Repository navigation
Track PostgreSQL qualification gates for a future release #74
Description
Objective and evidence policy
SPOOL's industrial flagship is high-assurance verified PostgreSQL mutation/migration: bind an exact source state, deterministic plan, trusted authenticated authority and live target contract; fence execution; reconcile ambiguous outcomes; prove exact external target state; separately authorize repair/cutover; emit independently verifiable receipts. No connector-count race. Do not infer success from file presence, process return, job conclusion, or transport acknowledgment alone.
Snapshot 2026-09-26: latest main SHA 333a535a9fe5e04fe6ac6247897c9a9f45238d50; released v1.1.1 excludes industrial PostgreSQL. PostgreSQL qualification PR #71 at 1ce26faa0571c6a5d63450c4d053893886719c7e; red-team draft PR #72 at cf031cba8d5dfd58a452e8309d6fa5f6214d654a. Prior conversational 43/100 is a historical subjective baseline, not a measured new score. All outstanding P0 items stop-ship for enterprise PostgreSQL.
Evidence state: production smoke 36230115706 job 108371545596 had runner_id=0, steps=[], failure. Industrial release gate and CodeQL also ended before test steps. This is QUALIFICATION_NOT_EXECUTED, not a product-test failure and not a PASS. main is unprotected. Connected GitHub integration cannot read or configure protection (403). Repo-private Actions entitlement/billing/policy remains unverified. Do not guess the root cause. Current benchmark file at 5b60af2 reports target writes: 100K/1M/5M at ~110,375/~131,130/~118,296 rows/s, respectively; 10M skipped for disk. These results are not independently reproduced industrial evidence.
P0 — blocking prerequisites and acceptance gates
- Executable enforced release/security governance. Determine Actions runner allocation cause using repository Settings > Actions, plan/billing/spending, runner eligibility and enterprise policy where applicable. A real Linux job must acquire a runner and execute steps; then real CodeQL, release-gate, SQLite OS matrix, PostgreSQL conformance and browser smoke must pass on the exact candidate SHA. Protect
main: PR-only, required checks, review, no ordinary bypass/force push/deletion. Build/release provenance must bind commit and artifact. Until enforcement exists, fail closed; do not report remote gate PASS. - Target DDL/contract TOCTOU and cardinality. In
src/connectors/postgres/target.js, the 10scheckRepairContractTTL can skip a changed contract, and CDCflushUpsertstests only cumulativeinserted+updated < 1. For every mutating transaction hold a DDL-conflicting relation lock across fresh contract inspection, fenced mutations and ledger COMMIT; use canonical endpoint/identity scoped cache only for non-authoritative hints. Check every SQL piece:written.rowCount === piece.length,written.rows.length === piece.length, returned insert/update tally === piece length, and final totals equal intended effects; handle zero-column updates, delete skips and trigger/rule/RLS side effects explicitly. Trigger-suppression and concurrent ADD/DROP/ALTER, index/PK, RLS, rule, generated-column, session-replication-role changes must fail closed withoutCOMMITTED_EXACT. Validate live session and relation contract also during repair/cutover. - Trust boundary for authority. Replace caller-controlled
principalwith verified OIDC/mTLS/service identity; bind claims to issuer, audience, nonce, expiry, tenant and credential rotation; enforce scoped RBAC+ABAC in command kernel, not a UI wrapper; negative impersonation/replay/cross-tenant tests required. - Separation of duties / multi-party controls. Separate approval-signing key and service role from execution role, with distinct authorization records, revocation, two independent identities for destructive repair/schema/cutover, replay-resistance and immutable SIEM-ready audit. A single daemon bearer must not assert two approvers.
- Hard crash and natural lease takeover. No DELETE/administrative lease cleanup in test harness. Process A obtains fence F; hard SIGKILL with lease intact; before TTL B is refused; after DB-clock expiry B obtains F+; old A's mutations rejected, including commit races. Prove target ledger/checkpoint recovery and ambiguous COMMIT. Repeat under container/machine loss where feasible.
