[dharan1007]

User problem

The deployed website previously exposed technical source/JSON and sent nontechnical users to product pages with disjoint navigation. The first UX draft PR #78 adds human-first routes but src/app.js renders a transient 404 for these paths and src/product-surface.js asynchronously overwrites it; the product nav uses full-page reload links.

Candidate implementation

• Cherry-pick the exact four original website blobs from draft PR feat(web): human-first onboarding and safe integration guide #78 onto industrial-security candidate PR fix(qualify): exact SIGKILL recovery proof + Actions-free browser gate #80, without changing released v1.1.1 or main.
• Register all seven product routes in the SPA router, publish a narrow product-route render/title bridge, show a loading shell rather than a false 404 during module initialization, and intercept only primary unmodified allowlisted internal anchor clicks. Preserve Ctrl/Cmd/middle click, external links and downloads.
• Change the homepage phrasing 'production-verified' for experimental SQLite to 'released, bounded-memory'. Keep /developers descriptions accurate: no hosted database mutation API, the local daemon expects an authenticated POST, and browser CSP denies outbound calls.
• Five dependency-free regression cases added at tests/product-route-bridge.test.js: render all 7 pages with no undefined, direct SPA rendering, absent-bundle startup, whitelist navigation, and modified-click semantics.

Verification

Exact changed JavaScript source blobs parsed by V8; all seven product-only pages were dynamically rendered via a mock DOM and their HTML/title crosschecked against the SPA render handoff; five source-level interaction tests passed in isolated V8. Not executed: full repository npm suite, bundled Chromium production browser flow, visual accessibility audit, actual Vercel deployment. GitHub Actions available minutes are exhausted; the mandatory standalone external browser and PostgreSQL qualification script in parent PR #80 has not run in an eligible runner.

Release boundary

DRAFT; not merged, deployed, production-qualified or 100/100. Parent PR #80 and #79 remain experimental. Production main 333a535a9fe5e04fe6ac6247897c9a9f45238d50, release v1.1.1 unchanged. Do not promote until independently executed mandatory evidence exists.

Standalone qualification fail-closed hardening (additive commit)

• scripts/qualify/assert-test-execution.js parses and validates the actual Node TAP test transcript; a green process with zero executed tests, skipped/aborted/TODO cases, contradictory counters, missing summary, or a fake no-entry summary is POSTGRES_TEST_NOT_EXECUTED. Both PostgreSQL conformance and adversarial red-team executions use explicit TAP reporting and this mandatory check in external-ci.sh, still with zero GitHub Actions reliance.
• Five regression cases passed under an isolated V8 evaluator with the exact committed checker source; live PostgreSQL suites remain NOT_EXECUTED.
• In cdc-production-lifecycle.js, the writer previously labeled one 'transaction' every 25 autocommitted operations and split DELETE/INSERT into two transactions. The modified qualification writer explicitly wraps each logical operation in BEGIN/COMMIT, rolls back errors, and accounts for actually committed transactions. Four focused mock-connection tests passed, including an injected failure after the DELETE. This is not a live logical replication proof.
• Current head 9cf8fe00b64e87ab776c175d4d58bd14dcabb182. The parent and main remain unchanged; candidate is unqualified, unmerged and undeployed.

Additional false-green qualification defects corrected (commit 50055702ce79d89e48bbe546b14078afe48da8ef)

