coulomb/tenant-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore(consistency): renormalize lifecycle state [auto]

Browse source 
Updated by fix-consistency on 2026-08-18:
  - workplan status: ready → active
This commit is contained in:
custodian-sync 2026-08-18 07:29:03 +02:00
parent b22d4a7294
commit 0a65a4a25c
1 changed files with 41 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

47
workplans/TEN-WP-0009-postgres-production-store.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "PostgreSQL as the production store, SQLite for dev and test" title: "PostgreSQL as the production store, SQLite for dev and test"
domain: infotech domain: infotech
repo: tenant-engine repo: tenant-engine
status: ready status: active
owner: claude owner: claude
topic_slug: tenant-lifecycle topic_slug: tenant-lifecycle
created: "2026-08-16" created: "2026-08-16"
@ -123,7 +123,7 @@ building a fleet drift-detector because we got bitten. Raised with
```task ```task
id: TEN-WP-0009-T01 id: TEN-WP-0009-T01
status: todo status: progress
priority: high priority: high
state_hub_task_id: "b4701256-f235-4474-9dcf-7cb09f62b873" state_hub_task_id: "b4701256-f235-4474-9dcf-7cb09f62b873"
``` ```
@ -208,6 +208,13 @@ move-to-dedicated trigger list and runbook are recorded.
Status 2026-08-17: **accepted.** `consumers/tenant-engine.yaml` merged at Status 2026-08-17: **accepted.** `consumers/tenant-engine.yaml` merged at
`deda11e`. Provisioning is operator-gated as RAPP-IN-0004; nothing applied yet. `deda11e`. Provisioning is operator-gated as RAPP-IN-0004; nothing applied yet.
2026-08-18 repository readiness: desired runtime and migration manifests now
consume separate file-projected leases, label the client namespace, and admit
egress only to the real `databases/platform-pg` destination (an earlier draft
incorrectly selected namespace `railiance-platform`). The published retention
policy replaces the declaration's placeholder. T01 remains progress because
consumer/lease provisioning and backup evidence are live operator gates.
**They caught a real defect in our proposal.** The declaration had a single **They caught a real defect in our proposal.** The declaration had a single
`statementTimeout` field that the renderer applied to the migration role, the `statementTimeout` field that the renderer applied to the migration role, the
runtime role, *and* the database — so our 5s would have given us 5s DDL and runtime role, *and* the database — so our 5s would have given us 5s DDL and
@ -334,7 +341,7 @@ path. Asked.
```task ```task
id: TEN-WP-0009-T02 id: TEN-WP-0009-T02
status: todo status: done
priority: high priority: high
state_hub_task_id: "d7428bc1-2e5f-4a4c-93f5-9368ebb691d5" state_hub_task_id: "d7428bc1-2e5f-4a4c-93f5-9368ebb691d5"
``` ```
@ -368,11 +375,19 @@ SQLite-only dev is meant to stay dependency-light.
Done when all three backends pass the same conformance suites unchanged. Done when all three backends pass the same conformance suites unchanged.
Completed 2026-08-18. `PostgresTenantStore` implements the full protocol with
bounded pooling, per-checkout credential-file rotation, row locking and atomic
receipt/version/event transactions. The existing lifecycle and guardrail
conformance suites run against PostgreSQL when
`TENANT_ENGINE_TEST_DATABASE_URL` is present. A disposable PostgreSQL 16 run
passed 88 shared conformance cases; the full source suite passes 260 with 28
environment-gated PostgreSQL cases skipped when no database is supplied.
## T03 - Backend selection that fails closed ## T03 - Backend selection that fails closed
```task ```task
id: TEN-WP-0009-T03 id: TEN-WP-0009-T03
status: todo status: done
priority: high priority: high
state_hub_task_id: "89c121c6-8bc5-4abe-80f0-d11406aeffc2" state_hub_task_id: "89c121c6-8bc5-4abe-80f0-d11406aeffc2"
``` ```
@ -397,11 +412,16 @@ store am I actually using" is cheap to answer and expensive to guess.
Done when misconfiguration is a startup failure with a clear message, covered Done when misconfiguration is a startup failure with a clear message, covered
by tests. by tests.
Completed 2026-08-18. URL-file selects PostgreSQL, path selects SQLite, both
refuse startup, and neither retains the in-memory test default. `/health`
reports and pings the active backend so store selection and credential failure
are externally visible without disclosing a DSN.
## T04 - Migrate production data ## T04 - Migrate production data
```task ```task
id: TEN-WP-0009-T04 id: TEN-WP-0009-T04
status: todo status: progress
priority: high priority: high
state_hub_task_id: "51a83eae-9e9f-4676-bc1d-9c2d884bac0d" state_hub_task_id: "51a83eae-9e9f-4676-bc1d-9c2d884bac0d"
``` ```
@ -433,11 +453,19 @@ Keep the SQLite file and its PVC until T05's soak passes. It is the rollback.
Done when a verified copy is live in PostgreSQL and the comparison evidence is Done when a verified copy is live in PostgreSQL and the comparison evidence is
recorded here. recorded here.
2026-08-18 repository readiness: `tenant-engine-transfer` now refuses a
non-empty target, copies all seven tables in one transaction, preserves
identity sequence values and nullable legacy timestamps, compares every source
and target row, and emits non-secret counts/SHA-256 digests plus requested
tenant lifecycle/version checks. Its PostgreSQL 16 integration test exercises
all tables and the next event sequence. The live scale-to-zero/export/import is
not performed and T04 remains progress.
## T05 - Cut over the deployment ## T05 - Cut over the deployment
```task ```task
id: TEN-WP-0009-T05 id: TEN-WP-0009-T05
status: todo status: progress
priority: high priority: high
state_hub_task_id: "03aeae3b-5e0f-4c77-a763-787ae08078f5" state_hub_task_id: "03aeae3b-5e0f-4c77-a763-787ae08078f5"
``` ```
@ -466,6 +494,13 @@ Done when production runs on PostgreSQL, `make verify-pin` passes, and the
TEN-WP-0007 T04 verification list still passes end to end against the live TEN-WP-0007 T04 verification list still passes end to end against the live
service. service.
2026-08-18 desired state: PVC/mount removed, `RollingUpdate` selected,
file-projected runtime and caller credentials added, and egress narrowed to
`databases/platform-pg`, flex-auth and DNS. A separate migration Job has its
own lease and NetworkPolicy. Replicas deliberately remain one. The manifests
are not applied and the pinned old digest does not yet contain this code, so
T05 remains progress and no live PostgreSQL claim is made.
## T06 - Tell the fleet, and close the loop on TEN-WP-0008 ## T06 - Tell the fleet, and close the loop on TEN-WP-0008
```task ```task