the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-operation-backend-r1

Actual Forgejo source-state transaction primitive, r1

This is bounded source progress for NK-WP-0048-T34 / RAPPS-WP-0016-T05/T08, not an admitted operational backend or completed inverse. It adds real database primitives to the actual reviewed Forgejo 11.0.3 source under /tmp; it adds no second application source repository in Apps. No production/native database, configuration, credential, deployment or identity was read or changed. Existing frozen extension and release packets remain unchanged. No canonical owner edit, publication, installed image selection or native dispatch occurred.

Implemented database mechanics

models/auth/source_operation.go operates on actual login_source rows through Forgejo's real transaction machinery. Prepare commits original whole source inventory and exact private desired configuration before a source mutation. Apply checks exact current/original equality, modifies one explicitly identified OAuth2 source, verifies the complete expected persisted post-state and commits post-state plus outcome atomically. Existing targets require exact ID/name/type; case creation requires name absence. Configuration decoding is deliberately avoided for snapshots and restoration, so unknown fields cannot silently vanish. Complete raw private/public equality, source ID and created/updated identity stay inside owner custody. Public results contain only operation ID, phase and numeric source ID; no private digest or configuration is returned.

Inverse independently checks complete current/post equality. It restores preexisting sources in place with the exact original raw bytes and ID. It never deletes a preexisting or unchanged source. Only confirmed case creation can select deletion; actual local user and external-login references refuse deletion without changing those users/links. Another unresolved managed operation on the same target refuses, rather than sharing creation provenance. Unknown or changed state refuses. A prepared intent can be cancelled without changing sources. Reconcile reads committed phase/current equality without retrying mutation. Errors provide no driver/configuration text and return no successful result.

SQLite acquires a write transaction before source reads, excluding even uncooperative SQL writers. The actual two-connection exclusion test sets the managed engine to DEFERRED mode, so it exercises the explicit initial write. The source contains PostgreSQL table locks covering source/journal/user/link writers; PostgreSQL behavior is not tested or accepted by this SQLite proof. MySQL and nested transactions refuse. Locks span each database transaction; they do not span an entire release or control provider registration in another process, DDL/admin bypasses, Helm/image writers or unmanaged shared consumers. Complete application/release writer exclusion still needs owner implementation.

The production DB hooks currently print arguments on slow/error queries and runtime traces, even with normal SQL logging disabled. This patch adds an explicit private-query context and redacts statement, arguments and driver-error text in those three hooks. The primitive refuses both configured SQL logging and the actual XORM logger's argument logging. Server/driver/audit/backup logging, custom hooks and private-runtime output custody remain owner review obligations. The actual hook tests include positive unredacted controls; no real secrets were used. The initial candidate only wrapped the Go context; inspection found that existing Engined contexts and db.WithTx did not propagate that marker into XORM's real query hooks. Direct hook fixtures alone missed this flaw. The final patch rebinds marked contexts in db.GetEngine, preserving the same transaction and actual SQL cancellation context; ordinary unmarked routing is unchanged. The added actual hooked-XORM failing-query test checks real slow/error/trace paths and positive/private controls. Earlier results remain in the evidence as insufficient for this propagation question.

Private journal custody and recovery limits

login_source_operation is registered with Forgejo's existing model/schema sync. Its before/desired/post fields contain private raw configurations and secret copies, including unrelated-source snapshots. It is not a value-free receipt, independent authenticated evidence, an authorization token or an audit outbox. It inherits the owner's database/storage/backup custody and encryption limits; this patch adds no encryption or new read grant. Existing database access does not automatically authorize an additional journal reader. Owner credential inventory, recovery access, backup inclusion, retention and eventual deletion must explicitly account for these additional copies before admission.

Preparation refuses at 64 unresolved or 256 total journals, at a desired config above 64 KiB or an original inventory above 1 MiB. These are refusal bounds, not retention approval. Nothing automatically erases unresolved, failed/uncertain or terminal private recovery state. A separately authenticated owner retention and purge decision/implementation is still required; exhaustion remains refused. Completed rows preserve original/desired/post state for recovery. Individual refused or storage-failed calls are not a separately durable attempt log: the admitted runtime must preserve their original errors/uncertainty, current-session references and authenticated attempt/evidence history outside a rolled-back transaction. DB commit uncertainty always calls reconciliation; an ambiguous response does not justify blindly replaying the effect.

The actual file-backed SQLite test kills a child process immediately after the real ApplySourceOperation INSERT, before post-state/journal update/commit. A new process sees the original prepared journal and no source. Later independent processes observe confirmed apply, perform inverse and confirm reverted absence. This proves bounded actual local database crash/restart mechanics, not an external session, deployed database or independent evidence facility.

Required integration before any exposed operation

There is intentionally no new unauthenticated CLI, API, privileged default factory or always-true authority callback. These exported low-level functions have the same private-database trust boundary as existing CRUD; they are not an authorization boundary. An existing owner CLI/service must authenticate a fresh current initiating principal/session and exact Access Engine decision before every call, including preparation/reconciliation journal writes and each inverse attempt. Admission must bind case, operation/transaction, source and accepted implementation revision, exact parameters, target, principal, current session, purpose/action and expiry/revocation. Neither an arbitrary Subject in a CheckRequest, a service caller token, an offline config pin nor this journal authenticates the initiating human/agent. Fresh inverse authority cannot reuse a revoked hand-over session. All exit paths still need revocation.

The shared producer-owned Access Engine adapter is separate coordinator work. The real owner session/evidence/outbox/revocation facilities, release-wide exclusion, cross-process provider refresh/restart and session-to-CLI binding remain unresolved here. These are existing hand-over/inverse obligations, not an eighth SecurityCase kernel step or another service. Actual app policy and exact desired-config validation remain the admitted owner's responsibility.

An image downgrade remains refused until authoritative source restoration/removal, complete unrelated-state checks and all extension-sensitive configurations are independently verified safe. Even a restored original source can contain a preexisting extension gate; a source inverse does not itself authorize downgrade. Helm omission/rollback never substitutes for source inverse. Keep the extended image and gate when linked-source deletion refuses or any current state is uncertain; preserve local sign-in and reconcile with the owner. Existing users or external links must never be removed to force deletion.

Evidence

The exact eight-path additive patch, actual source pre/postimages, inventories, bounded real package tests, crash/exclusion tests and original failed attempts are retained in this directory. Tests run in network-disabled bwrap with only public source/toolchain/module inputs; toolchain/modules are read-only and build cache/source are isolated writable copies. run-tests.py records the exact sandbox and argv. Only synthetic fixtures are used. Initial Git-global-config and hook-test pointer-method harness failures remain evidence, not successes. Early test sandboxes used network isolation without a PID namespace; their host-proc visibility is retained as a profile limitation, not an isolation proof. No host process-argument scan was authored. Final and corrected control runs use both network and PID isolation before mounting proc. The first control trial started before its separate source copy completed; its missing-package setup failure is explicitly invalid, preserved and superseded, never a detected guard. No lifecycle, native gate or owner workplan is closed by these source tests.