Changelog

Naming: QDG Knowledge Base (QDG KB) is the canonical product and data platform. qdb.qdatasite.com is its public host. “QDG Wiki” and “KB Wiki” refer to the superseded localhost pilot or are informal legacy names. QDG KB Viewer is the read-only website; QDG Knowledge Base MCP is the authenticated agent integration.

Version note: The versions below describe the QDG KB platform/documentation milestones. The currently installed MCP application package still reports 0.1.0 plus the controlled locking hotfix identified below.

0.4.0 - 2026-09-04

Production release of the central, team-accessible QDG Knowledge Base MCP service. Work was performed through staged review, Odin inventory, least-privilege database setup, isolated runtime deployment, authenticated route verification, write canaries, and team onboarding.

Added

• Created the independent QDG-KB-MCP repository and implemented a centrally hosted Streamable HTTP MCP service for the existing qdgwiki schema.
• Added seven read-only tools for service status, Markdown validation, project/page discovery, search, page retrieval, and immutable version history.
• Added three write tools for project creation, page creation, and guarded page update.
• Added optimistic concurrency: page updates require the version that was read and reject stale writes rather than silently replacing another user's work.
• Added immutable page-version creation for every successful page write. The service exposes no delete, schema-management, privilege-management, or arbitrary SQL tool.
• Added named bearer-token identities with separate actor, scope, enabled state, and SHA-256 digest. Odin holds hashes only; raw credentials remain in the private master inventory outside Git and the service installation.
• Created an inventory of 30 existing token values without regenerating them. Slots 01–10 are enabled read/write allocations; slots 11–30 are disabled read/write spares.
• Added a dedicated private Python 3.13.15 x64 runtime, an isolated application venv, a pinned dependency lock, 31 verified offline production wheels, and the WinSW service wrapper.
• Installed Windows service QDG-KB-MCP as the virtual account NT SERVICE\QDG-KB-MCP, requiring no managed Windows password.
• Added read-only inventory, readiness, database verification, runtime staging, application staging, ACL, token import, loopback test, IIS route, automatic-start, public test, hotfix, and handover scripts. Destructive stages use exact targets, backups, verification, and fail-closed behavior.
• Added protected operational locations for configuration, logs, runtime files, audit backups, and deployment receipts.
• Added the QDG Knowledge Base MCP project in QDG KB, including the production handover and team setup pages.
• Added a reusable Codex client setup utility that installs the non-secret MCP block and reads an assigned token from the private inventory without displaying it.

Architecture changed

• Replaced the local-per-user MCP model with one shared service on Odin. Team clients now use the public HTTPS MCP endpoint and an individual token; only the central service receives database credentials.
• Bound the application listener to 127.0.0.1:8972 only. Port 8972 is not published through the Windows firewall.
• Added one exact QWebHub rewrite for /mcp/qdg-kb and descendants. QWebHub terminates HTTPS and proxies the request to the loopback listener.
• Confirmed the browser viewer remains available separately at /knowledge-base/ and remains read-only.
• Set the service to Automatic (Delayed Start) after local and proxied checks passed.
• Standardised client authentication on the environment-variable name QDG_KB_TOKEN. The client configuration stores the variable name, not the token.

Database and security

• Replaced the unsuitable shared web_admin@% runtime access with the loopback-only account qdgkb_writer@localhost for this service.

• Restricted the writer to the content operations required by the MCP application:

  GRANT USAGE ON *.* TO `qdgkb_writer`@`localhost`
  GRANT SELECT, INSERT ON `qdgwiki`.`kb_page_versions` TO `qdgkb_writer`@`localhost`
  GRANT SELECT, INSERT, UPDATE ON `qdgwiki`.`kb_pages` TO `qdgkb_writer`@`localhost`
  GRANT SELECT, INSERT, UPDATE ON `qdgwiki`.`kb_projects` TO `qdgkb_writer`@`localhost`
  

• Confirmed the account has no GRANT OPTION, active role, DELETE, DDL, migration-table read, system-table read, or database-wide administrative access.

• Stored the database configuration and hash-only token configuration under C:\ProgramData\QDG\Config\QDG-KB-MCP with inheritance disabled and access limited to Administrators, SYSTEM, and the exact service identity as required.

• Granted the service read/execute access to its code and private Python, read-only access to its secret configuration, and modify access only to its own log/runtime directories.

• Reviewed 7,095 filesystem security descriptors before granting service access.

