Production blocker and current protected truth — refreshed 2026-09-17 KST
Protected/default Wardnet truth remains main@f8260f1e03836039ff9463dd99fa982e4e270c4b after #155. Production mode still does not use PostgreSQL as authoritative state; StateAuthority::Postgres remains deliberately disabled on protected truth. Draft PostgreSQL work is implementation evidence, not protected/released authority.
Wardnet still needs PostgreSQL to be the only production authority for durable control-plane/security-evidence state while retaining JSON/file state only for standalone/community operation. The production boundary must provide multi-replica concurrency, tenant isolation, transactional mutation+audit, recoverable migrations, bounded connection degradation and independently verifiable recovery evidence. Issue #192 owns detailed durable reputation/publication/uniqueness invariants. Issue #243 owns machine-verifiable 100% owned-production statement/line, branch, edge and public-rustdoc evidence.
Current dependency state
Canonical order remains:
#140 -> #193 -> #194 -> #196 -> #198 -> #199 -> #200 -> #207 -> #208 -> #209 -> #212 -> #216 -> #217 -> #219 -> #221 -> #223 -> #224 -> #225 -> #226 -> #228 -> #229 -> #231 -> #233 -> #234 -> #236 -> #241 -> #242 -> #244
#227/#230/#232/#235/#239/#240/#243 remain acceptance/RED or completion lanes. Every parent/head movement requires ordinary non-force adoption and fresh exact-head evidence; predecessor checks do not transfer.
The foundation is still not integrable. Runtime Configuration #140 remains exact 7d98725cc51b259b0be940385b2245758d098081, pre-#155/non-mergeable. Reverse-direction #310 remains the protected-base synthesis lane. src/credentials.rs is already reconciled with #155; the remaining semantic source conflict is src/lib.rs.
Serialized hostile synthesis child #430 is now exact 65b887e347d47e3cd29071342c353408c3f14e4a. Test-only 062ea6ab787d0a1d864e429a95f7ed1642fbf37e established semantic RED on repository-native CI: Fuzz 35029440921 is SUCCESS and CI 35029440905 / rust job 104584220679 proved stale run_from_env could bind public 0.0.0.0:44429 with no write-capable administrator, while protected-auth primitives remained unused. Invalid whole-file repair 408e8b8de90d061e6ef01414f298f2156d2466df was reverted at 61790e2a46e8c45467f57558673e5a1b8a2e0490 and is not promotable.
The bounded deterministic synthesis helper at predecessor exact cc8f721775e808ff00961dc8e29540e34720b1c2 completed successfully in one-shot run 35160876925 / job 105011075007, reconstructed from protected complete src/lib.rs, applied only the reviewed Runtime Configuration/authentication composition, ran the targeted hostile and library verification, committed only src/lib.rs as 0e0f01efbd6e21874c94eed987192534e234f211, and was removed by ordinary fast-forward follow-up. Current #430 exact 65b887e... therefore contains the production-source synthesis. That construction GREEN does not transfer to current admission: fresh exact-current CI 35180770661 / rust job 105072217366 and Fuzz 35180770659 remain QUEUED at the latest live read. Do not restack #193 or later children, blind-rerun, add no-op churn or treat predecessor construction evidence as exact-current GREEN while this foundation is still awaiting admission.
The only admissible foundation repair is a complete, non-truncating src/lib.rs synthesis that preserves one immutable Runtime Configuration snapshot, CredentialRegistry secret authority, strict/header-presentable/write-capable administrator derivation, constant-time request authentication, pre-bind require_write_auth_for_bind, readiness/listener-loopback state, management 401/403, request-body/rate/state/credential/flush/shutdown behavior and single-sourced parse helpers.
First PostgreSQL child #193 remains exact 7a93322c9a824e6e939a8143b1f20eccaeac856d on historical parent 93a51f9706cf8a9704f69aed4a69df5be16c84e4; its historical CI/Fuzz successes do not transfer. Current tip #244 remains Draft implementation evidence only. Keep the chain intact and parked; do not force/rebase or manufacture disposable checks while the foundation moves.