- Source-to-target transaction fidelity and contract continuity. Real logical-decoding transactions must map to exactly one fenced target transaction; checkpoint and server acknowledgment only after durable exact application; bind source relation/row identity/publication, exported snapshot and decoding contract. Fail closed on publication drift, replica identity/PK changes, TOAST semantics, TRUNCATE exclusion, duplicate event/replay, schema transition mismatch.
- Qualification-class integrity. Replace any release/promotion inference from
releaseGrade:booleanwith explicit, monotonically bounded qualification claims and schema-versioned verification. Existing v3/v4 evidence can remain readable as legacy integrity records but may NOT silently acquire a new production class.CUSTOMor dirty runs never inherit immutable-profile qualification. Class evidence binds SHA, source/target engine exact build, topology, config, workload, security/fault gates, metrics, CI run identity, expiration/revocation and independent verifier outcome.
Proposed minimum qualification envelopes — freeze before execution
These are future acceptance thresholds, not accomplished measurements. All classes need exact source/target verification, zero unexplained loss/duplicates, contract-drift refusal, independently checked artifacts; requirements are cumulative.
| Claim | Minimum dataset and soak | Additional mandatory gates |
|---|---|---|
| CI_CORRECTNESS | >=100K rows; >=30s actual CDC | real PG, unit/integration/conformance, DDL/trigger cardinality, deterministic evidence, no mocks counted as integration |
| PILOT | >=1M rows; >=1h CDC | source handoff, live content verify/repair, SIGKILL and lease expiry, basic IAM/audit, bounded resources |
| SMALL_PRODUCTION | >=10M rows; >=24h CDC | TOAST and 1GB tx spill, ambiguous commit, DB restart, publication/slot/WAL faults, repair/cutover crashes |
| MEDIUM_PRODUCTION | >=100M rows; >=72h CDC | HA/promotion and timeline/slot checks, network partition, TLS/DNS/credential rotation, disk/I/O/fsync, rolling upgrade and rollback |
| LARGE_PRODUCTION | >=1B rows when capacity exists; >=7d CDC | multiple workers, sustained HA/soak, repeated failover, verified p99 latency/RPO/RTO/lag and resource limits |
| INDUSTRIAL | LARGE envelope plus repeated independent certification | OIDC/SSO/SCIM/RBAC/ABAC/SoD/dual approval, KMS/HSM rotation, OTel/SIEM, SBOM/SAST provenance, published version/topology support, operator drills, support/SLA and independently verified signed receipts |
An environment unable to execute the tier must say NOT_QUALIFIED, never silently downscale. Do not use row count alone as an INDUSTRIAL indicator.
P1/P2 living gap register (owner/status/evidence required on each update)
All below remain OPEN / not independently qualified unless replaced with exact passing evidence on a named commit:
| Area | Priority | Required acceptance evidence |
|---|---|---|
| PostgreSQL full-load | P1 | exported snapshot held, multiple readers same state, schema/engine fingerprint, independently reconciled source cardinality and 1M/10M/100M/1B tiers |
| CDC transaction fidelity | P1 | ordered BEGIN/COMMIT, unchanged/changing TOAST, LOB/json/float/numeric/NULL fidelity, TRUNCATE fail-closed, large transaction byte envelope |
| Crash recovery / ambiguous outcome | P0/P1 | hard kill between data/ledger/checkpoint/ACK, DB restart, exact reconciliation, safe reacquire |
| Cutover | P0/P1 | source quiescence/barrier, final snapshot-to-CDC watermark, independent approval, SIGKILL mid-cutover, rollback and dual-write detection |
| Verification/repair | P1 | false-positive and false-negative corpus, independent comparison; tamper/delete triggers, repair cardinality and post-crash convergence, approval revocation |
| Scale/performance | P1 | 100K,1M,10M,100M,1B; CPU, RSS, disk, WAL amplification, throughput, p50/p95/p99, CDC/checkpoint lag, RPO/RTO, verification & repair rates |
