.custodian-brief.md

@@ -2,7 +2,7 @@
 # Custodian Brief — tenant-engine
 
 **Domain:** infotech  
-**Last synced:** 2026-08-18 05:29 UTC  
+**Last synced:** 2026-08-17 20:53 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -17,12 +17,14 @@ Progress: 0/4 done  |  workplan_id: `e9da1c15-7beb-48d9-97ab-b657fdf9366e`
 - · T04 - Hand the pattern back to the fleet  `b816a862`
 
 ### PostgreSQL as the production store, SQLite for dev and test
-Progress: 2/6 done  |  workplan_id: `3bf3b4ab-a116-4914-b2d8-d3c430754956`
+Progress: 0/6 done  |  workplan_id: `3bf3b4ab-a116-4914-b2d8-d3c430754956`
 
 **Open tasks:**
-- ► T01 - Decide the topology and write the cluster manifest  `b4701256`
-- ► T04 - Migrate production data  `51a83eae`
-- ► T05 - Cut over the deployment  `03aeae3b`
+- · T01 - Decide the topology and write the cluster manifest  `b4701256`
+- · T02 - Implement `PostgresTenantStore`  `d7428bc1`
+- · T03 - Backend selection that fails closed  `89c121c6`
+- · T04 - Migrate production data  `51a83eae`
+- · T05 - Cut over the deployment  `03aeae3b`
 - · T06 - Tell the fleet, and close the loop on TEN-WP-0008  `e7adbc64`
 
 ---

workplans/TEN-WP-0009-postgres-production-store.md

@@ -4,7 +4,7 @@ type: workplan
 title: "PostgreSQL as the production store, SQLite for dev and test"
 domain: infotech
 repo: tenant-engine
-status: active
+status: ready
 owner: claude
 topic_slug: tenant-lifecycle
 created: "2026-08-16"
@@ -123,7 +123,7 @@ building a fleet drift-detector because we got bitten. Raised with
 
 ```task
 id: TEN-WP-0009-T01
-status: progress
+status: todo
 priority: high
 state_hub_task_id: "b4701256-f235-4474-9dcf-7cb09f62b873"
 ```
@@ -208,13 +208,6 @@ move-to-dedicated trigger list and runbook are recorded.
 Status 2026-08-17: **accepted.** `consumers/tenant-engine.yaml` merged at
 `deda11e`. Provisioning is operator-gated as RAPP-IN-0004; nothing applied yet.
 
-2026-08-18 repository readiness: desired runtime and migration manifests now
-consume separate file-projected leases, label the client namespace, and admit
-egress only to the real `databases/platform-pg` destination (an earlier draft
-incorrectly selected namespace `railiance-platform`). The published retention
-policy replaces the declaration's placeholder. T01 remains progress because
-consumer/lease provisioning and backup evidence are live operator gates.
-
 **They caught a real defect in our proposal.** The declaration had a single
 `statementTimeout` field that the renderer applied to the migration role, the
 runtime role, *and* the database — so our 5s would have given us 5s DDL and
@@ -341,7 +334,7 @@ path. Asked.
 
 ```task
 id: TEN-WP-0009-T02
-status: done
+status: todo
 priority: high
 state_hub_task_id: "d7428bc1-2e5f-4a4c-93f5-9368ebb691d5"
 ```
@@ -375,19 +368,11 @@ SQLite-only dev is meant to stay dependency-light.
 
 Done when all three backends pass the same conformance suites unchanged.
 
-Completed 2026-08-18. `PostgresTenantStore` implements the full protocol with
-bounded pooling, per-checkout credential-file rotation, row locking and atomic
-receipt/version/event transactions. The existing lifecycle and guardrail
-conformance suites run against PostgreSQL when
-`TENANT_ENGINE_TEST_DATABASE_URL` is present. A disposable PostgreSQL 16 run
-passed 88 shared conformance cases; the full source suite passes 260 with 28
-environment-gated PostgreSQL cases skipped when no database is supplied.
-
 ## T03 - Backend selection that fails closed
 
 ```task
 id: TEN-WP-0009-T03
-status: done
+status: todo
 priority: high
 state_hub_task_id: "89c121c6-8bc5-4abe-80f0-d11406aeffc2"
 ```
@@ -412,16 +397,11 @@ store am I actually using" is cheap to answer and expensive to guess.
 Done when misconfiguration is a startup failure with a clear message, covered
 by tests.
 
-Completed 2026-08-18. URL-file selects PostgreSQL, path selects SQLite, both
-refuse startup, and neither retains the in-memory test default. `/health`
-reports and pings the active backend so store selection and credential failure
-are externally visible without disclosing a DSN.
-
 ## T04 - Migrate production data
 
 ```task
 id: TEN-WP-0009-T04
-status: progress
+status: todo
 priority: high
 state_hub_task_id: "51a83eae-9e9f-4676-bc1d-9c2d884bac0d"
 ```
@@ -453,19 +433,11 @@ Keep the SQLite file and its PVC until T05's soak passes. It is the rollback.
 Done when a verified copy is live in PostgreSQL and the comparison evidence is
 recorded here.
 
-2026-08-18 repository readiness: `tenant-engine-transfer` now refuses a
-non-empty target, copies all seven tables in one transaction, preserves
-identity sequence values and nullable legacy timestamps, compares every source
-and target row, and emits non-secret counts/SHA-256 digests plus requested
-tenant lifecycle/version checks. Its PostgreSQL 16 integration test exercises
-all tables and the next event sequence. The live scale-to-zero/export/import is
-not performed and T04 remains progress.
-
 ## T05 - Cut over the deployment
 
 ```task
 id: TEN-WP-0009-T05
-status: progress
+status: todo
 priority: high
 state_hub_task_id: "03aeae3b-5e0f-4c77-a763-787ae08078f5"
 ```
@@ -494,13 +466,6 @@ Done when production runs on PostgreSQL, `make verify-pin` passes, and the
 TEN-WP-0007 T04 verification list still passes end to end against the live
 service.
 
-2026-08-18 desired state: PVC/mount removed, `RollingUpdate` selected,
-file-projected runtime and caller credentials added, and egress narrowed to
-`databases/platform-pg`, flex-auth and DNS. A separate migration Job has its
-own lease and NetworkPolicy. Replicas deliberately remain one. The manifests
-are not applied and the pinned old digest does not yet contain this code, so
-T05 remains progress and no live PostgreSQL claim is made.
-
 ## T06 - Tell the fleet, and close the loop on TEN-WP-0008
 
 ```task