Draft implementation contract already demonstrated
On real postgres:18.4-bookworm, without enabling production authority, the Draft lineage has demonstrated fail-closed authority selection behind configuration/credential boundaries; durable tenant/source generation token+ordinal uniqueness; atomic publication/history/current-head state with actor/decision attribution; ENABLE+FORCE RLS plus constrained runtime roles; failure-atomic migrations/rollback/reapply; transaction-local tenant context and pool cleanup; typed repositories with no production raw-SQL escape hatch; exact replay/conflict and explicit unknown-COMMIT semantics; bounded pool replacement/reconnect; physical base-backup/WAL/PITR destructive restore; divergent-writer serialization; half-open protocol preflight; and a real 200-sample PostgreSQL preflight+probe buyer-path measurement at p95 <=20 ms on that Draft lineage.
These receipts must be reacquired after dependency-first integration. cargo test is not proof of the standing 100% coverage/rustdoc contract.
Production ownership / integrity contract
Every mutable production row carries explicit tenant and actor/service ownership where applicable. Stable IDs/timestamps come from authority rather than trusted clients. Keyverse supplies authenticated subject/tenant claims through a released contract; Wardnet validates action context and binds tenant authority to its own transaction. Display names, email addresses, HTTP headers and connection-string text are never authorization keys.
Migrations are versioned and failure-atomic. PK/FK/uniqueness/check/domain constraints enforce durable invariants. Critical mutations and Wardnet audit evidence are atomic. Production repositories expose bounded typed operations, not arbitrary SQL callbacks. Once database work begins, connection loss/timeout never causes automatic replay; unknown COMMIT stays explicit and can only be reconciled by later byte-identical typed commands. ENABLE+FORCE RLS is default-deny; runtime LOGINs remain non-owner/non-superuser/non-BYPASSRLS; tenant context is Wardnet-validated and transaction-local. Wardnet migrations do not create long-lived credentials.
No explicit database lock or long-lived transaction may remain open across LLM calls, external I/O, sandbox execution or long-running computation. Read bounded state and end the transaction, perform slow work outside the transaction, then open a bounded write transaction and revalidate the required optimistic/concurrency predicate before commit. Cross-service SQL remains forbidden.
Reliability / recovery contract
Pool capacity is bounded; failed members have bounded replacement authority and cannot head-of-line block healthy members. Protocol progress is checked before business work without replay; stale/desynchronised sessions are removed before reuse. Liveness/startup/readiness remain distinct. Physical backup + WAL/PITR is canonical database recovery with destructive restore evidence. Production backup cadence, retention, archive durability, storage/encryption/key/IAM authority and measured RPO/RTO/SLO remain deployment/operability contracts rather than lab claims.
Remaining production gate
One unchanged dependency-restacked integration candidate still needs protected integration of #140 first and every PostgreSQL child in order; exact 100% owned-production statement/branch/edge/public-rustdoc evidence; production backup/WAL retention, storage/encryption/key/IAM authority and recovery evidence; exact-current startup/readiness/degraded behavior; revalidation of cross-tenant denial, actor/decision attribution, immutable publication/current-head integrity, divergent-writer conflict, byte-identical replay, unknown COMMIT, half-open protocol loss and no-replay semantics; terminal CI/Fuzz/security/SAST/CodeQL/review/thread/package/SBOM/provenance/reproducibility/governance evidence on the same head; and immutable release identity tying source, schema/migrations, package/image, SBOM/provenance/signature, recovery and rollback together.
Close only after PostgreSQL is technically enforced as production authority, RLS is proven below application filtering, critical mutations are transactional/auditable, degraded/unknown outcomes remain bounded/non-replaying, backup/restore meets accepted production objectives, startup/readiness fails closed, exact coverage/rustdoc evidence is complete, and the exact protected integration is published as an immutable verified Wardnet release.
Boundaries
Keyverse owns authenticated identity claims; Wardnet owns Wardnet authorization and transaction binding. Billing/credit products retain financial-ledger authority. EgressWeave, quarantine-sandbox-runtime, contextual-orchestrator, AppGuardrail, Context Graph Contracts and EA Core remain separate canonical owners; no source copy, mutable runtime dependency or cross-service SQL. .github remains canonical for reusable workflow/governance/control-plane repair.
Do not close because a Draft stack is GREEN, a database fixture restores, a p95 sample meets target, or documentation names PostgreSQL.