| Distributed workers/HA | P1 | DB-clock leases, fencing under clock skew and partitions, anti-split-brain failover, restart/rolling upgrade |
| Enterprise identity SSO/RBAC/ABAC/SCIM | P0/P1 | external claim validation, tenant scoping, provisioning/deprovision, deny-by-default, privilege escalation suite |
| Two-person approval / SoD | P0 | independent approvers, separate execution authority, revocation/replay/step-up tests |
| Secrets/KMS/HSM/key rotation | P1 | no plaintext retention, rotation during live CDC, mTLS/private CA, receipt key rollover and verify past receipts |
| Audit/SIEM/OTel | P1 | append-only event/correlation IDs, no sensitive payload leakage, end-to-end trace, export and alerts for blocking states |
| Control plane/agents | P1 | authenticated controllers, bounded retries, idempotent commands, agent cannot bypass approval gates |
| Upgrade/rollback/compatibility | P1 | old checkpoints/ledgers reopen, migration schemas, restart mid-upgrade, incompatible driver rollback, Node/better-sqlite3 compatibility |
| Connector certification SDK | P2 | contract tests, semantic capability/version matrix, fail-closed unsupported operations, reproducible certification suite |
| Security threat model/SBOM/SAST/supply chain | P1 | updated attack tree for CDC/ledger/approval, CodeQL, dependency audit, SBOM, signed reproducible artifact/attestation |
| Chaos/fault testing | P1 | process/container kill; DB restart; deadlock/serialization; DDL; partitions/DNS/TLS/credentials; disk-full/I/O/fsync; checkpoint corruption; promotion; repair/cutover crash; clock skew |
| Platform/version certification | P1 | PG14–18 vendor+patch, primary/replica/managed HA, decoder, slot topology; revocable certificates and unsupported list |
| UX/operator tooling | P2 | durable blocking alerts, inspectable reasons, recover/repair approvals, playbooks; never dismiss correctness blockers as cosmetic |
| SDK/API/CLI/MCP surfaces | P2 | identical auth/plan/fence semantics across all surfaces, schema-contract conformance and auth-negative tests |
| Documentation/support/SLA | P2 | published limits, RPO/RTO evidence, runbooks, incident drills, support routing and documented commitments |
| Compliance readiness | P2 | evidence for control operation/data handling/privacy; no unearned SOC2/ISO claims |
| Release provenance/reproducibility | P0/P1 | exact SHA → dependency manifest → build → signing → deployed artifact → browser/database smoke; rollback attestation |
| Customer evidence/case studies | P2 | permissioned real workloads with independently measured acceptance; no invented testimonials |
| Commercial packaging | P2 | clear supported scope/entitlements/pricing/contractual exclusions, truthful SLA language |
First execution order (do not downgrade gates for green)
A. Restore a real runner and enforced release boundary. B. Close contract TOCTOU + CDC exact cardinality and execute PR #72 race attacks. C. Establish trusted identity, separate approval/execution with two-party high-risk authorization. D. Natural lease expiry, SIGKILL and ambiguous outcome matrix. E. Replace releaseGrade with verified qualification-class claims. F. Complete PostgreSQL fidelity, 100MB/1GB/5GB/10GB bounded-spill fault suite, schema/publication contract. G. Scale/soak/HA/version matrix; OTel/SIEM/KMS/supply-chain; operator/SDK/support/case-study readiness. Branch PRs are experimental until exact class passes. Each run should update SHA, workflows, class, executed tests, workload, metrics, blockers, evidence URLs, residual risks and next action.
Comparator-driven risks (not claims that SPOOL has already surpassed them)
- HVR PostgreSQL capabilities: current matrix distinguishes log-based CDC, limited DDL, LOBs and PostgreSQL 9.5–17 in that HVR version. Check each HVR version independently.
