Forgejo PostgreSQL source verification and tracing context correction
This packet verifies the actual composed Forgejo 11.0.3 source on a disposable
PostgreSQL 16.14 instance. It retains the source correction, failed setup and
test attempts, controlled counterexamples, exact sandbox/command receipts and
complete rebuilt release evidence. Apps commit 308e83fc integrates the new
40-path source patch and build lock. Independent owner review and operational
admission remain open.
The actual production engine initialization and registered model schemas run under default, explicit-public and named schemas. OAuth configuration values use the actual application type. All 37 PostgreSQL test/subtest results pass: create/reconcile/inverse, exact raw restoration, unchanged source retention, private drift refusal, local/external account-link refusal, unexpected trigger rollback, raw SQL writer exclusion on all four protected tables, concurrent preparation and private driver-error diagnostics. A PostgreSQL trigger places private synthetic configuration in its driver error; the application's actual slow/error/trace hooks and returned operation error suppress that configuration. An unmarked query provides a positive diagnostic control.
The diagnostics test exposed a real hook-composition crash. XORM 1.3.9 passes the same ContextHook to each BeforeProcess hook without feeding the previous returned context into it. A hook after tracing could therefore discard the task context and make tracing's AfterProcess panic. The correction publishes the new task context into ContextHook as well as returning it. This preserves the incoming private-query marker and ordinary context values. Actual SQLite query success/failure and private/ordinary trace cases cover the corrected composition. The six focused DB checks and all 94 selected composed package results pass without skips. The test-only PostgreSQL tag adds no runtime route or authority.
Separate client processes prepare an intent, die immediately after the actual source INSERT, reconcile the rolled-back prepared state, and confirm an apply. The actual PostgreSQL server then restarts with the same synthetic volume. Further fresh processes reconcile the committed apply, perform the inverse and verify the reverted journal and source absence. This is transaction/recovery mechanics evidence, not a real initiating principal, current inverse authority, signed evidence/outbox or a deployed-database acceptance receipt.
Controlled source copies independently remove the PostgreSQL table lock and
the private-query marker. Both fail their intended tests in all three schema
profiles. Those expected counterexamples are separate from successful normal
runs; the canonical runtime source is not weakened. See
controlled-counterexamples.json and source-equivalence.json.
The first two container setup attempts failed because the image's initialization script explicitly clears PGHOST and requires its default socket. The first suite also exposed an incomplete user fixture; its replacement uses the actual user model. The initial tracing regression had an incorrect AddHook API call. The first combined run reused an already-consumed file-replacement fixture; the final run provisions fresh read-only and writable-alias fixtures. All original failures remain retained. None is counted as a source success.
The database has no TCP listener, published port or network. Only its exact synthetic Unix socket is exposed to the network/PID-isolated test process. The image is immutable and recorded; the workload is limited to one CPU and 512 MiB. Local trust authentication is solely a disposable fixture, not a credential-custody proof. Exact labeled containers and volumes from all three setup attempts were removed; cleanup receipts are retained.
For reproduction, use a new prepared workspace from the companion release
recipe, explicit public module/build caches, and unused attempt/workspace names.
database_runtime.py start --attempt N creates the owned database fixture.
run_postgres.py build --source-workspace ... --module-cache ... --go-cache ...
compiles the real test binary, and suite / combined-regressions execute the
normal checks. Supply the same --runtime-attempt N and test --workspace.
The recovery actions are prepare, crash (expected process exit 73),
recover-prepared, server restart, recover-applied, and recover-inverse.
The optional build controls are omit-postgres-lock and omit-private-context;
their suite failures must match the recorded target tests. Finish with exact
owned database_runtime.py cleanup --attempt N. Existing receipts and trial
directories refuse overwrite. The early fixed-path receipt replay is retained;
the final combined run exercises the explicit-workspace interface.
The new patch independently replays all 40 postimages from the pinned official
archive. The complete frontend/static release builds; all 2,234 embedded assets
are exact and all 48 actual CLI/SQLite subprocess checks pass on its binary.
Two fresh no-cache local OCI exports reproduce identical archive, manifest,
config and index. Base layers and rootless runtime settings remain exact.
This is one source build and two exports. No image is loaded, pushed or deployed.
Published asset digests have explicit sha256: types; their derivation restores
the runtime's original manifest byte for byte. Scanner rules are unchanged.
Existing T08/T34/T42 still require current authenticated operation/inverse sessions, exclusion of every application/Helm/release writer, private journal reader/backup custody, retention and native deployed-database acceptance. T07's chart/private-mount admission and T09/T43's ongoing HTTP/API/Git/SSH authorization remain open. All sixteen target gates and the full SEC-DSM ledger remain in scope; no native gate is closed by these source checks.