[P0] Persist reputation source-generation uniqueness with atomic snapshot publication

[seonghobae]

Proven production defect and current implementation boundary — refreshed 2026-09-20 KST

Refs #80 #190 #191 #199 #200 #207 #208 #209 #212 #216 #217 #219 #221 #223 #224 #225 #226 #228 #229 #231 #233 #234 #236 #241 #242 #243 #244.

Test-only #191 proved a current-only generation cursor cannot enforce historical token uniqueness across transitions: an opaque source-generation token can ABA-reappear at a later ordinal. A bounded recent-token cache only delays the defect. PostgreSQL therefore remains planned production authority for historical generation identity and publication state.

Protected/default Wardnet truth remains main@f8260f1e03836039ff9463dd99fa982e4e270c4b; StateAuthority::Postgres remains disabled. Every PostgreSQL head remains Draft/unreleased until the complete dependency lineage reaches protected truth and an immutable release gate is satisfied.

Current canonical PostgreSQL lineage

Order remains:

#140 -> #193 -> #194 -> #196 -> #198 -> #199 -> #200 -> #207 -> #208 -> #209 -> #212 -> #216 -> #217 -> #219 -> #221 -> #223 -> #224 -> #225 -> #226 -> #228 -> #229 -> #231 -> #233 -> #234 -> #236 -> #241 -> #242 -> #244

#227/#230/#232/#235/#239/#240/#243 remain acceptance/RED or completion lanes. Parent movement requires ordinary non-force adoption and fresh exact-head evidence; predecessor checks never transfer.

The lineage is parked behind Runtime Configuration. Canonical #140 is now exact 99c7c6c798f13c9c37d00d9f586f102585ad3494, directly based on protected main@f8260f1e03836039ff9463dd99fa982e4e270c4b, mechanically mergeable and still Draft. The earlier protected-base synthesis/reconciliation lineage is integrated into this root: one immutable Runtime Configuration snapshot composes with protected credential/RBAC/public-bind semantics rather than allowing stale ambient run_from_env state to become authority. Repository-owned CI/Fuzz/SAST/Security evidence on the unchanged root is terminal GREEN; delegated CodeQL terminal settlement remains central .github#1929 ownership and is not a Wardnet source/test/SARIF RED.

Keep #193 and every descendant parked until #140 satisfies live review/governance and reaches protected truth by normal integration. Do not blind-rerun, add no-op churn, transfer predecessor GREEN, force/rebase, self/model approve, weaken gates or routinely bypass protection.

The first PostgreSQL child remains on its historical parent and its historical successes are predecessor evidence only. Current Draft tip #244 remains implementation evidence only; real PostgreSQL preflight/probe p95 and recovery evidence on that lineage must be reacquired after dependency-first non-force restack.

Draft contract already demonstrated

On real PostgreSQL 18.4 fixtures, without enabling production authority, the lineage has demonstrated durable tenant/source generation token+ordinal uniqueness under ENABLE+FORCE RLS; immutable admission and stable divergent conflicts; atomic publication history/last-known-good head; least-privilege capability roles; failure-atomic migrations and startup compatibility; externally managed ordinary runtime LOGIN mapping; transaction-local tenant binding and pooled cleanup; typed publication/read APIs with mandatory actor/decision attribution and no public raw-SQL escape; authoritative-complete reads; bounded pool replenishment/readiness; typed unknown-COMMIT outcome with no automatic replay; destructive physical backup/WAL/PITR recovery; divergent-writer serialization and byte-identical replay; half-open protocol-progress detection and selective healthy-member failover; and 200 real PostgreSQL preflight+probe samples at p95 <=20 ms on the Draft lineage.

Those receipts must be reacquired after dependency-first integration. cargo test/CI GREEN does not prove the standing 100% owned-production statement/line, branch, edge and public-rustdoc contract.

Durable aggregate contract

One authoritative PostgreSQL transaction must preserve tenant/source identity, opaque generation token, normalized generation ordinal, producer/version/tombstone identity, immutable evidence/provenance/completeness proof, exact prior publication and last-known-good head, plus attributable actor/decision audit evidence.

