feat(integration): add concrete PostgreSQL plugin runtime

[seonghobae]

Buyer/security outcome

Advances #130/#244 from an abstract hosted PostgreSQL seam to an Integration-owned node-postgres/default-entrypoint implementation without borrowing another bounded context's Pool, using generic DATABASE_URL, or treating process-wide PostgreSQL settings as authority.

Current non-force ancestry

Parent #244 remains f0b91869f306b1b7d0d5759307acf347e413aa06. Current exact head 0a6fe7b25664bc893a4ebeb9647d830b59202fc2 is a non-force descendant of prior accepted head 45b5ad55b1575a677c9edf65fc350e55e3c68f8f and preserves the Integration-owned ten-path product delta. The protected #218 runner/control-plane foundation remains normal ancestry; no predecessor check/review evidence transfers.

Latest RED → repair status

RED a0b5653426f0d55e50f6baff6ad66543a57d932f remains valid: apps/integration-service/package.json declares pg ^8.22.0 and @types/pg ^8.20.0, while root pnpm-lock.yaml still lacks the two direct entries under the apps/integration-service importer. The shared lock already resolves pg 8.22.0 and @types/pg 8.20.3.

An attempted full-file contents mutation at c78de4f61a8fdfbeaa11d9bba09d64391edce0f6 was rejected as invalid because it did not preserve the canonical lockfile. It was immediately repaired by non-force descendant 0a6fe7b25664bc893a4ebeb9647d830b59202fc2, whose tree restores pnpm-lock.yaml to the exact prior blob ac72584e4cc0a7307aee08b15a71f468eb7cdba2. That invalid mutation is not accepted evidence and did not weaken or replace the frozen-lock RED.

The accepted next repair is still importer-only: add only pg { specifier: ^8.22.0, version: 8.22.0 } and @types/pg { specifier: ^8.20.0, version: 8.20.3 } under apps/integration-service, with no package graph/integrity/CLI churn. Earlier broad lock regeneration f3bc29112e691e1c30008c4e4132b486f20567ff changed unrelated lockfile data and was likewise rejected/reverted by b6c1befd8fea6b9943d95461b9f19b1d9f4f5061.

Earlier preserved lineage covers credential-free process startup failure; explicit self-contained PostgreSQL URI authority without PG* fallback; URI query/fragment denial; separately configured verified TLS; finite connection/statement/query/idle/lifetime bounds; bounded idle-error SQLSTATE evidence and telemetry failure; constructor/listener acquisition cleanup; lazy-Pool readiness before runtime authority; untrusted readiness-result access; one-time query-capability capture; and one-time shutdown-capability capture so readiness, accepted runtime SQL and cleanup retain the acquired authority.

Evidence boundary

The current exact head has source/fixture/architecture/changelog evidence only. Do not claim package/repository/100% coverage GREEN, real PostgreSQL/Vault connection, migration acceptance, timeout timing, TLS certificate/hostname/handshake acceptance, load/p95 evidence or independent exact-head approval until those are produced on this exact lineage.

Next dependency

Repair the Integration frozen-lock importer atomically on this lineage. Then prove real PostgreSQL + Vault migrations, readiness/startup/shutdown, connection limits, statement/query timeout behavior, idle-error handling, hostile-result cleanup and verified TLS certificate/hostname/handshake behavior on protected lineage. Only after that advance #130 to separately reviewed connect-time DNS/IP-rebinding-safe outbound HTTPS, redirect/proxy policy, signing/idempotency, durable attempt/outcome/retry/dead-letter/recovery, revocation fencing, operator recovery and buyer-visible state.

Keep Draft. No source copy, cross-service SQL, mutable dependency, self-approval, bypass, gate weakening, destructive rebase or force-push.

Refs #130, #205, #235, #241, #242, #243, #244.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}