References
Production blocker and current protected truth — refreshed 2026-09-17 KST
Protected/default Wardnet truth remains
main@f8260f1e03836039ff9463dd99fa982e4e270c4bafter #155. Production mode still does not use PostgreSQL as authoritative state;StateAuthority::Postgresremains deliberately disabled on protected truth. Draft PostgreSQL work is implementation evidence, not protected/released authority.Wardnet still needs PostgreSQL to be the only production authority for durable control-plane/security-evidence state while retaining JSON/file state only for standalone/community operation. The production boundary must provide multi-replica concurrency, tenant isolation, transactional mutation+audit, recoverable migrations, bounded connection degradation and independently verifiable recovery evidence. Issue #192 owns detailed durable reputation/publication/uniqueness invariants. Issue #243 owns machine-verifiable 100% owned-production statement/line, branch, edge and public-rustdoc evidence.
Current dependency state
Canonical order remains:
#140 -> #193 -> #194 -> #196 -> #198 -> #199 -> #200 -> #207 -> #208 -> #209 -> #212 -> #216 -> #217 -> #219 -> #221 -> #223 -> #224 -> #225 -> #226 -> #228 -> #229 -> #231 -> #233 -> #234 -> #236 -> #241 -> #242 -> #244#227/#230/#232/#235/#239/#240/#243 remain acceptance/RED or completion lanes. Every parent/head movement requires ordinary non-force adoption and fresh exact-head evidence; predecessor checks do not transfer.
The foundation is still not integrable. Runtime Configuration #140 remains exact
7d98725cc51b259b0be940385b2245758d098081, pre-#155/non-mergeable. Reverse-direction #310 remains the protected-base synthesis lane.src/credentials.rsis already reconciled with #155; the remaining semantic source conflict issrc/lib.rs.Serialized hostile synthesis child #430 is now exact
65b887e347d47e3cd29071342c353408c3f14e4a. Test-only062ea6ab787d0a1d864e429a95f7ed1642fbf37eestablished semantic RED on repository-native CI: Fuzz35029440921is SUCCESS and CI35029440905/ rust job104584220679proved stalerun_from_envcould bind public0.0.0.0:44429with no write-capable administrator, while protected-auth primitives remained unused. Invalid whole-file repair408e8b8de90d061e6ef01414f298f2156d2466dfwas reverted at61790e2a46e8c45467f57558673e5a1b8a2e0490and is not promotable.The bounded deterministic synthesis helper at predecessor exact
cc8f721775e808ff00961dc8e29540e34720b1c2completed successfully in one-shot run35160876925/ job105011075007, reconstructed from protected completesrc/lib.rs, applied only the reviewed Runtime Configuration/authentication composition, ran the targeted hostile and library verification, committed onlysrc/lib.rsas0e0f01efbd6e21874c94eed987192534e234f211, and was removed by ordinary fast-forward follow-up. Current #430 exact65b887e...therefore contains the production-source synthesis. That construction GREEN does not transfer to current admission: fresh exact-current CI35180770661/ rust job105072217366and Fuzz35180770659remain QUEUED at the latest live read. Do not restack #193 or later children, blind-rerun, add no-op churn or treat predecessor construction evidence as exact-current GREEN while this foundation is still awaiting admission.The only admissible foundation repair is a complete, non-truncating
src/lib.rssynthesis that preserves one immutable Runtime Configuration snapshot,CredentialRegistrysecret authority, strict/header-presentable/write-capable administrator derivation, constant-time request authentication, pre-bindrequire_write_auth_for_bind, readiness/listener-loopback state, management 401/403, request-body/rate/state/credential/flush/shutdown behavior and single-sourced parse helpers.First PostgreSQL child #193 remains exact
7a93322c9a824e6e939a8143b1f20eccaeac856don historical parent93a51f9706cf8a9704f69aed4a69df5be16c84e4; its historical CI/Fuzz successes do not transfer. Current tip #244 remains Draft implementation evidence only. Keep the chain intact and parked; do not force/rebase or manufacture disposable checks while the foundation moves.Draft implementation contract already demonstrated
On real
postgres:18.4-bookworm, without enabling production authority, the Draft lineage has demonstrated fail-closed authority selection behind configuration/credential boundaries; durable tenant/source generation token+ordinal uniqueness; atomic publication/history/current-head state with actor/decision attribution; ENABLE+FORCE RLS plus constrained runtime roles; failure-atomic migrations/rollback/reapply; transaction-local tenant context and pool cleanup; typed repositories with no production raw-SQL escape hatch; exact replay/conflict and explicit unknown-COMMIT semantics; bounded pool replacement/reconnect; physical base-backup/WAL/PITR destructive restore; divergent-writer serialization; half-open protocol preflight; and a real 200-sample PostgreSQL preflight+probe buyer-path measurement at p95<=20 mson that Draft lineage.These receipts must be reacquired after dependency-first integration.