- AWS DMS source limits: missing PK and PK structure drift can cause missed UPDATE/DELETE. Fail closed rather than compete on permissive connector count.
- Qlik Replicate DDL limits, updated 2026-09-24: rapid DDL-DML-DDL can be misordered. Add ordered source contract transitions to the adversarial suite.
- Qlik Replicate general limitations: configured LOB truncation and NULL-key UPDATE/DELETE effects are relevant negative test fixtures.
- AWS DMS validation: PK/unique index and collation limitations demand explicit source-target key equality semantics.
- Striim, Airbyte and other systems: update comparator matrix with versioned official docs before design claims; do not infer new features from marketing headlines.
Stop rule: Neither an open PR, a runnable fixture with mocked connectors, a profile name, a short benchmark, nor a successful deploy constitutes enterprise PostgreSQL release qualification.
Activity
dharan1007 commentedon Sep 26, 2026
2026-09-26 — quota-independent qualification path established, NOT EXECUTED
User confirmed the GitHub account exhausted this month's GitHub-hosted Actions allowance. This explains the zero-runner/zero-step failures; do not keep retriggering hosted runs or misclassify them as SPOOL code-test failures.
Draft PR #75 adds:
spool-industrialLinux/x64 runner and isolated PG service.Independent local verification: exact submitted shell script hash matched the syntax-tested copy (FNV32 4331eef1, 5,824 chars);
bash -nPASS; incorrect SHA, dirty checkout and missing PostgreSQL credentials each correctly refused with exit 2. Workflow YAML parsing/structural checks PASS. Full npm/PG/CodeQL tests NOT EXECUTED: this session has no accessible private repository dependencies, Docker/PostgreSQL or npm networking. The self-hosted GitHub workflow is currently QUEUED with no registered matching runner. Do not mark it green or promote PR #71, still draft.External action required to unlock live evidence: register a trusted Linux/x64 self-hosted runner with extra label
spool-industrial, Node 22, Docker, CodeQL CLI, and owner-only/var/lib/spool-qualification/evidence. Alternatively runbash scripts/qualify/external-ci.sh "$(git rev-parse HEAD)"on a dedicated Linux/WSL2 test host with the documented PostgreSQL test-only environment. Enable enforceable protected-main checks separately through an eligible repository admin account. Never put production credentials on the test runner.P0 PostgreSQL DDL/contract TOCTOU, exact cardinality, trusted auth/SoD/dual approval, natural stale-lease SIGKILL, qualification classes and all real fault/security/soak/scale envelopes remain OPEN. No score increase or industrial claim is justified by creating a CI harness.
dharan1007 commentedon Sep 26, 2026
2026-09-26 final current-turn status: quota-independent qualification PR #75 is DRAFT, head
a5b1c50786ae74c679b8e4504f0b313799cbff55, based on still-draft industrial PR #71. It now includes the reviewed external runner script (additional end-of-run clean-tree/SHA verification), self-hosted Linux PostgreSQL workflow, and operator docs. The exact script (6,116 chars, FNV324c2fba4c) matched the syntax-checked local copy. Local negative preflight tests for SHA mismatch, dirty checkout, missing real PG credentials passed. YAML parse/structural tests passed. No live PG/CodeQL/load/SIGKILL suite ran.Latest self-hosted run 36248975351 is QUEUED, not PASS, pending an authenticated registered
spool-industrialrunner; the hostedrelease-gateon the same head still failed due the account quota. The existing production v1.1.1 andmainare unchanged/unprotected. Maintain PostgreSQL STOP-SHIP; no P0 correctness/auth/recovery closure or readiness score increase is supported. No customer data should be used as test fixtures.dharan1007 commentedon Sep 26, 2026
2026-09-26 follow-up — exact mutation cardinality increment
Authoritative main
333a535a9fe5e04fe6ac6247897c9a9f45238d50; production release remainsv1.1.1and excludes industrial PostgreSQL. PR #71 remains draft at1ce26faa0571c6a5d63450c4d053893886719c7e; red-team PR #72 remains draft. New draft correctness PR #76 targets PR #71 and currently ends atf08ddf86c25fb8c350ad881bc0bec4203fcb4224.What changed in #76 (not merged): removes the authoritative 10s PostgreSQL target contract cache; obtains transaction-held
