credentials. Other services and websites retain their current authentication until individually migrated after the first service is verified.

Adopted the non-conflicting Start_Project standards: confirmed Python plus PowerShell, QDG Identity as the Knowledge Base project, the four standard pages, a consolidated changelog/handover, script versions and the existing Git/immutable-release archive approach.

Published Project Description, User Guide and How to Use with content readback verification. These explain OAuth usage, architecture and reasoning, deployment, outage behaviour and remaining live gates. Robert requested a detailed additional-service integration guide after the working implementation is verified; that guide remains pending rather than presenting assumptions as tested instructions.

Verification evidence

• 392 local Identity/joint-pilot tests passed. Two symbolic-link cases require Linux CI because local Windows did not permit link creation.
• 102 local KB tests passed using the actual hash-locked Identity wheel, including five isolated real MySQL tests for audit, grants, rollback and the read-only deployment probe.
• 46 focused collector checks, 25 deployment/SCM fixtures and 108 independent release-safety cases passed. Existing OAuth preparation and upgrade failure regressions also passed.
• A fresh offline installation of all 32 production runtime packages passed dependency checks, exact distribution comparison and isolated installed-package imports.
• A hosted Windows fixture failure was reproduced with shortened temporary paths and corrected without weakening production path checks. The final PR-head CI result is the merge reference.

Identity implementation source: b2c5e791a01c5e2e04265ba6c2db63dc22fab856. KB application source: 8671df3d30c3782c6d142ba6cbfa295451c2a7ed; release metadata and CI fixture follow-up: b108c9730de0ed36732ddf4de0de557ef906b8a1.

Identity PR #1 and KB MCP PR #2 contain the reviewed work. These are open delivery changes, not a record of production activation.

Outstanding acceptance

Complete the actual Auth0 end-user login and Codex desktop read/write, renewal, restart and revocation proof. Run the collector on Odin, review the report, resolve the actual runtime/policy/database/ingress/ACL prerequisites, and prepare the final host-specific execution package. Rehearse production and emergency recovery before cutover.

No production deployment, token retirement for the live MCP, other-service migration or emergency activation is recorded by this delivery. No OneDrive sync was performed.