• Converted 187 Python cache paths from inherited to explicit protected Administrator/SYSTEM rules before applying the service read/execute permission.

• Chose a no-TLS MySQL connection only for the same-machine loopback path. This account and decision must not be reused for remote database access.

Fixed

• Corrected the scheduled task \QWebHub\Restart: it incorrectly restarted the AdminManagement application pool and now restarts the overarching QWebHub pool. The previous task XML and a non-secret change report were retained for recovery and audit.
• Corrected the QWebHub repair script's handling of an optional/empty output path after the first guarded run failed before making a change.
• Corrected IIS route discovery and verification after initial PowerShell/IIS provider object assumptions did not match Odin. The final route was verified against the actual QWebHub ingress rather than the plausible but internal qdb-backend site.
• Corrected the ACL grant workflow after Python-created cache directories inherited rules rather than carrying the explicitly protected state expected by preflight.
• Corrected MySQL 8.4 locking permissions exposed by the first authenticated write canary. kb_projects now has the narrow UPDATE permission required by its locking read.
• Corrected the repository page-update query to use FOR UPDATE OF p, locking only the mutable kb_pages row instead of requiring UPDATE on immutable kb_page_versions. This source correction is commit b974c4e.
• Avoided using the original all-in-one finalizer after its IIS rule parser/property assumptions failed. Each failure restored the previous bytes and Manual startup; the smaller automatic-start operation then completed and passed all checks.

Verified

• Confirmed Odin runs MySQL 8.4.7 on port 3306 and that the active KB schema is qdgwiki with kb_projects, kb_pages, kb_page_versions, and kb_schema_migrations.
• Confirmed qdgkb_writer@localhost authenticates with the protected configuration, has the exact reviewed grants, can read the three content tables, and cannot read kb_schema_migrations or mysql.user.
• Confirmed the private Python runtime imports SSL, SQLite, venv, and ensurepip and is isolated from the existing shared, user-writable Python installation.
• Confirmed the service runs under its dedicated virtual identity with one loopback-only listener.
• Confirmed health, missing-token rejection, invalid-token rejection, valid-token MCP initialization, tool discovery, and qdgwiki database status both directly and through QWebHub.
• Confirmed the public endpoint works from outside Odin over HTTPS.
• Confirmed the public MCP write path by creating the operations project/page, publishing a new immutable page version as actor Robert, and proving a stale version update is rejected with a conflict.
• Repeated the QWebHub authenticated read canary after applying the MySQL locking source correction.
• Verified all reviewed public websites returned HTTP 200 after the QWebHub scheduled task correction: health, QDBAdmin, QProcess, Knowledge Base, and breeding reports.
• Confirmed the local Codex client can connect through the new production MCP and use it to publish the team onboarding page.

Team enablement

• Documented once-per-machine Codex setup using ~/.codex/config.toml and bearer_token_env_var = "QDG_KB_TOKEN".
• Documented Claude Code user-scope setup and the optional checked-in project .mcp.json, both resolving the token from the local environment rather than storing it in shared configuration.
• Added verification, 401 troubleshooting, version-conflict recovery, and token-loss guidance.
• Added a reusable project rule requiring assistant-led handovers, deployments, releases, and material changes to update the matching QDG KB page before completion.
• Clarified that a manual Git commit outside an assistant session does not invoke MCP or update documentation automatically.

Known follow-ups

• Package the guarded b974c4e query correction into a normally versioned MCP release; the installed application still reports 0.1.0 plus that controlled hotfix.
• Build a versioned updater that stages a new venv, stops only this service, swaps the application version, preserves ProgramData secrets, verifies health/auth/database access, and automatically rolls back on failure.
• Remove the redundant exact MCP rule left on the internal qdb-backend IIS site in a separate reviewed change. The live public request path already uses QWebHub.
• Relabel each enabled generic/unassigned token entry to the actual recipient before issuing it so page history records a useful actor.
• Monitor service stop time during future upgrades; the final restart succeeded but WinSW emitted repeated wait messages while stopping Python.
• Perform a controlled Odin reboot/startup check when an approved maintenance window is available. Automatic (Delayed Start) has been configured and restart-tested, but a full operating-system reboot was not part of this rollout.
• Audit and retire any obsolete local QDG Wiki/KB MCP services separately. Do not remove them merely because the central endpoint works without first confirming that no unique configuration or recovery evidence remains.