SHARE UPDATE EXCLUSIVEtarget relation lock and reattests contract before mutation/ledger commit; requires targetContractId for fenced mutation. INSERT and per-piece UPSERT/CDC use strict actualrowCount,RETURNINGcount and boolean classification; end-to-end CDC source-event tally is checked before ledger insert. Copy of independent red-team trigger/contract-race test carried from #72.Verification performed: New standalone row-cardinality helper and tests passed 4/4 on Node 22 in isolated local fixture; byte-for-byte Git blob equality independently checked. Static source inspection confirms lock and no TTL fast path. NOT EXECUTED: full repository tests, real PostgreSQL adversarial contract/DDL races, CodeQL, crash/lease, throughput and industrial profiles. The build environment has no private checkout dependencies, PostgreSQL or Docker and cannot resolve npm registry. Do NOT mark the P0 closed or increase a readiness score from this alone.
Quota workaround: draft PR #75 adds trusted self-hosted / direct external qualification. Workflow 36248975351 is still QUEUED, not PASS; a matching isolated runner has not executed. Its gate correctly refuses missing red-team tests. Refrain from rerunning exhausted GitHub-hosted jobs. Repo
mainremains unprotected, so independent promotion governance also still P0.Next executable gate: obtain a trusted isolated runner (not a production credentialed machine), run exact candidate SHA and the #72 red-team test against disposable real PG17; prove concurrent DDL blocks/fails closed and trigger suppression leaves no ledger commit; measure lock contention regression, then full PostgreSQL/CI/security suite. Follow with identity/SoD/dual approval, natural stale lease/SIGKILL, release classes and sustained scale. Both PRs #75 and #76 remain draft until independently executed evidence exists.
Readiness scoring note: historic 43/100 and later 64/100 are subjective summaries, not reproducible qualification scores. No newly qualified capability was established; production class stays NOT_QUALIFIED / enterprise PostgreSQL STOP-SHIP.
dharan1007 commentedon Sep 26, 2026
2026-09-26 incremental engineering run — new draft PR #77, HEAD
e43b777c88f66b237ed4edab381e3e954f9660d7, based on industrial PR #71 (unchanged at1ce26faa0571c6a5d63450c4d053893886719c7e).Verified code changes (draft, unmerged): share one exact expected-refusal predicate between harness and evidence verifier; contradictory or missing refusal fields now fail. Scenario exceptions—even
error.expected=true—cannot pass an unfinished run. A scenario's ownresult.status/metrics.statusFAIL cannot be overwritten by an empty failure list. Manifestresult=PASSnow requires every required scenario PASS and manifest/metric statuses to agree, plus refusal count consistency. A PostgreSQL CDC qualification run now requireswal_level=logical(previouslyreplicawas accepted).failures.jsonis written after the raw-log integrity scan.Targeted verification: the committed pure helper blob
6fd25b9bcb003f38db309ae54a9abf375e6ee76cwas tested on Node v22 with five passing fail-closed tests (inconsistent flags, missing fields, scenario FAIL, replica-WAL and missing/failed manifest scenarios). NOT EXECUTED: full npm suite/build, PostgreSQL end-to-end, independent evidence bundles, CodeQL or load/chaos; this is unit-level evidence, NOT a qualification promotion.Latest authoritative status:
main=333a535a9fe5e04fe6ac6247897c9a9f45238d50, unprotected; releasev1.1.1; draft PR #71 industrial; draft #72 red-team; draft #75 self-hosted gate (run36248975351queued/not executed); draft #76 live target contract/cardinality; draft #77 qualification fail-closed. Exhausted GitHub-hosted Actions minutes mean hosted checks cannot presently run; no green gate has superseded this. Keep enterprise PostgreSQL STOP-SHIP. Do not raise historic subjective 43/100 from unexecuted work. The earlier 64/100 claim is not a reproducible measurement.Next: run combined #76 and #77 changes with #72 red-team on isolated real PG via external runner; resolve discovered regressions and any implementation defects; then identity/SoD/dual approval, natural dead-owner lease/SIGKILL/ambiguous commit, real CodeQL/release governance and explicit qualification classes. External comparator update: AWS DMS docs still describe PostgreSQL PK/DDL drift omissions, Qlik docs warn rapid DDL→DML→DDL ordering, HVR compare can differ for floats, and Striim documents >1GB wal2json v1 limitation. Add those as negative tests; do not claim competitive outperformance without measured comparison.
