fix(email): enforce shared send throttling - #1417
Conversation
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueThanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@opencode-agent @cwl-noema-review please independently review exact current head |
|
Please perform an independent review for exact current head 3d08f5f. Review only the current diff and current-head checks; do not dismiss reviews, bypass branch protection, update the base, or merge. |
| \nPlease independently review exact current head for PR #1417. all current checks are terminal with no failures; review the shared send-throttling diff and concurrency/security behavior at this exact SHA. Publish normal structured review evidence; do not reuse stale reviews, dismiss, bypass, or merge. |
|
@opencode-agent @cwl-noema-review Review-only request for exact current head 3d08f5f. I traced every email send endpoint caller into the shared PostgreSQL advisory-lock bucket and verified the focused rate-limiter tests (64 passed, 1 skipped in prior local evidence), with current hosted checks green. Please independently review this exact SHA only; no bypass or self-approval. |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head3d08f5fe829e5111d6bd3e641e5272ad6ad74ccb. -
Head SHA:
3d08f5fe829e5111d6bd3e641e5272ad6ad74ccb -
Workflow run: 32255702926
-
Workflow attempt: 1
Coverage evidence
Coverage evidence job did not run or did not publish coverage evidence.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Backend (6 files)"]
S1 --> I1["API and service runtime"]
I1 --> R1["Review risk: Backend (6 files)"]
R1 --> V1["backend tests"]
OpenCode Review Overview
Pull request overviewOpenCode cannot approve yet because required coverage evidence did not pass. Review outcome1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
Coverage evidenceCoverage evidence job did not run or did not publish coverage evidence. Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Backend (6 files)"]
S1 --> I1["API and service runtime"]
I1 --> R1["Review risk: Backend (6 files)"]
R1 --> V1["backend tests"]
|
|
PR governance metadata gate is not ready for
|
|
Current-head review request for PR #1417. HEAD: 3d08f5fe829e5111d6bd3e641e5272ad6ad6 The shared email-send limiter was audited at the exact HEAD: every send caller reaches the PostgreSQL advisory-lock bucket, unavailable shared state fails closed, scope keys bind organization and user, and audit records contain only a one-way scope hash. Focused tests: 64 passed, 1 skipped. Full backend: 1777 passed, 32 skipped. Ruff and diff checks pass. Please review this exact HEAD with current GitHub Checks and provide structured adversarial evidence. Do not reuse the older coverage-only review. |
…1381) * fix(db): make fresh-database schema bootstrap work end-to-end The retired 'emails' table (replaced by 'email_records' during the email model reconciliation) was still referenced by fresh-DB setup, breaking both 'alembic upgrade head' and bootstrap_db against a clean database: - schema_backfill_sql() created a dead 'ix_emails_owner_date ON emails' index (used by migration 0001 and bootstrap_db) -> UndefinedTableError. - migration 0011_email_read_state did 'ALTER TABLE emails ADD COLUMN is_read' unconditionally; guard it on the table existing (matching the has_table/ has_column pattern used by later revisions) since email_records already carries is_read from the model metadata. - give email_records.is_read a server_default so create_all/bootstrap_db match the migration intent and raw inserts that omit is_read (postgres smoke seeds) don't hit a NOT NULL violation. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com> * fix(email-import): avoid NUL byte in Postgres advisory-lock key The owner import quota advisory lock built its owner key as f'{user_id}\x00{organization_id}' and passed it to hashtext() as a text bind param. PostgreSQL text cannot encode NUL (0x00), so every email import 500'd on real Postgres with CharacterNotInRepertoireError (mocked/SQLite unit tests skip the advisory-lock path, hiding it). Derive a NUL-free sha256 digest instead and update the tests to assert the NUL-free contract. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com> * chore(env): add Cloud Agent dev environment (backend + frontend + Postgres/pgvector) Repo-managed .cursor/environment.json plus idempotent install/start scripts: - install.sh: system packages (postgresql-16 + pgvector, python venv/build tools), backend venv + pinned requirements, frontend pnpm@11.5.3 deps. - start.sh: bring up the Postgres cluster, generate a per-VM dev .env with random secrets on first boot, ensure the app DB + pgvector extension, and apply alembic migrations. - terminals run the backend (start_backend.py) and frontend (next dev). Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com> * fix(env): keep Cloud Agent Postgres secrets off the psql command line Reject empty DATABASE_URL role secrets and apply ALTER USER through dollar-quoted psql stdin. Install hashed requirements so the baked environment matches the CI supply-chain contract. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com> * fix(db): guard email_records.is_read on the alembic path Keep 0011 as a retired-emails no-op downgrade and add 0018 so existing email_records tables get NOT NULL DEFAULT true without interpolated DDL. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com> * docs: record Cloud Agent env contract and NUL advisory-lock anti-pattern Pin the import quota lock key to an independent SHA-256 digest and point operators at the next boot/import action. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com> * test(cloud-agent): reject unpinned pip self-upgrade * fix(cloud-agent): remove unpinned pip self-upgrade * security(cloud-agent): document fixed-argv subprocess boundary * fix(db): stack read-state migration after send buckets --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com> Co-authored-by: Seongho Bae <me@seonghobae.me> Co-authored-by: opencode-agent[bot] <219766164+opencode-agent[bot]@users.noreply.github.com>
|
The only OpenCode blocker is stale coverage evidence for prior head |
|
Exact current HEAD |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
|
Current-head review request for PR #1417. Exact head: The live review threads are resolved/outdated for this head. Please regenerate independent review and required metadata evidence against this exact head. Any new finding will be handled before normal protected merge; no bypass or force operation is requested. @OpenCode review current head 69fb72d. @coderabbitai review |
|
|
Stale review: cited a coverage-evidence/required-check failure on an earlier commit; current head has been verified (gh pr checks) to pass coverage-evidence and all other non-metadata-gate required checks, with no current-head review from this reviewer. Dismissing as superseded per AGENTS.md stale-review guidance.
opencode-agent
Bot
added
priority: medium
|
I am validating the existing shared-send delta on this PR from exact head Before committing: I will inherit the complete canonical migrated-PostgreSQL CI prerequisite from #1562 ( |
|
Continuing the existing shared-send owner at exact head 1666f76. Scope: reproduce cancellation during the pre-resolved SMTP socket connect, repair cleanup in the shared helper if RED is confirmed, and verify both direct send and registered Connector consumers. Preserve the limiter, request transaction boundary, complete prerequisite history, DNS pinning/TLS identity, and cancellation propagation. No replacement PR, force push, merge, closure, provider call, or release claim. The 164-open-PR inventory found no overlapping connect-helper delta; #1287 has a separate OAuth SASL validation deletion that must not be inherited. |
Preserve the complete CI owner child and existing shared-send delta; no source copy or history rewrite. Co-Authored-By: Codex <noreply@openai.com> Signed-off-by: Seongho Bae <me@seonghobae.me>
Signed-off-by: Seongho Bae <me@seonghobae.me> Co-Authored-By: Codex <noreply@openai.com>
Ordinary merge of CI owner 0648eac retains SMTP throttling, socket cancellation and migration delta. No deletion or force rewrite; independently verify this consumer.