Process lessons

• Do not infer production topology from repository names or a working website. Capture a read-only server/IIS/service/database inventory first.
• Do not treat “the site loads” as proof that MCP works. Test missing, invalid, and valid authentication plus MCP initialization, discovery, database access, and a controlled versioned write through the public hostname.
• Do not add routes to a plausible backend before proving the true public ingress.
• Do not fix a service-account problem by granting GRANT OPTION, root, shared web_admin, broad schema access, or database access to every workstation.
• Do not run a service from a shared runtime where ordinary users can modify imported code. Use an isolated, pinned runtime or correct the ownership boundary first.
• Do not place raw tokens or database passwords in Git, TOML/JSON shared configuration, screenshots, chat, tickets, command-line arguments, or documentation.
• Do not issue generic shared identities when per-person attribution and independent revocation are required.
• Do not combine unrelated website application changes with MCP deployment. The exact proxy rule is infrastructure; QWebHub application development remains separate.
• Do not assume a long one-time installer is simpler operationally. Prefer small, restartable, idempotent stages and a tested updater/rollback path for future releases.
• Keep byte-for-byte backups, verify exact targets before mutation, and restore prior state automatically when a check fails. Several rollout scripts safely stopped and restored rather than leaving a partial deployment.

Source history

• 973b30f, 7301abf: repository initialization and central MCP implementation.
• 05a01fe: secure Odin production deployment tooling.
• b974c4e: MySQL locking-scope correction.
• 3b0045b: verified production rollout and handover evidence.
• 8709fd2: safe Codex client setup utility.
• a534fb5: team MCP onboarding guide.

0.3.2 - 2026-08-23

Changed

• Declared QDG Knowledge Base the canonical team documentation system.
• Marked the earlier QDG Wiki web/MCP implementation as a legacy localhost pilot that must not be deployed or used for new team onboarding.
• Clarified that QDG KB Viewer is the live read-only browser experience under QWebHub, while write integration required a separately secured central MCP service.
• Updated repository guidance, onboarding, architecture decisions, handover, and access logic to reflect the canonical-system boundary.

Reviewed and documented

• Performed a code, database, IIS, service, scheduled-task, configuration, and deployment review rather than assuming the development checkout described Odin.
• Added the as-deployed inventory, database access plan, remediation handover, team remediation summary, web-admin connection audit, least-privilege SQL templates, and restore-test documentation.
• Added a read-only Odin inventory collector and safe repair/verification scripts.
• Identified that the existing local pilot used broad web_admin@% database access and was unsuitable as the credential model for a team-facing MCP service.
• Identified the QWebHub restart-task target defect and the need to separate QWebHub, QDG KB Viewer, the legacy QDG Wiki pilot, and the proposed MCP service in both naming and operations.

Source history

• 2e40ebf, eff4c8e: canonical-name and legacy-boundary changes, merged through PR 1.
• 20c2017: detailed remediation and deployment handover package.
• b618deb: review-link handover record.
• 890d437: checkout-safe writer SQL verification.

0.3.1 - 2026-08-02

Changed

• Highlighted that updatewiki uses Codex or Claude for AI editorial decisions rather than appending content mechanically.
• Documented the complete read, assess, merge, validate, and immutable-version workflow.
• Reinforced AI-managed merging directly in the installed updatewiki skill.

Fixed

• Corrected the skill installer so updates copy skill contents into the existing destination instead of creating nested duplicate skills.

0.3.0 - 2026-08-02

Added

• Added user-guide and quick-reference as standard QDG KB page types.
• Published detailed Codex and Claude Code installation, troubleshooting, and verification guidance.
• Published a compact updatewiki command and examples reference.

Changed

• Expanded the updatewiki skill's page-selection guidance for the two new standard types.
• Added a forward-only database migration for existing Odin installations.
• Updated QDG KB Viewer ordering so both guide types appear as standard pages.

0.2.0 - 2026-08-02

Added

• Created the independent QDG KB Viewer Django project.
• Registered the viewer in QWebHub at /knowledge-base/ with a dedicated qdgwiki database alias.
• Added namespaced templates and static assets, project search, rendered Markdown, and version history.

Changed

• Removed Knowledge Base presentation code from AdminManagement.
• Kept QDG KB focused on the updatewiki skill, database writes, schema, and immutable versions.

0.1.0 - 2026-08-02

Added

• Created the simplified QDG KB MCP service.
• Added MySQL-backed projects, pages, and immutable page versions.
• Added the cross-compatible updatewiki skill for Codex and Claude.
• Added local stdio and container-ready streamable HTTP transports.
• Added the read-only AdminManagement Knowledge Base module.