cargo testis not proof of the standing 100% coverage/rustdoc contract.Production ownership / integrity contract
Every mutable production row carries explicit tenant and actor/service ownership where applicable. Stable IDs/timestamps come from authority rather than trusted clients. Keyverse supplies authenticated subject/tenant claims through a released contract; Wardnet validates action context and binds tenant authority to its own transaction. Display names, email addresses, HTTP headers and connection-string text are never authorization keys.
Migrations are versioned and failure-atomic. PK/FK/uniqueness/check/domain constraints enforce durable invariants. Critical mutations and Wardnet audit evidence are atomic. Production repositories expose bounded typed operations, not arbitrary SQL callbacks. Once database work begins, connection loss/timeout never causes automatic replay; unknown COMMIT stays explicit and can only be reconciled by later byte-identical typed commands. ENABLE+FORCE RLS is default-deny; runtime LOGINs remain non-owner/non-superuser/non-
BYPASSRLS; tenant context is Wardnet-validated and transaction-local. Wardnet migrations do not create long-lived credentials.No explicit database lock or long-lived transaction may remain open across LLM calls, external I/O, sandbox execution or long-running computation. Read bounded state and end the transaction, perform slow work outside the transaction, then open a bounded write transaction and revalidate the required optimistic/concurrency predicate before commit. Cross-service SQL remains forbidden.
Reliability / recovery contract
Pool capacity is bounded; failed members have bounded replacement authority and cannot head-of-line block healthy members. Protocol progress is checked before business work without replay; stale/desynchronised sessions are removed before reuse. Liveness/startup/readiness remain distinct. Physical backup + WAL/PITR is canonical database recovery with destructive restore evidence. Production backup cadence, retention, archive durability, storage/encryption/key/IAM authority and measured RPO/RTO/SLO remain deployment/operability contracts rather than lab claims.
Remaining production gate
One unchanged dependency-restacked integration candidate still needs protected integration of #140 first and every PostgreSQL child in order; exact 100% owned-production statement/branch/edge/public-rustdoc evidence; production backup/WAL retention, storage/encryption/key/IAM authority and recovery evidence; exact-current startup/readiness/degraded behavior; revalidation of cross-tenant denial, actor/decision attribution, immutable publication/current-head integrity, divergent-writer conflict, byte-identical replay, unknown COMMIT, half-open protocol loss and no-replay semantics; terminal CI/Fuzz/security/SAST/CodeQL/review/thread/package/SBOM/provenance/reproducibility/governance evidence on the same head; and immutable release identity tying source, schema/migrations, package/image, SBOM/provenance/signature, recovery and rollback together.
Close only after PostgreSQL is technically enforced as production authority, RLS is proven below application filtering, critical mutations are transactional/auditable, degraded/unknown outcomes remain bounded/non-replaying, backup/restore meets accepted production objectives, startup/readiness fails closed, exact coverage/rustdoc evidence is complete, and the exact protected integration is published as an immutable verified Wardnet release.
Boundaries
Keyverse owns authenticated identity claims; Wardnet owns Wardnet authorization and transaction binding. Billing/credit products retain financial-ledger authority. EgressWeave, quarantine-sandbox-runtime, contextual-orchestrator, AppGuardrail, Context Graph Contracts and EA Core remain separate canonical owners; no source copy, mutable runtime dependency or cross-service SQL.
.githubremains canonical for reusable workflow/governance/control-plane repair.Do not close because a Draft stack is GREEN, a database fixture restores, a p95 sample meets target, or documentation names PostgreSQL.
References