|
Full PostgreSQL revalidation at cc2c4cb is FAILED/INCOMPLETE, not GREEN. The 113-package Actions hash dry-run reported no changes and compatibility passed; fresh/repeat migrations completed. After the execution handle disappeared, process inspection confirmed the runner/pytest were no longer live. Retained JUnit naruon-postgres.9UpmOJQk/pytest.xml has tests=649, skipped=2, errors=1, failures=0; the error is pytest terminal flush BrokenPipeError: [Errno 32] Broken pipe. Output-consumer disconnection is observed; its initiating cause and final runner exit code are not established. The log stops near 30 percent, so this does not validate the remaining suite. Both task containers and volumes were absent; only their verified empty task-labelled networks were removed by exact ID. No global prune, daemon restart, warning suppression, source change or merge. Preserve this failed receipt before any unchanged-head retry with durable output handling. |
|
Same-head full PostgreSQL retry completed at cc2c4cb. Command: bash scripts/ci/run_backend_postgres.sh, with stdout/stderr redirected directly to a durable local file; separately recorded final runner exit is 0. No source or test-scope changes. Pytest: 1892 passed, 2 skipped in 789.73s. Both skips are tests/live/test_live_api_sequence.py:107 because LIVE_BASE_URL is required. Redacted JUnit: 1894 tests, 0 errors, 0 failures, 2 skipped; SHA-256 5cdcf50c05928dab29ca173a46de5856b13ed8c182762857953cee37afbf4672. JUnit suite time is 789.704s. Cleanup completed and separate Docker label queries confirmed zero containers (including stopped), volumes and networks for naruon-test-ozws5fyx. Local and remote heads remain identical and worktree clean. Evidence directory: naruon-postgres.OzWS5fyx. The earlier 649-test internal BrokenPipe failure remains failed historical evidence: #1417 (comment) . The initiating pipe closure is not attributed. This is local full-suite/cleanup evidence, not current-head hosted review/check success, merge-ref security certification or protected merge. |
|
Fresh local merge-ref security evidence, not hosted gate certification:
|
|
Ordinary non-force merge: predecessor cc2c4cb plus complete parent 938d4b1 produces current head 5dea509. Exactly three inherited files changed (85 additions/13 deletions), no conflicts or discarded consumer delta. Gate and full harness blobs match the parent. Own committed-head full fake-GitHub governance harness PASS/exit0, 40 focused source contract tests passed with zero skips (1.96s), ShellCheck/diff checks passed; pushed without force after remote predecessor verification. Full PostgreSQL runner completed: 1892 passed, 2 live-API skips requiring LIVE_BASE_URL, 209.96s; runner exit 0. Redacted JUnit1894 tests/errors0/failures0/skipped2, SHA-256 0dd8233473136121021518332d17036762d6cd2afb22d2500edcf8d357f6e3db. Cleanup completed; independent Docker label queries confirmed no containers (including stopped), volumes or networks for naruon-test-ancjfu3g. Local head unchanged and clean. Evidence directory naruon-postgres.Ancjfu3G. Prior-head PostgreSQL and merge-ref security receipts are historical, not certification of this head. Keep Draft/open until prerequisite and review-admission conditions are satisfied; then obtain fresh hosted checks/review. No protection change, self-resolution, release or protected merge claim. Fresh local merge-ref security: f0c602d, parents match live base/head before and after scanning. Complete tracked git archives, no operator environment files. Trivy0.74.0 download-db-only exit0; DB updated2026-09-06T07:00:11.537152697Z. Repository configuration retained. vuln+misconfig HIGH/CRITICAL fixable with --include-dev-deps: exit0/reported0; separate all-severity secret scan: exit0/reported0. No WARN/ERROR/FATAL/Timeout/Denied log matches. JSON SHA-256 security 5f7e9cf5338cea6632987c64902c1a95ed8f6209ed855163427b0b5f1cd95083, secrets ab11d5881765cd422300d026485da02f2b1cc08903af7f78ce0ed937f17a83e7. Evidence naruon-938d-5dea-security.0r7038. Scope-limited local results are not hosted gate, review, release or runtime certification. |
Preserve SMTP throttling and complete CI/owner delta through a normal merge. CI parent 0ec1cf9 passed the governance harness, 40 source contracts and 1877 PostgreSQL tests (2 live-endpoint skips). No branch history or PR is discarded; SMTP validation remains independent.