Database uniqueness is authoritative in both directions: one opaque token cannot bind to two ordinals and one ordinal cannot bind to two opaque tokens for one tenant/source. Exact committed replay is valid only when immutable publication identity and attribution are byte-identical; divergent replay fails deterministically.

Production repositories expose typed bounded operations, never generic raw-SQL callbacks. Partially admitted generations, partial evidence, partial publication and unaudited mutation are never current truth. Crash/cancellation/connection loss retains the prior published snapshot until complete commit. Unknown COMMIT is explicit and never converted to automatic replay or inferred success.

No explicit database lock or long-lived transaction may remain open across LLM calls, external I/O, sandbox execution or long-running computation. Read bounded state and end the transaction, perform slow work outside the transaction, then open a bounded write transaction and revalidate the required optimistic/concurrency predicate before commit. Cross-service SQL remains forbidden.

Remaining hostile acceptance / production gate

Before closure, one unchanged dependency-restacked integration candidate must prove: machine-verifiable 100% owned-production statement/branch/edge/public-rustdoc coverage; production backup/WAL retention/storage authority, encryption and key/IAM ownership without embedded long-lived secrets; production-shaped recovery objectives and destructive restore evidence; readiness/liveness/startup against the authoritative database; preserved historical uniqueness, publication completeness, actor/decision audit linkage, tenant RLS, commit ambiguity, pool bounds and no-replay semantics after restack; terminal CI/Fuzz/security/SAST/CodeQL/review/thread/package/SBOM/provenance/reproducibility/governance evidence on the same exact head; and ordinary protected integration followed by immutable Wardnet release identity binding source, artifact digest, SBOM, provenance/signature, reproducibility, rollback and recovery evidence.

StateAuthority::Postgres remains fail closed until that contract is protected truth. A Draft branch, successful cargo test, recovery fixture, p95 measurement or predecessor receipt is not production authority.

Ownership / architecture

This remains Wardnet Reputation Security Evidence state. It does not move to EgressWeave, contextual-orchestrator, quarantine-sandbox-runtime, AppGuardrail, CGC or EA Core. Keyverse may supply released authenticated tenant/subject claims; Wardnet validates action context and binds its database transaction. Principal lifecycle and backup-storage IAM remain deployment/infrastructure authority.

No source copy, cross-service SQL, mutable foreign production dependency, self/model approval, routine administrator bypass, force/destructive rebase, gate weakening, automatic replay of started database work or predecessor-evidence transfer. Generic solo-maintainer approval remains central .github#772; runner/OpenCode defects remain .github#712/#1234; delegated CodeQL settlement remains .github#1929 or verified successors.

Traceability

• PostgreSQL Global Development Group. (2026). PostgreSQL 18 documentation: Row security policies. https://www.postgresql.org/docs/18/ddl-rowsecurity.html
• PostgreSQL Global Development Group. (2026). PostgreSQL 18 documentation: Continuous archiving and point-in-time recovery. https://www.postgresql.org/docs/18/continuous-archiving.html
• PostgreSQL Global Development Group. (2026). PostgreSQL 18 documentation: Database connection control functions. https://www.postgresql.org/docs/18/libpq-connect.html
• PostgreSQL Global Development Group. (2026). PostgreSQL 18 documentation: Frontend/backend protocol. https://www.postgresql.org/docs/18/protocol-flow.html
• tokio-postgres 0.7.18. Client::check_connection. https://docs.rs/tokio-postgres/0.7.18/tokio_postgres/struct.Client.html
• Eggert, L., & Gont, F. (2009). TCP User Timeout Option (RFC 5482). https://www.rfc-editor.org/rfc/rfc5482
• National Institute of Standards and Technology. (2020, updated controls). SP 800-53 Rev. 5, CP-9 System Backup; CP-10 System Recovery and Reconstitution. https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final

[seonghobae]

Fresh Wardnet owner-path progress, 2026-09-08 KST:

