feat(recovery): assess PostgreSQL timeline history

[seonghobae]

Summary

Assess bounded PostgreSQL timeline-history bytes into content-free structural ancestry evidence without claiming archive provenance, WAL-byte authority, replay, promotion, PITR, RPO, or RTO.

Exact stack boundary

• Protected main: b84f0c94154043a3473939c01bb6471de5a129ae
• Base branch: fix/recovery-evidence-weakref-coverage-b84f0c9
• Exact base SHA: 5951b7a4d779903b8924abaef2a387cae50b7f54
• Head branch: feat/postgres-timeline-history-b84f0c9
• Exact head SHA: 5f804f040e5611964219b455dd60d5faf8f6b995
• Ancestry: 4 commits ahead / 0 behind the exact predecessor
• Relative diff remains exactly:
  • pg_llm_batch/postgres_timeline_history.py
  • tests/test_postgres_timeline_history.py

5f804f0... is a non-destructive merge commit retaining the original timeline-history lineage and exact #233 head 5951b7a... as parents. It includes #233's focused weak-reference coverage regression only as predecessor history; that test is not part of this PR's relative diff. No source or documentation was written directly to protected main.

Fresh targeted writer inventory finds only feat/postgres-timeline-history-b84f0c9 on this exact source surface. Fresh formal-review inventory remains empty; absence of review is not approval.

RED → GREEN lineage

• 5a3fdde690343d2182eac56a46d57df35bda83a6 — tests-first contract; the production import intentionally failed.
• 5f91e11e2e56b7cd7865a4ad7eba4945bbe200e4 — product-lineage tip before stacking, including focused syntax/empty-history coverage.

Contract boundary

assess_postgres_timeline_history(...) accepts an explicit target timeline ID plus at most 64 KiB of raw history bytes. It parses only authority-bearing parent timeline IDs and switchpoint LSNs, ignores comments/blank lines and untrusted reason text, requires increasing parent timelines below the child and nondecreasing switchpoints, canonicalizes LSNs, and binds the assessment to the exact input bytes with SHA-256.

Timeline 1 may contain only comments/blank content; later timelines require at least one parent entry. The result does not prove source provenance, archive completeness, cluster identity, WAL continuity, replay, target promotion, or deployment recovery objectives.

Exact validation state

Pre-stack exact head 5f91e11e2e56b7cd7865a4ad7eba4945bbe200e4 produced terminal-success Security Scan 32053574925, SAST Semgrep 32053574998, Release Acceptance 32053574879, Python 3.10/3.12/3.14 unit lanes, PostgreSQL/container smokes, compile, Ruff, and 100% public-docstring coverage. CI 32053574902 failed only at repository aggregate coverage: the timeline-history module was exact 100%, 1352 tests passed, and the only uncovered branches were protected-main postgres_backup_evidence.py:65->exit and postgres_schema_evidence.py:49->exit, owned by dependency-root #233. That predecessor evidence is RCA context only and does not transfer.

For unchanged exact stacked head 5f804f040e5611964219b455dd60d5faf8f6b995, repository-local workflows concluded terminal-success:

• CI 32209482371: success;
• Security Scan 32209482337: success;
• SAST Semgrep 32209482351: success; and
• Release Acceptance 32209482409: success.

Those historical conclusions remain branch evidence only. Final integration still requires fresh proof that every then-required scanner actually analyzed the final contributor head under then-protected central semantics. No predecessor, synthetic, or stale evidence transfers.

Dependency and governance boundary — refreshed 2026-08-30

#233 is the exact predecessor and must integrate first. The former read-only central coverage/review failure is historical RCA rather than the current capability boundary. Unchanged #233 now has fresh exact-contributor-head CI, Release Acceptance, Trivy Security Scan, Semgrep SAST and bounded Strix evidence under protected central semantics. None of that evidence transfers to this child.

#233 remains non-passing because its active same-head OpenCode formal state is still CHANGES_REQUESTED, that disposition has not been superseded by a fresh qualifying semantic review, and no qualifying approval exists under live governance. Central .github remains read-only; mutable control-plane/reviewer/provider truth is centralized in #244. Do not mutate central, copy its workaround, churn pg heads merely to manufacture events, or transfer predecessor evidence.

This branch owns only the two timeline-history files above and does not mutate WAL receive, PITR target binding, WAL filename continuity, WAL-byte binding, canonical-documentation writer #229, or read-only central dependencies.

After #233 integrates, retarget/reconcile this PR non-destructively to then-current protected main, prove the relative diff remains exactly the two timeline-history files, and reacquire every exact-final-head/current-base CI, security, coverage, package, SBOM, provenance, release, review, and thread-resolution gate. Merge only with the qualifying independent non-author approval required by then-live policy.

Queued, pending, cancelled, skipped-required, absent, neutral, stale, predecessor, status-only, synthetic, author-only, rate-limited, infrastructure-failed, dismissed, or conclusion-null evidence is non-passing.

Refs #204, #233, #244.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}