|
Current-head integration receipt: ec3e361 normally merges prior5dea5092 and CI0ec1cf92, inheriting owner f2e2ac0 completely while preserving SMTP throttling. Full governance harness exit0/PASS; 40 source contracts with -W error, ShellCheck and diff checks exit0. Full disposable PostgreSQL runner exit0: 1892 passed, 2 LIVE_BASE_URL-dependent skips in138.59s. Redacted JUnit SHA2563c4e3a524fce4f172618561db4623cd19328cc594f22f15b979385241889226b. Independent Docker container(-a), volume and network label queries confirm zero task resources for naruon-test-2iixv5hn. Clean head unchanged after tests; ordinary push succeeded. These local results do not establish current hosted security/review, protected merge, deployed runtime or Visual Inspection. Older merge-ref security evidence is historical until revalidated. No Ready toggle, run cancellation, force rewrite or PR closure performed. |
|
최신 보안 검사에서 수정 대상 확인: head ec3e361, merge 1c4c369. Trivy0.74 기본 HIGH/CRITICAL fixable 검사와 별도 전체 심각도 secret 검사는 exit0이었으나, 기본 결과에 requirements-strix-ci-hashes.txt가 누락됐습니다. 동일 archive에 --file-patterns "pip:requirements-.*\.txt"를 추가하자 해당 파일의 aiohttp3.14.1에서 CVE-2026-69244 HIGH(fixed3.14.3)가 탐지되어 exit1로 종료됐습니다. 확장 결과 SHA256: e73f60a718fc87d00267d975f3097cd5034f06e15e52313cd1f06c6b8817123c. DB는 이미 이 CVE를 인식하므로 기존 zero 결과로 취약점을 반박할 수 없습니다. 실제 보안 통과가 아닙니다. 기존 #1244가 aiohttp3.14.3 hash-lock 수정 소유자이며 중앙 manifest 탐지 설정도 별도 보완해야 합니다. 최초 DB 갱신 명령은 옵션 위치 오류로 exit1, 도움말 확인 뒤 trivy image --download-db-only로 수정해 exit0. 검사 후 head/base/merge 동일함을 확인했습니다. 보호 병합, 배포, 최신 Visual Inspection은 미완료입니다. |
Preserve SMTP implementation and complete dependency/governance/CI delta through normal merge. Parent CI passed137.75s PostgreSQL run1877pass2LIVEskip, governance harness and expanded Medium-plus security. SMTP new-head validation remains independent.
|
선행 보안 수정 상속 완료:489bcbeaf131da123551a187228862b0e47ad549는ec3e361d와CI cdef6034를 일반 병합해 SMTP와 모든 선행delta를 보존했습니다. full governance harness exit0/PASS,40source-Werror/ShellCheck/diff exit0. 실제PostgreSQL1892pass/2LIVE_BASE_URLskip125.69s runnerexit0; task containers(-a),volumes,networks0 확인. JUnit SHA2562e5546db2bdaa5287f0cb9ffbd46a44328eb10f7cc5e88bba660fcdde722913f. trackedarchive expanded MEDIUM/HIGH/CRITICAL fixable Trivy(vuln,secret,misconfig) exit0,11language manifests/0findings, JSON5d45e7275b7f588b3627abf53bc1ff3d64a7d85f5fa412308f0f9ca560b64198. 일반push완료. 현재head local검증이며 현행merge-ref/hostedreview/보호병합/최신VI로 확대해석하지 않습니다. 중앙탐지설정PR1969, 기존UI테스트경고 수리는 별도미완료입니다. |
seonghobae
removed
the
status: needs-review
seonghobae
added
status: draft
ChatGPT Codex Connector
1 participant
Current inherited governance repair
Exact head:
cc2c4cbc3fe134787b724b79cde98fe3e7c1b6e0; complete parent0648eace4186c9ba813102df4f26571e20cea3c0integrated by ordinary merge, with no conflicts or discarded consumer delta. This merge changes only three governance files (34 additions / 10 removals); gate and harness match the parent. Own committed-head full fake-GitHub harness PASS exit 0; own 40 source/governance tests PASS, zero skips; ShellCheck and diff check PASS. CI first attempted a nonexistent third test filename and exited 4 with zero collection; corrected actual two-file command passed. No dependency sync or full PostgreSQL lifecycle was rerun in this increment, so prior DB and security receipts below remain historical and do not certify this new head. Hosted checks, qualifying review and prerequisite-first protected integration remain pending; no approval/merge claim.Historical predecessor receipts
Current merge-ref local security — 2026-09-06
Head
9e4ddde9286e5217e9fadbed212bf39141a8ed23, fetched merged27ee7c2541a06bf67859934e714d89a05321bf7with verified current base/head parents. After tracked archive extraction completed successfully, Trivy vulnerability/misconfiguration scan (include-dev-deps, HIGH/CRITICAL, fixable only) and separate secret scan each exited0 with zero reported findings. No ignore rule or scanner policy changed; tracked trivy.yaml retained. Report SHA-256: security9d42b156bae2711495e88ecf3f6cfac545c6b69a1444733491aee6a5ebf83ace; secretscc8784bfa95118a2bdb5df1efc2f99f7e827862d3e46a9803d52bb609ee340c8.Initial scans started before extraction completion and are explicitly INVALID, not evidence. Only the *_complete.json reruns are accepted. Local scans are not hosted gate success, application/runtime security certification, independent approval or protected merge. Remaining publication concurrency finding is unaffected.