• Draft security(state): persist tenant-scoped generation bindings #199 now has exact current b23c34f6656f6c4abd0b59875894d47bd86379e6 with terminal hosted CI 34230257863 SUCCESS. Its PostgreSQL 18.4 acceptance proves tenant-scoped historical token uniqueness, ordinal uniqueness, missing/cross-tenant fail-closed RLS, transaction-local tenant cleanup, and immutable history even when the test runtime role is deliberately granted SQL UPDATE/DELETE privileges. The latter operations expose zero rows because no mutation RLS policy exists; original provenance remains unchanged.
• A review-found single-writer violation on security(state): persist tenant-scoped generation bindings #199 was repaired at e0e0cbb75ce5f2f39f501bf4d145755965b983ea: the competing docs/product-technical-gap-baseline.md was removed, leaving docs(gaps): add exact-head readiness baseline #130 as the sole commercial ledger writer. security(state): persist tenant-scoped generation bindings #199 now changes only CHANGELOG, migration 0001, and its PostgreSQL acceptance.
• Draft successor security(state): define idempotent generation admission #200 is now the deliberate next RED directly on security(state): persist tenant-scoped generation bindings #199. Exact b27ae591d52375aec1e00958742341e3ddaf90fa adds only a real PostgreSQL acceptance for a defined generation-admission boundary: first binding committed; exact immutable replay replay; divergent provenance/token rebinding and occupied-ordinal rebinding must fail with stable conflict classes and leave history unchanged. Production is unchanged and the required migration 0002 is intentionally absent at the RED head. CI 34231630231 has materialized and is currently queued; predecessor GREEN is not transferred.

This remains a bounded #80/#192 progression, not production authority. PostgreSQL selection is still fail closed, and atomic coupling to producer lifecycle, accepted evidence snapshot/completeness, last-known-good publication, concurrency/crash behavior, pooling, migrations/recovery and backup/restore remain open acceptance. No recent-token cache or foreign-owner state is introduced.

[seonghobae]

Fresh durable-publication TDD progress — 2026-09-08 KST.

Draft successor #207 is directly stacked on exact #20063b2731. Test-only head d8d0cd3 produced the intended real RED in CI 34237346607 / job 102098369156 after rustfmt was repaired: cargo fmt --check passed, the existing workspace tests ran, and tests/postgres_atomic_publication.rs failed specifically because migrations/0003_reputation_source_publication.sql did not exist. The test requires first commit, exact replay, exact-prior CAS, atomic generation/evidence/completeness/lifecycle/LKG publication, rollback after an evidence constraint failure, stale-prior fail-closed behavior, and one-winner/one-conflict concurrent writers against PostgreSQL 18.4 under a non-owner/non-BYPASSRLS role.

Minimal production candidate 5761071 now adds only migration 0003 on top of that RED. It keeps production PostgreSQL selection disabled and uses SECURITY INVOKER + FORCE RLS, immutable publication history, a tenant/source LKG pointer, source-scoped transaction advisory serialization, exact replay identity, and stable reputation_source_publication_conflict CAS. Its hosted CI 34238358576 has materialized but is not yet terminal, so no GREEN is claimed.

This remains an incremental #80/#192 slice. Pool checkout/reset hygiene, repository wiring, migration/rollback/recovery, backup/restore, and immutable release evidence remain separate acceptance; no EgressWeave/quarantine/Context Graph/EA authority is copied into Wardnet.

[seonghobae]

Fresh hostile publication-order finding on 2026-09-08 KST. After the first atomic-publication candidate was added, review found that exact-prior CAS alone still allowed an unused but regressive ordinal to advance last-known-good authority. Test head f2ef0b0bbaa5599c9d82dbc54e3e27b71e5d643a added a real PostgreSQL 18.4 case generation-9@9 -> generation-10@8 under the non-owner/non-BYPASSRLS runtime role. CI 34238906678, rust job 102103706051, acquired ubuntu-24.04, passed checkout/format, passed the original atomic/idempotent/concurrent publication acceptance, then RED exactly because the regressive transition returned committed instead of reputation_source_publication_conflict.

Minimal causal repair is current Draft #207 head f595bc83198b45bc99fe1d9393dcb3ee3db8a860: when a publication head exists, successor admission now requires both exact prior-generation identity and candidate_ordinal > current_head_ordinal; otherwise the same stable conflict class is raised before generation admission. Current-head CI 34240277646 is materialized but still non-terminal, so GREEN is not claimed and no predecessor result transfers. Production PostgreSQL selection remains disabled; pooling context hygiene, migration/rollback/restore and full #80 repository wiring remain open acceptance.

[seonghobae]

Fresh privilege-boundary RED and causal repair — 2026-09-08 KST.