dharan1007 commentedon Sep 26, 2026
2026-09-27 evidence-register update — integration PR #79
Production status remains STOP-SHIP / NOT_QUALIFIED. Latest production main still
333a535a9fe5e04fe6ac6247897c9a9f45238d50, released v1.1.1; no industrial promotion or verified rating increase. Historical 43/100 is a subjective previous baseline, not certification. Detailed living plan/gap register:docs/INDUSTRIAL_READINESS_PLAN.mdon #79.Draft #79 overlays exact development patches from #72/#75/#76/#77 onto #71, without touching
main. New focused verification: 8/8 Node 22 checksum tamper fixtures; 3/3 Node 22 class/forgery fixtures; 3/3 isolated source regression fixtures for natural-lease SIGKILL; JS syntax/source read-back and exact Git blob matches. NOT EXECUTED: real PostgreSQL hard SIGKILL, target DDL/cardinality integration, complete repository test/build, required CodeQL/release gates, sustained CDC/load/HA and independent receipts. The checksums proof closes only the checksum-index coverage flaw at unit-test level; cannot authenticate the producer. The amended SIGKILL scenario no longer administratively DELETEs the lease to achieve recovery; it now tests active-lease refusal, real PG-clock expiry, increased fence and rejected stale mutation before replay, pending real PG proof.Qualification integrity: new schema-v5 development harness records explicit
NOT_QUALIFIED, replacing misleading boolean grades; legacy v3/v4 flags are non-promoting. The immutable class ladder is defined, but no trusted external class attestor exists. No CI_CORRECTNESS/PILOT/SMALL/MEDIUM/LARGE/INDUSTRIAL certification is earned.P0 remaining: executable mandatory CI+CodeQL and protected main; live DDL TOCTOU/cardinality proof; trusted authenticated identity versus caller principal; separately keyed approval/execution with two distinct high-risk approvers; complete real natural lease/SIGKILL/ambiguous-commit/CDC source ACK evidence; externally attested class issuance. P1/P2 full-load/TOAST/1GiB spill/PG14–18, HA, scale and soak, operator GUI/API usability, support/SLA/compliance/customer evidence remain OPEN as documented. Highest-value action: allocate/trust an executable isolated Linux PostgreSQL runner, restore mandatory gates, run exact PR #79 SHA then fix evidence-based defects. Do not merge, bypass checks or assign an earned class without those results.