Exact-head full PostgreSQL revalidation — 2026-09-06
Unchanged head
9e4ddde9286e5217e9fadbed212bf39141a8ed23: 1892 passed /2 explicit LIVE_BASE_URL-only skips /166.76s /runner exit0. Fresh and repeated migrations through0020_merge_send_registry completed. Task project naruon-test-3p3ywuub has no remaining containers, networks or volumes. Actions hash requirements dry-run matched all113 installed packages, compatibility passed. Worktree/head unchanged after run.JUnit SHA-256:
4164a38c362395022caeac3a7c24f5513a4cff00e901273f58cb0377577ddcbd.This is the consumer's own full result, not inherited owner evidence. Hosted snapshot has6queued checks and3skipped publication/deployment checks, not approval or protected integration. Live API/mail and new-head security evidence remain separate unverified gates.
Current governance inheritance — 2026-09-06
Head
9e4ddde9286e5217e9fadbed212bf39141a8ed23normally inherits complete CI ownerb0d1bb6edfa4b505a6bd4c2c42c178237c00b502, including #1531e058f3ead35f9a19d3c3b20c6ab5fc04d2e2cbb2. Multiline pending notice parsing repaired; existing stacked-workflow test moved into backend collection. Own full fake-GitHub metadata harness PASS; focused governance 40 passed /0 skipped /0.08s, ShellCheck/diff checks pass. Inherited script/test blobs match owner. No SMTP/dependency/release mutation in this merge. Prior full PostgreSQL/security results below remain tied only to their old named heads; fresh required hosted checks and independent review remain pending. Draft/open, no completion/merge claim.Historical receipts
Current inherited CI repair
Head
b7011d2cc6a96c9e153a2771a7cac39749fa2969, tree2d3518f6fe7e3d1cc9f90855ebb35bfc290cd9ac, normally merges complete CI owner #15621f538b188bf0c6a8193fbea005d0c537a01095ecintodc8b53d38ddf80b726b5dc6cff1d21f2c25d293e. All shared-send quota, migration and SMTP cancellation deltas remain; no source copy or force push. The three inherited files match the owner blobs exactly. Draft on that unmerged owner.The owner closes a separately reproduced launch-to-PID cancellation gap. A task-owned DEBUG barrier injects a real SIGTERM before ownership registration; the unchanged runner left a live child after cleanup. The minimal fix defers cancellation only until PID registration. Owner focused19 tests and its own complete1876/2 migrated lifecycle pass, with unchanged20-second cleanup bound. These owner receipts do not transfer to this consumer head.
This consumer's own exact-head full migrated PostgreSQL run completed 1891 passed / 2 explicit LIVE_BASE_URL-only skips / 141.87 s, fresh/repeated migrations and complete scoped cleanup, exit0, after exact synchronization of the same113 core/agent packages as Actions. JUnit SHA-256
6b878f5303d34ebef472b148448ceaaa7d8c7d9e249c2f4ee601b5676a074673. Its generated test project has no remaining containers/networks/volumes. This is local lifecycle evidence, not hosted approval, protected merge, actual mail/browser execution, full coverage or latency proof.Historical dc8b/b2e9 runs ended137 during removal; this is consistent with the watchdog but does not establish signal attribution or daemon-latency cause. Keep those failed receipts. A later narrow success and this launch-window fix do not retroactively resolve them.
Inherited root-cause decision and limits.