After the official-image startup harness was repaired, exact 43c6396e750d27c35f0a071543e81fce4cc788f2 produced the intended hosted semantic RED in CI 34243761631, rust job 102120327373: formatting and every preceding PostgreSQL 18.4 acceptance passed, including atomic/idempotent/concurrent publication, ordinal-regression rejection, generation RLS and admission. tests/postgres_publication_privilege_boundary.rs then failed exactly because the runtime role could execute direct UPDATE reputation_source_publication_head and bypass the function's CAS/monotonicity state machine. This confirms that RLS tenant isolation alone is insufficient when a SECURITY INVOKER publication function requires underlying runtime DML grants.

Minimal repair is current Draft #207 head 80af90273def9f72042ef378d3a74ea31b8a6de6: migration 0003 changes the publication boundary to SECURITY DEFINER with search_path = pg_catalog, pg_temp; PUBLIC execute remains revoked. The executable deployment-role acceptance provisions a dedicated NOLOGIN/NOSUPERUSER/NOBYPASSRLS state owner, transfers the publication function to it, gives that owner only the DML needed by the bounded transaction, and gives the runtime role SELECT + publication-function EXECUTE only. It asserts rolsuper=false, rolbypassrls=false, prosecdef=true, runtime INSERT/UPDATE privileges=false, successful function-mediated publication, failed direct head regression, failed direct history forgery, unchanged last-known-good head and immutable history count. Migration deliberately does not create cluster roles; production PostgreSQL selection remains disabled until #80 supplies the deployment/migration/pooling/recovery contract.

Current-head CI 34244982960 is queued/non-terminal, so GREEN is not claimed and no predecessor receipt transfers.

[seonghobae]

Exact-current publication slice is now GREEN and code-current. Draft #207 remains stacked on exact #20063b2731; current head is 1d45a024f7e6a0cc351eda3b9fb317ccf6e35300. The intervening post-repair delta was read/adopted non-force: CHANGELOG plus Proposed ADR docs/adr/2026-09-08-reputation-source-publication-transaction-boundary.md and its index only; migration/tests remain the least-privilege atomic-publication implementation already reviewed.

Hosted CI 34245836806, rust job 102127456517, is terminal SUCCESS on unchanged 1d45a024...: hosted ubuntu-24.04 executed fmt, locked workspace tests against PostgreSQL 18.4, including atomic publication/CAS/rollback/concurrency/FORCE-RLS and the dedicated NOLOGIN/NOSUPERUSER/NOBYPASSRLS state-owner + least-privilege runtime boundary, then strict Clippy. Reviews 0; inline threads 0. Predecessor 80af... GREEN is retained only as history, not promoted to the documentation head.

#207 therefore closes the bounded publication-transaction/privilege slice but does not enable production PostgreSQL authority. The next #80/#192 acceptance remains executable deployment-role provisioning plus repository/pool context hygiene, migration upgrade/rollback/recovery, backup/restore and production fail-closed readiness. In particular, deployment must prove the final state-owner/runtime grants rather than relying on the test fixture: state owner remains NOLOGIN/NOSUPERUSER/NOBYPASSRLS, runtime receives no direct publication INSERT/head UPDATE or inner-admission authority, and pooled transactions establish tenant context transaction-locally with no context surviving connection reuse.

[seonghobae]

Exact-current follow-up — #207 is now GREEN on its documentation-bearing head. Current Draft head 1d45a024f7e6a0cc351eda3b9fb317ccf6e35300 is still based directly on #200@63b2731d7173d24fc15cc1c340fb177727d33251. Hosted CI 34245836806, rust job 102127456517, completed SUCCESS on this exact head: checkout/toolchain, cargo fmt --check, locked workspace tests including all real PostgreSQL 18.4 atomicity/concurrency/ordinal/tenant/least-privilege cases, strict Clippy and cleanup all passed.

The slice now also carries Proposed ADR docs/adr/2026-09-08-reputation-source-publication-transaction-boundary.md and the matching Unreleased CHANGELOG entry. It does not promote PostgreSQL to production authority. Remaining #80/#192 acceptance is unchanged and explicit: deployment state-owner/runtime role installation, repository wiring, pooled-connection tenant-context checkout/reset, migration upgrade/rollback/recovery, crash/retry semantics, backup/restore survival and immutable protected release evidence. No predecessor result, self/model approval or bypass is being used.

