0.5.0

• Recorded the verified v0.4.0 source and image identity in the release index and target identity page (#37, #39).
• Added a zero-problem editorial check to the documentation workflow (#38).

0.4.0

• Claim submissions accept an optional idempotency key so identical requests can be replayed safely (PR #35).

Image: ghcr.io/qa-test-automation-frameworks/quality-reference-application@sha256:fac0451807a22f8b17d6d4b7b47233c7c1252900c7e70b3bae20e39723d4673c
Source: 38c6807
Built and verified by: https://github.com/qa-test-automation-frameworks/quality-reference-application/actions/runs/40289705362
Fixture version: v0.1.0
API versions: v1, v2

0.3.0

Quality Reference Application 0.3.0 — 2026-10-26

Changes

• Claim list and claim read paths now have identity-scoping mutation controls.
• Test-control token comparison uses a constant-time check.
• Image version labels distinguish releases from later commits.
• The release index records verified image and source identity, and ARIA consumer pacts run on every change.
• Keyboard-complete claim journeys restore focus after session changes, claim creation, and reviewer actions.
• Production npm dependencies and both published Linux image architectures receive scheduled and pull-request advisory disposition.
• Exact-image security exception records require an owner, human approval, expiry, and evidence URL.
• A release version label rule and verified release index are in place, with required pinned ARIA consumer Pact checks.

Verified release identity

• Source commit: f62b3d8503ab40ca09e8bc83af95a3836bcb176b
• Image: ghcr.io/qa-test-automation-frameworks/quality-reference-application@sha256:67d700d6c835acb015f70fbc0a562169ed981a87658eab7bb597b8bf84680198
• Fixture version: v0.1.0
• API versions: v1, v2
• Source workflow run: https://github.com/qa-test-automation-frameworks/quality-reference-application/actions/runs/40267893373

QRA 0.2.0

What changed

• Adds an API v2 claim limit advertised by policy while keeping the v1 limit available.
• Adds PostgreSQL checks for lock contention, atomic audit writes, session expiry, readiness recovery, and namespace reset admission.
• Records the public source, package, fixture, and image identities for consumers.

Verification

• Source: e005b4415865c4029857a1066adf9b0f2474298e
• Main verification and publication: run 39753401824
• Multi-platform image: ghcr.io/qa-test-automation-frameworks/quality-reference-application@sha256:98642e84cd0ad94a48a2cced57e94bf3c9c1be295b4308a175b88f33c5db405c (linux/amd64, linux/arm64)
• SBOM and provenance attestations are enabled.

Consumers should verify their own integration against the exact digest they pin.