Merge ref
13488ac848b5573386f42565eec9239ee18f8481matches current base/head/tree. Refreshed Trivy HIGH/CRITICAL fixable vulnerability/misconfiguration scan including dev dependencies: 0 findings, SHA-2560b48cbc2195c8229d0b4a3b8e9c1283fe712a7f2e42b045b9bc013a3966f9f69. Separate all-severity secret scan: 0, SHA-25669fb96172e77546499e53428c21d720853e71b66a545b2740aa16616ae6fad6f.Fresh current-head check-runs show six queued checks and three skipped deployment/publication jobs. Neither pending evidence nor skipped jobs establishes qualifying review/protected approval. Remain Draft on the unmerged prerequisite; no protected dependency advisory is resolved by a local scan.
Historical SMTP and CI receipts through dc8b, not current-head evidence
Current authority
Head
dc8b53d38ddf80b726b5dc6cff1d21f2c25d293e, treeb66b0bff2cab33c9ff26301dad6005778c804696, Draft on complete CI prerequisite #1562 atb2e98a52588db72e501c0843b33816e2e5bc698b. Ordinary commits/merges retain all existing shared-send and prerequisite deltas.New repair and failure lineage
56025b17rerun then failed the CI signal probe's pre-signal five-second readiness assertion (1888 passed / 1 failed / 2 skipped); failed JUnit SHA-25627c1ac50cb7073bdb5299170618e6ee204ad437199658285f68cb44621e593bbremains failure evidence.3d3a9fec41477cffc8786e7ab4e1006fa9ad09dc73e5afa3e53998e268ebdb6d. The generated project's container, network and volume are now absent; manual/late cleanup does not change the failed execution status. Investigate daemon teardown timing and rerun the unchanged complete suite without weakening cancellation, redaction or cleanup guarantees.91212236c1a018859f5fe58551397b924d9477b0matches current base/head/tree. Fresh-DB Trivy HIGH/CRITICAL fixable vulnerability/misconfiguration scan including dev dependencies: zero findings, SHA-25641a09c0be4cdd3abf1ef5de5059284f2621ffb2b9b5adc08f898fece4c210d6c. Separate secret scan: zero findings, SHA-2568261953e4e211fdc8169446248417226a62b535ae2fc321f6bf01881b39fc650.SMTP root cause, rejected alternatives and APA reference. CI failure and repair.
Remain Draft while the prerequisite is unmerged. Hosted checks/current-head qualifying review, protected integration, real delivery/browser behavior, coverage and p95/release/deployment remain separate gates.
Historical receipt at 1666, not current-head evidence
Current authority
Head
1666f76cf94c31e34c2762c9d75f52ea3040b9a2, tree2a6aa3759b94e923325df7c6568cc6db3f8f63ca. Draft on canonical CI prerequisite #1562 at30d8476b5fa1d4379684acaf2f334414597e97c4; protected develop remains a separate acceptance boundary. Ordinary merges retain the complete originala9f334a442538b666e03e694731745d8aab4b45adelta, all #1562/#1503/#1565/#1571 prerequisites and the nested migration-isolation follow-up. No close, force push, source copying or gate bypass.Repair and validation
0020_merge_send_registryjoins both without DDL or removal of either history. Fresh and repeated upgrades pass locally.bash scripts/ci/run_backend_postgres.sh: 1887 passed, 2 explicitly unconfigured live API skips, zero failures/errors in 120.85s. All four real PostgreSQL send cases ran, including the real 61-second window. Fresh/repeated migrations and task-only cleanup completed. JUnit SHA-256f581d06533152c7a5f70246abf32398bc59cb604c525c6974e5a960effac7ff2. Full backend Ruff passes.abc115c644c408681206712d59a916eee5f7dcfbhas the stated base/head and identical tree. Refreshed local Trivy HIGH/CRITICAL fixable vulnerability/misconfiguration scan includes development dependencies and has zero findings; SHA-256603aff0b0fe41bb7fc5bbd9287799132886ced2eec349ff08f53bd004907c8a4. Separate all-severity secret scan: zero findings, SHA-256607901f5a88df359f88777ed7242438bee6d043e4382fed932dd49e8ff639a2a.Traceability and remaining gates
Decision, failed candidates, reproducible command and APA references.
Remain Draft while the required foundation is unmerged. Obtain current-head hosted checks and qualifying independent review before protected landing. Local DB/API fixtures are not browser HttpOnly proxy evidence, delivery, customer workload accuracy, coverage percentage, p95, release or deployment proof.