fix(bedrock): interim default gen-0/warn until v2 producer ships

core/src/main/resources/config.yml

@@ -47,9 +47,15 @@ bedrock-identity:
 # Signed Bedrock principal v2 is additive to the legacy identity path above. New generated
 # configurations require it; files created before this section existed remain generation 0,
 # preserve their legacy behavior, and never advertise v2 until explicitly upgraded.
+#
+# INTERIM DEFAULT (Track B, see minekube/moxy kanban t_87f2966f): generation 0 + mode warn
+# keeps fresh installs on the working v1 identity path. The previous shipped default
+# (generation 2 + mode require) rejects EVERY Bedrock join with READINESS until the v2
+# producer (metadata endpoint + signed per-session envelopes) ships. Once the producer is
+# live, this default can return to generation 2 + require.
 bedrock-principal:
-  config-generation: 2
-  mode: require
+  config-generation: 0
+  mode: warn
   issuer: minekube-connect
   trust-domain: urn:minekube:connect:production
   audience: urn:minekube:connect:bedrock-principal:v2

core/src/main/resources/proxy-config.yml

@@ -81,8 +81,8 @@ bedrock-identity:
 # configurations require it; files created before this section existed remain generation 0,
 # preserve their legacy behavior, and never advertise v2 until explicitly upgraded.
 bedrock-principal:
-  config-generation: 2
-  mode: require
+  config-generation: 0
+  mode: warn
   issuer: minekube-connect
   trust-domain: urn:minekube:connect:production
   audience: urn:minekube:connect:bedrock-principal:v2

core/src/test/java/com/minekube/connect/bedrock/BedrockPrincipalGenerationConfigTest.java

@@ -19,16 +19,21 @@ class BedrockPrincipalGenerationConfigTest {
     @TempDir Path tempDir;
 
     @Test
-    void newlyGeneratedServerAndProxyConfigsDefaultV2ToRequire() throws Exception {
+    void newlyGeneratedServerAndProxyConfigsDefaultToV2WarnUntilProducerShips() throws Exception {
         ConnectConfig server = load(ConnectConfig.class, tempDir.resolve("server"));
         ProxyConnectConfig proxy = load(ProxyConnectConfig.class, tempDir.resolve("proxy"));
         for (ConnectConfig config : new ConnectConfig[] {server, proxy}) {
-            assertEquals(2, config.getBedrockPrincipal().getConfigGeneration());
-            assertEquals("require", config.getBedrockPrincipal().getMode());
+            // Interim default (Track B): generation 0 + warn keeps fresh installs on the
+            // working v1 identity path until the v2 producer (metadata + signed envelopes)
+            // ships. Generation 2 + require rejects every Bedrock join with READINESS when
+            // the producer is absent (see moxy kanban t_87f2966f).
+            assertEquals(0, config.getBedrockPrincipal().getConfigGeneration());
+            assertEquals("warn", config.getBedrockPrincipal().getMode());
             assertEquals("minekube-connect", config.getBedrockPrincipal().getIssuer());
             assertEquals("urn:minekube:connect:production", config.getBedrockPrincipal().getTrustDomain());
             assertEquals("urn:minekube:connect:bedrock-principal:v2",
                     config.getBedrockPrincipal().getAudience());
+            assertFalse(BedrockPrincipalConfiguration.from(config.getBedrockPrincipal()).isCapable());
         }
     }