P08: implement QR resources and machine-decodable downloads

[Techshrr]

GoJet V10 / P08 — QR

Refs #1
Closes #23

Status

SIGNED EXACT-HEAD CLOSURE PASS — READY FOR MERGE

P08 implements the approved CAP-QR contract on top of the integrated P05/P06 Link authority and P07 Analytics baseline.

Base and final revision

• P07 main integration SHA: 04941afc59db763e6c7db8a67721dea542c72a43
• Branch: develop/p08-qr
• Contract-freeze commit: a41e9342290d92dfb6ddd01c1861fe77ff0518b4
• Signed exact head: dc055fbd52cde5d0aada0b912373cc182660f105
• Frozen test range: P08-T001..P08-T016
• Signed review: artifacts/v10/P08/review.md

Delivered

• repository-global QR schema, Workspace quota counter and audit events
• tenant-bound authoritative QR CRUD with server-side RBAC and quota enforcement
• one same-Workspace authoritative source Link per QR resource
• QR payload is the server-derived current GoJet public short URL, never an alternate raw customer destination
• live P05 destination-risk and P06 custom-domain authority enforcement for create/preview/download
• real deterministic server-side PNG/SVG generation and safe download metadata
• independent ZBar machine decode evidence against actual generated artifacts
• /app/qr list/create route and /app/qr/{qrId} detail/preview/download/delete route
• Link Detail QR integration using the same P08 authority
• canonical desktop/tablet/mobile browser evidence plus 320 CSS px reflow, keyboard-only, reduced-motion and non-color safety-state evidence
• exact-head evidence coherence and affected P00-P08 closure workflows

Final signed-head evidence

• P08 QR Contract: SUCCESS
• P08 Real QR Integration: SUCCESS (P08-T001..P08-T010)
• P08 Workspace QR Browser: SUCCESS (P08-T011..P08-T014)
• P08 Evidence Coherence: SUCCESS (P08-T015)
• P08 Closure: SUCCESS (P08-T016)
• final P08 Closure run: 32579404081
• final closure artifact: 9477523498
• closure artifact digest: sha256:aede44ebad79a78adc872f33a874f8aea1ae24bb430b0e06eaa2da32739c0a2d
• P08-T016.json: PASS, errors=[], 15/15 exact-head evidence inputs, 21/21 required regression workflows
• closure.json: phase=signed, merge_authoritative=true
• P0 defects: 0
• P1 defects: 0
• unresolved DECISION REQUIRED: 0

One signed-head P04 run observed a one-off Docs desktop layout-shift sample while the product code was unchanged. The exact same P04 job was rerun without changing SHA, threshold or implementation and completed SUCCESS; P05/P06/P07 closures were then rerun sequentially and also completed SUCCESS before final P08 closure.

Correctness boundary

• destination-risk pending, review, block, missing, malformed and stale fail closed for QR generation/distribution
• target-fingerprint changes invalidate prior allow state until exact-current authority is restored
• applicable custom-domain authority remains independently required
• deleted QR resources cannot generate new detail/preview/download artifacts
• no screenshot-only, DOM-only or mocked decoder evidence substitutes for real generated assets and native services
• production Docker/Compose and production Node HTTP runtime remain prohibited

Gate scope

• G3 P08 CAP-QR functional/API subset: PASS
• G10 P08 QR/generated-asset subset: PASS
• release-wide G10: OPEN — later-owned by release verification nodes

Exit

The signed exact head dc055fbd52cde5d0aada0b912373cc182660f105 satisfies the frozen P08 Exit Conditions and is merge-authoritative.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.