• CDC soak previously swallowed driver exceptions, used unsupported parameterized multi-command SQL, preconstructed enormous seven-day operation arrays, and counted inserts while UPDATE/DELETE often affected no rows. Replaced with 30-second bounded windows, 100 deterministic operations per writer/window in disjoint int32 identity bands; each UPDATE/DELETE/MULTI actually inserts and mutates one source row in a transaction; exact SQL rowCount checks, rollback and propagation, all-settled worker shutdown, real row-event-count comparison, monotonic duration gate. Eight focused mock-driver regression cases passed. Not a PostgreSQL execution proof.
• Exported MVCC source previously set up 2 * profile.writers tables but read only the first two, and performed the post-snapshot write after the exporter closed. Now an independent session commits the post-export marker into every table while the exporter stays open; profile.writers parallel joined reader sessions consume all tables, each must see old 1,000-row snapshot while independent live reads see 1,001. Four focused simulated-MVCC orchestration and negative cases passed; actual real-PostgreSQL MVCC test NOT_EXECUTED.
• These defects reduced the trustworthiness of earlier claimed evidence. Their code fixes do not increase readiness until actual Linux/PostgreSQL, security, fault/HA, load and long-duration acceptance have executed.

The candidate remains DRAFT, unreleased and undeployed. The release v1.1.1 and protected-status-unenforced main remain untouched.

CDC ordering and preview symlink red-team (2026-09-27)

• Actual capture path src/connectors/postgres/cdc.js previously used async WAL callback sequencing that could advance ACKs out of order; now uses bounded serialized dispatch and returns an awaitable promise to pg-logical-replication 2.x flow-control. It advances recorded commit ACK only after the transport ACK resolves, rejects max-message stops inside a transaction, and accepts LSN waterlines only at completed commit boundaries. Seven focused tests against the actual source function with mocked PostgreSQL transport passed; this is NOT live PostgreSQL validation.
• A real isolated Node HTTP red-team reproduced a directory-symlink escape from the static preview: /src/escape.html exposed an outside-dist sentinel. The server now checks resolved real paths against the real static root before reading, including symlinked parent folders. The exact two patched Git blobs (6ff939acedcf8f91e1f34db16fac97f2d10b2739, a8ec2e43daef5ee85566c2c945d4adb3c04ee907) were copied into an isolated local Node 22 test harness, Git blob identities verified, and 6/6 HTTP integration/security tests PASS. This closes the reproduced path leak, not a general penetration-test sign-off.
• Current candidate commit 39794479742f5c5fe1b6a353e8a0f3d7440203f9. Draft, no merge, no production redeploy, no real PG/failover/scale/CodeQL tests. The execution container has no PostgreSQL server, Docker/Podman, or CodeQL; outbound DNS/HTTP fetches are blocked. An attempted Hugging Face compute job was rejected with 402. Vercel deployment connector write action returned unavailable. Do not promote from this evidence.

[dharan1007]

2026-09-27 candidate qualification update (NOT_QUALIFIED):

• Pushed static-only preview server + 5 focused local passing HTTP/security/SPA tests (commit 7e4f4cf). This is not a backend/industrial deployment.
• Pushed CDC soak event-accounting fix (e6270be): UPDATE, DELETE and MULTI each emit seed INSERT + mutation; 400-operation source-mix check verified 680 expected row events. Prior code expected only 480 and would misclassify real CDC behavior.
• Pushed CDC bounded-capture truth fix (2a77527): expose collectedChangeCount/truncatedChanges, reject industrial qualifier evidence if any streaming window loses events, allocate 100k event capture budget for immutable profile scale, 9 focused production-code checks passed.
• Provisioned isolated free PostgreSQL 17 dpg-dash48h7lnhs7395ph6g-a. Live query blocked: Render MCP cannot reach database with empty IP allowlist; free database does not supply logical WAL needed for CDC, so this cannot qualify the industrial gate.
• Render web service creation failed because Render cannot fetch the private GitHub repository. Vercel reported an older production deployment READY, but the candidate has NOT been deployed or smoke-tested there.
• No GitHub Actions used; no production database touched. Still open: real pgoutput/CDC, kill/failover, enterprise auth, CodeQL/npm audit, seven-day/1B load, signed provenance, and candidate deployment. Keep PR draft and main unchanged until evidence exists.

