QDG Identity change log

Document version: 1.0.1. Updated 6 September 2026.

Identity 0.2.0 and KB MCP 1.2.0 preparation

Added the shared Auth0 token verifier, current subject permissions, stable request identity, exact MCP discovery and a bounded local synthetic pilot. The KB integration preserves all ten tools, adds current tool-level permission checks and commits identity audit with each permitted content write.

Added explicitly activated emergency reads for one approved Robert identity, with an absolute maximum one-hour lifetime, current policy enforcement and durable audit before data release. It is disabled by default and permits no writes or automatic fallback. Added private credential preparation that never activates service access or prints a token.

Added the read-only Odin collector, the reviewed deployment controller and its semantic probes. The workflow binds exact host/configuration/artifact hashes, detects drift, stages offline, protects backups, stops only KB MCP and requires verified canaries. Recovery preserves current denials and refuses an automatic return to retired static authentication.

Confirmed day-one scope: QDG Knowledge Base MCP only, with new OAuth credentials independent of existing QDBAuth credentials. Other services and websites retain their current authentication until individually migrated after the first service is verified.

Adopted the non-conflicting Start_Project standards: confirmed Python plus PowerShell, QDG Identity as the Knowledge Base project, the four standard pages, a consolidated changelog/handover, script versions and the existing Git/immutable-release archive approach.

Published all four standard pages with content readback verification. These explain OAuth usage, architecture and reasoning, deployment, outage behaviour and remaining live gates. A BA review clarified independent read/write permissions, service-specific access removal and the distinction between pilot and production resources, and added links to current operating guides. Robert requested a detailed additional-service integration guide after the working implementation is verified; How to Use now records its required evidence, tested example, independent walkthrough and Robert's acceptance. That guide remains pending rather than presenting assumptions as tested instructions.

Verification evidence

• 392 local Identity/joint-pilot tests passed. Two symbolic-link cases require Linux CI because local Windows did not permit link creation.
• 102 local KB tests passed using the actual hash-locked Identity wheel, including five isolated real MySQL tests for audit, grants, rollback and the read-only deployment probe.
• 46 focused collector checks, 25 deployment/SCM fixtures and 108 independent release-safety cases passed. Existing OAuth preparation and upgrade failure regressions also passed.
• A fresh offline installation of all 32 production runtime packages passed dependency checks, exact distribution comparison and isolated installed-package imports.
• Hosted Windows fixture failures were reproduced and corrected without weakening production checks: shortened temporary paths required canonical fixture directories, and PowerShell 5.1 closures needed an explicitly captured assertion function when called from another script. All five PowerShell suites then passed together in the hosted runner.
• Identity Windows/Linux CI passed at 2a34c44; KB Windows CI passed at bdf488d. Check the exact current PR head again if later changes are added.

Identity implementation source: b2c5e791a01c5e2e04265ba6c2db63dc22fab856; standards and collector handoff package: 2a34c44dae3b2ba1cc9ded7e179fef32c10f9ea7. KB application source: 8671df3d30c3782c6d142ba6cbfa295451c2a7ed; release metadata and CI fixture follow-ups: b108c9730de0ed36732ddf4de0de557ef906b8a1 and bdf488d9179a80bcb4a6127840b67d1c13db45e0. These documentation/test corrections do not replace the immutable built application wheels.

Identity PR #1 and KB MCP PR #2 contain the reviewed work. These are open delivery changes, not a record of production activation.

Outstanding acceptance

Complete the actual Auth0 end-user login and Codex desktop read/write, renewal, restart and revocation proof. Run the collector on Odin, review the report, resolve the actual runtime/policy/database/ingress/ACL prerequisites, and prepare the final host-specific execution package. Rehearse production and emergency recovery before cutover.

No production deployment, token retirement for the live MCP, other-service migration or emergency activation is recorded by this delivery. No OneDrive sync was performed.