[seonghobae]

Exact-current deployment-role/atomicity GREEN — 2026-09-08 KST. Draft #208 remains directly stacked on #207@1d45a024f7e6a0cc351eda3b9fb317ccf6e35300; current exact head is 03af6b3c962ce7d681bd49f5a80487aa94283bc6, mergeable, with zero current review threads. Hosted CI 34248937286 / rust 102138060537 is terminal SUCCESS on that unchanged head: formatting, all locked workspace tests including real PostgreSQL 18.4 role installation/replay, least-privilege mediation and deterministic mid-flight rollback, plus strict Clippy all passed.

The hostile predecessor 282f0fec7ff16b3aa4e1e086900970e154e4f1c0 / CI 34248558975 proved the deployment artifact was non-atomic: an injected ALTER FUNCTION failure stranded both capability roles and temporary state-owner schema CREATE. The minimal repair wraps the full installer in one PostgreSQL transaction, so role creation, grants, ownership-transfer privilege and revocations now roll back together. No production PostgreSQL selection is enabled.

#80/#192 still require repository wiring, actual deployment principal mapping, pooled tenant-context checkout/reset, migration upgrade/rollback/recovery, crash/retry, backup/restore and protected immutable release evidence before PostgreSQL can become production authority. No predecessor receipt, self/model approval or bypass is used.

[seonghobae]

2026-09-09 KST state-authority progression, preserving #80/#192 ownership:

• test(state): require pooled transaction-local tenant context #223 is now exact 0876c55fdc82927adaece4f3bb414a7a631dea68, Draft on security(state): bind external runtime principal #221@e2ff0fe4055a598a5c450e7942fed2051ec21238. Hosted CI 34284257853 / rust 102256023876 and Fuzz 34284257807 / job 102256114065 are terminal SUCCESS. The session boundary binds tenant identity transaction-locally, cleans pooled connections across commit/error/cancellation, and now also rejects non-loopback PostgreSQL hostaddr before the test-only NoTls connector can perform remote I/O. Production PostgreSQL state authority remains disabled.
• The next bounded typed application-repository child is test(state): require typed PostgreSQL publication repository #224, exact test-only 38ff51a63e7fab153a0b1ca411265a45ec17ce35 on that test(state): require pooled transaction-local tenant context #223 head. Its PostgreSQL 18.4 hostile contract requires typed generation-8@8 -> generation-9@9, stable rejection of historical token ABA generation-8@10, preservation/replay of generation 9 after the failed ABA, and rejection of a different token rebound to ordinal 9. It intentionally requires callers not to construct SQL or parse PostgreSQL error strings.

#224 does not claim the whole #192 aggregate complete. After its typed publication repository is GREEN, remaining acceptance still includes attributable audit/evidence coupling at the durable boundary, phase-specific connection-loss/cancellation rollback, authoritative reads of only complete published aggregates, backup/restore with retention/encryption/RPO/RTO, readiness/degraded evidence, protected integration and immutable release.

[seonghobae]

Current Wardnet application-repository prerequisite has advanced beyond this issue body and was re-read on exact live evidence.

• security(state): bind external runtime principal #221 current exact e2ff0fe4055a598a5c450e7942fed2051ec21238: terminal CI 34275523673; rejects both shadow runtime-membership paths and pre-existing effective Wardnet mutation/inner-admission authority before mapping an external LOGIN.
• test(state): require pooled transaction-local tenant context #223 current exact 0876c55fdc82927adaece4f3bb414a7a631dea68: terminal CI 34284257853 and Fuzz 34284257807; owns pooled transaction-local tenant binding, RLS isolation, physical-connection cleanup and cancellation rollback.
• test(state): require typed PostgreSQL publication repository #224 current exact c805d83484be91a157ed8350944bf7d35d37bc7e: terminal CI 34290913936 / rust 102277031944 and Fuzz 34290913959 / 102277103330; owns the bounded typed publish_reputation_source repository call and stable Committed / Replay / PublicationConflict mapping. Real PostgreSQL 18.4 proves 8@8 -> 9@9, historical 8@10 ABA rejection, last-known-good replay, and ordinal rebound rejection.