dharan1007 commentedon Sep 27, 2026
2026-09-27 · GitHub-Actions-independent development progress (not production qualification)
scripts/qualify/external-ci.shin draft PR integration(industrial): consolidate red-team and P0 proof hardening without promotion #79 now has an additive draft PR fix(qualify): exact SIGKILL recovery proof + Actions-free browser gate #80 gate that MUST run the built SPOOL SPA in Chromium, verify the real workflow, put the screenshot outside the clean checkout, and checksum it with gate evidence. The runner still requires a real isolated PostgreSQL server, installed deps/Chrome/CodeQL, and an eligible Linux host; none is provisioned in the current code-execution container.id+payloadcomparison inside a PG repeatable-read read-only snapshot, and measures hard-SIGKILL RTO only after content-verified replay. Source ACK/LSN RPO remains UNMEASURED rather than fake zero. Verified exact new helper/test bytes against local Node 22: 4/4 tests pass; real PostgreSQL fault matrix NOT_EXECUTED.CUSTOMon overrides. Verified pure resolver against exact patched source. This raises the REQUIRED bar, not readiness.bash -npassed, negative test correctly failed on absent built site; actual SPOOL Chromium flow still NOT_EXECUTED.655b1b41bc89e8acc39ed4aa8e170dad2129cbdf. Main remains333a535a9fe5e04fe6ac6247897c9a9f45238d50, release v1.1.1. PR80 is DRAFT, parent integration PR79 is DRAFT, no promotion.No GitHub Actions minutes consumed by the standalone Node/shell tests. The historical 43/100 is a subjective prior estimate, NOT a new measured certification score.
dharan1007 commentedon Sep 27, 2026
2026-09-27 further independent-of-GitHub-Actions work: Draft integration PR #81 (#81), candidate
9cf8fe00b64e87ab776c175d4d58bd14dcabb182, composes the previously separately staged UX #78 and backend/qualification #80. Seven user-facing product routes have a direct SPA render handoff, with no transient fake 404, and tests protect internal navigation, Ctrl/Cmd clicks, external links and downloads; five focused source/DOM-mock cases passed. A mandatory TAP evidence checker refuses zero executed PostgreSQL tests, skips, TODO/cancel/fail or truncated/contradictory transcripts; its five tests passed. The production CDC lifecycle qualification writer now executes real BEGIN/COMMIT transactions for each logical source operation, including atomic DELETE+INSERT and rollback on faults; four mock-PG transaction tests passed. Earlier exact-blob focused Node/HTTP daemon/security/recovery checks passed 13/13. All passing focused tests are development evidence only, not full repository, real PG, browser, fault/HA, 1B-row/7d, independently signed release or enterprise authorization proofs. No eligible isolated PG host is available through this chat; HF compute job probe returned 402 and the available Supabase connections are production, so no destructive test was aimed at them. GitHub main333a535a9fe5e04fe6ac6247897c9a9f45238d50and published v1.1.1 unchanged. P0/P1/P2 stop-ship gates remain OPEN; 100/100 explicitly NOT CLAIMED.dharan1007 commentedon Sep 27, 2026
2026-09-27 final additional audit for Actions-independent candidate draft PR #81 (
50055702ce79d89e48bbe546b14078afe48da8ef): found and corrected two more ways a CDC qualification could be meaningless or falsely green. (1)cdc-soak.js: dropped the massive preallocated 7-day plan; strict bounded 30-second windows, per-worker disjoint IDs, exact SQL effect counts, observable atomic update/delete/multi transactions, no swallowed driver exceptions, bounded chunk event validation, actual monotonic duration and worker teardown; eight dependency-free mock driver/protocol-regression cases passed. (2)database-source-load.js: replaced two-table subset masquerading aswritersfull-fanout and post-snapshot writes made only after export closure; now every declared reader joins an exporter-held MVCC token after independent writes, while independent live reads must see changed state. Four mock PG orchestration negative/positive tests passed. Not run against a live PG server. No runner available for live code, no GitHub Actions minutes, HF Jobs requested CPU returned 402, connected Supabase projects are production not safe for destructive tests. STOP-SHIP P0/P1 gates unchanged: identity/policy/SoD, live PG data correctness/CDC/crash/failover, CodeQL and browser, 1B-row/7-day workload, independent evidence/attestation and enterprise operations. No 100/100 claim, main and v1.1.1 unchanged.[-]Industrial PostgreSQL 100/100 readiness: P0 stop-ship gates, qualification classes and evidence register[/-][+]Track PostgreSQL qualification gates for a future release[/+]