[dharan1007]

2026-09-27 additional candidate work / NOT_QUALIFIED:

• f6c8b18: Complete-transaction CDC capture audit and monotonic interval correction. Previous row LSN < prior commit LSN wrongly flagged valid long-running transactions; now audit commits across windows, refuse incomplete source transactions, and persist commit END-LSN as the durable restart cursor. Fixed capture stop after the last commit using commit END-LSN or an idle WAL heartbeat. 10 pure audit tests and 3 focused transport/heartbeat tests passed against exact production source with mocked replication transport (not live PG).
• 43f6bc2: Opt-in strict loopback operator migration-ID scope authorization. Missing scopes fail startup; status, mutation and cutover paths reject unauthorized or conflicting migration IDs and principal spoofing before service dispatch. Exact local-policy 7 tests plus scoped dispatch cases passed with crypto/HTTP test doubles. Explicitly NOT enterprise OIDC/mTLS, tenant resource isolation or two-person approval. docs/strict-local-authorization.md records limitations.
• a8cff65: Replaced torn overwrite-prone JSON checkpoints in the SIGKILL qualification child and parent with fsync'd file + atomic rename + directory fsync. Corrupt checkpoint fails closed; private crash fixture directory removes orphaned SIGKILL temp files. 4 real Node 22 Linux filesystem tests PASS including actual OS SIGKILL after temp fsync before rename, exact source/test Git blobs verified. This is a real isolated checkpoint fault test, not PostgreSQL failover.

Actual industrial gates still missing independently executed real pgoutput/CDC & MVCC, full repository tests, CodeQL/npm audit, actual PG SIGKILL/failover/HA, 1B+7d workloads, enterprise identity + resource scoping and SoD, provenance and candidate deployment. No GitHub Actions. PR remains DRAFT; do not merge/deploy to production or declare any readiness score as a measured certificate.

[dharan1007]

2026-09-27 continued P0 engineering (candidate HEAD 53773ba; NOT_QUALIFIED, draft, main untouched):

• 76eb819: the soak's 5% multi-row case now inserts TWO DISTINCT keys in one atomic source transaction. Repaired broken focused-test extraction marker and literal JS newline. Exact code exercised against mock PG; 10/10 focused checks passed.
• 32337b0: checked pg-logical-replication v2.5.0 implementation, which invokes acknowledge(_lastLsn) every 10s even with acknowledge.auto=false. Disabled its unsafe periodic feedback timer in both capture and CDC applier. Capture acknowledges only complete COMMIT end-LSN after callback, not BEGIN/row. Rejected false/throwing ACK; 17/17 focused source tests passed. Driver reference: https://raw.githubusercontent.com/kibae/pg-logical-replication/v2.5.0/src/logical-replication-service.ts (checkStandbyStatus lines 216-229).
• 47849fe: streamed mutation hashes now enforce maxMutations BEFORE the first excess item; target's async mutation loop refuses the first item beyond declared mutationCount. 3/3 focused source tests passed; live target tests not run.
• 53773ba: heartbeat replies in CDC applier are serialized behind durable transaction-ACK feedback, use only acknowledged/applied cursor rather than received heartbeat LSN, and never regress LSN under concurrent calls. 7/7 focused source tests passed.

VALIDATION: All test claims are focused isolated production-source/mock-transport checks, NOT full npm/CodeQL, live pgoutput, crash/HA, or industrial load. Six release gates remain open: (1) accessible isolated logical-WAL PostgreSQL + full SQL/CDC tests, (2) independent crash/HA/failover, (3) enterprise IAM/RBAC/SoD audit, (4) full npm audit+CodeQL+penetration review, (5) actual seven-day/1B profile hardware/load evidence, (6) exact candidate deployment + browser/release provenance verification. Existing Render free PG 17 is IP-denied to MCP and lacks HA; Render could not fetch private GitHub repo. GitHub Actions were not used. GitHub commit-status read returned 403, so no CI status is claimed. NO release/merge authorization.