Fresh exact-source review confirms the next #192 acceptance boundary is not another publication wrapper. migrations/0003_reputation_source_publication.sql atomically writes generation/publication/head evidence but creates no attributable audit relation/row; PostgresTenantPool::publish_reputation_source carries no authenticated subject/audit decision identity. The existing standalone/community AppData.audit_logs model is not production PostgreSQL authority and must not be silently reused as a tenantless persistence contract. Startup schema truth is separately versioned at 4 by deploy/postgresql/reputation_state_migrate.sql, so adding audit persistence must be an explicit supported schema evolution rather than editing 0003 in place.

Next bounded RED acceptance before production authority can advance: from exact #224 ancestry, use real PostgreSQL 18.4 and the externally managed runtime LOGIN; require a publication to commit exactly one tenant-scoped attributable audit record in the same database transaction; exact replay must not duplicate the audit record; a divergent publication or injected failure before audit completion must leave neither the candidate publication/head nor audit residue; cross-tenant/unbound audit visibility must remain default-deny; actor/decision identity must be validated parameter data and must not come from display names or ambient SQL/session text. GREEN must introduce the smallest new migration/version/role/repository contract needed for that invariant, preserve canonical 0001..0004 history, startup locking/future-schema refusal/recovery discipline and #223 transaction-local session semantics, and keep StateAuthority::Postgres disabled. No generic raw-SQL escape hatch, tenantless audit table, mutable sibling dependency, or predecessor evidence transfer.

[seonghobae]

2026-09-09 KST durable-aggregate progression: #227's complete-current-read acceptance now has an executed semantic RED and a minimum production candidate in Draft #228 on exact parent #226 da5f2b01163e9db1416bfa4162ebdb7953778fc5.

Exact d5b8bb17e3ebc6f97a1c7c88f7c63456f617e356 reached the intended RED in CI 34303075828 / rust 102313985043: checkout/toolchain/formatting completed and locked workspace compilation failed because the typed current_reputation_source_publication contract and fail-closed IncompletePublication outcome were absent. Candidate 5d4ce5b2... added only that typed immutable read inside the existing transaction-local tenant boundary. When its CI finally acquired a hosted runner, it failed only an emitted rustfmt line wrap before tests; Wardnet repaired exactly that formatting delta at current #228 f0c42b84b16549f58a0f93d8b74d643cebba91bf.

Current exact CI 34306473646 and Fuzz 34306473577 are queued, so GREEN is not claimed. The real PostgreSQL 18.4 fixture still requires generation 9 to remain complete current truth after generation 10 is merely admitted, typed absence for another tenant/unknown source, blank-source rejection, and IncompletePublication after required audit evidence is removed. Production PostgreSQL authority stays disabled. After this read reaches exact-head GREEN, remaining #80/#192 acceptance is repository-level divergent-writer concurrency, publication-phase crash/cancellation/connection-loss + idempotent retry, real backup/restore/RPO-RTO, readiness/degraded behavior, protected integration and immutable release.

[seonghobae]

Fresh 2026-09-09 current-state correction: exact #228 f0c42b84b16549f58a0f93d8b74d643cebba91bf now has both repository-owned CI 34306473646 and Fuzz 34306473577 terminal SUCCESS; fresh submitted reviews and inline review threads remain zero. That closes only acceptance item 9 (typed complete-current aggregate read) for the unchanged #228 slice and does not transfer through parent/protected-base movement.

Fresh post-GREEN source review found the next bounded #192 degraded-capacity/connection-loss gap in the typed pool: PostgresTenantPool::next_connection() blindly round-robins fixed Client slots, so a driver-closed backend can continue to be selected even while another pool member is healthy. Draft test-first child #229 is stacked on exact #228. Its formatted production-unchanged head is 2810982b207663e2d97c581e88073b859c344fcc; current CI 34307833504 is queued, so no semantic RED claim is made yet. Acceptance is intentionally narrow: a member known closed before an operation must be skipped in favor of a healthy member, while Wardnet must not replay a transaction/query after it has begun or failed because commit outcome may be ambiguous. Automatic replenishment and publication-phase ambiguous-commit recovery remain later #80/#192 work.