docs(recovery): drop transient Draft labels from canonical status - #226
Closed
cursor[bot] wants to merge 36 commits into
Closed
docs(recovery): drop transient Draft labels from canonical status#226cursor[bot] wants to merge 36 commits into
cursor[bot] wants to merge 36 commits into
Conversation
Replay the #212 successor alignment onto 229f8d3 so the product and technical contracts no longer present #209 as the active pg_restore path or treat set_config as an enforcement control. Register #210 as the Fernet operator-contract overlay and freeze stale #213. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Keep #209 as the unsafe predecessor and #212 as the unshipped active successor without freezing Draft/Ready pull-request state. Name the adjacent recovery families and add a regression that rejects those labels in durable product documents. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
seonghobae
requested changes
Aug 16, 2026
seonghobae
left a comment
seonghobae
left a comment
Contributor
There was a problem hiding this comment.
Blocking canonical-status inconsistency on exact head c76ca2988755e5fe7d7b6c02f1a5a8b899c63fad: this PR is explicitly the successor to #214 and is exactly one commit ahead of #214 head 8227e820e62edc502f7b050fb72d0a638d30d135, but docs/TRACEABILITY.md still registers #214 as “this five-file canonical overlay” and never registers #226 as the active six-file successor. That makes the canonical overlay register stale at the moment this successor is proposed and undermines the new status-vocabulary regression’s purpose.
Repair the durable register without introducing volatile Draft/Ready/check/SHA language: identify #226 as the active canonical-documentation successor, and classify #214 as the superseded predecessor (or otherwise state the relationship without implying #214 is still the landing vehicle). Verify the same successor identity across DOCUMENTATION_FITNESS, PRD, TRD, and ADR index if those files mention the canonical overlay. The existing target-isolation wording in TRACEABILITY is appropriately bounded: #225 is described as service-label separation, not authenticated cluster isolation; preserve that distinction.
Close the acquisition-facing documentation gaps that left assets, trust boundaries, and table identities only in SQL and scattered security prose. Cite NIST SP 800-30, 800-53, and 800-154 without claiming certification. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Map payload ownership, retention, and the no-blanket-masking privacy boundary, and show standalone versus embedded composition so a buyer can see the next host control without reading SQL first. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Contributor
Author
There was a problem hiding this comment.
Do not merge this head. seonghobae's register request on c76ca298 is only partly repaired on 65be01d.
What a reviewer should do next:
- Keep #214 Draft and unmerged. It still freezes transient Draft labels.
- Do not merge this #226 head. The overlay register still says
keep it Draft, and the FR-5 restore-target row still treats #224 as the active acceptance overlay. - Review the successor that removes that leftover state instruction, names #225 as the ADR 0022 restore-target landing vehicle, and keeps #225 as a configuration-label check rather than authenticated cluster isolation.
- Continue Issue #204 on the isolated restore-acceptance lanes. Do not start another vocabulary rewrite after the successor lands.
What this head already got right:
- #226 is named as the documentation overlay and #214 is marked superseded.
- Canonical status documents no longer persist
Draft #N/Ready #Nor contributor SHAs, except the leftoverkeep it Draftinstruction. - #225 remains described as service-label separation, not authenticated cluster isolation, in the overlay register.
- Threat-model, data-governance, UML, and ERD overlays stay evidence-readiness documents with operator next actions and APA 7th citations.
- No runtime, schema, workflow, or package-metadata changes.
Required checks on this synchronize were still queued at review time. Checks are not the blocker; the leftover register wording is.
Sent by Cursor Automation: Fix Issues
| - **#208** — bounded logical PostgreSQL backup executor using `pg_dump`; active source only and not evidence that protected main can create a restorable backup. | ||
| - **#210** — configuration/secrets operator/runtime contract successor; encryption-required policy, least-privilege runtime readiness, and provisioning separation remain unshipped until this lane is repaired and integrated. | ||
| - **#212** — direct logical-restore successor to closed #209; it replaces the invalid EOF postcondition with metadata-fingerprint verification and owns the accompanying restore-contract documentation. It is not evidence of isolated restore acceptance or end-to-end recovery readiness. | ||
| - **#214** — superseded canonical overlay that still froze transient Draft labels; keep it Draft. |
Contributor
Author
There was a problem hiding this comment.
This leftover keep it Draft instruction is the same class of transient pull-request state the overlay claims to remove. Name #214 as a superseded predecessor without telling an operator to keep a Draft label frozen in durable status prose.
| | FR-5 recovery evidence binding and live re-verification | ACTIVE-PR | protected main exposes the underlying receipt/schema/artifact evidence primitives only | PRs #215 and #221 exact-head evidence only | Bind-time composition and later re-inspection are active candidate seams, not inspection provenance or restore proof on protected main. A verifier success is integrity agreement at the inspection instant and does not remove TOCTOU or target-isolation requirements. | | ||
| | FR-5 post-restore catalog acceptance | ACTIVE-PR | protected-main schema and recovery evidence only | PR #223 exact-head catalog/unit/container evidence only; closed #216 is predecessor evidence | Catalog acceptance remains unshipped. Same-name index decoys, tenant-qualified key order, uniqueness/constraint authority, access method, readiness/validity, and live PostgreSQL query behavior must remain fail-closed before this can become protected-main truth. | | ||
| | FR-5 physical/WAL/PITR recovery profile | ACTIVE-PR | none on protected main beyond bounded recovery evidence | PR #219 exact-head evidence only | The profile records caller-owned recovery intent and objectives; it does not execute `pg_basebackup`, archive/replay WAL, prove an isolated target, or establish package RPO/RTO capability. | | ||
| | FR-5 restore-target isolation | PARTIAL | no protected-main target-isolation proof exists | active recovery acceptance work, including PR #224, is PR evidence only | Distinct configuration labels alone are insufficient to prove two service aliases resolve to different clusters. End-to-end acceptance must authenticate the actual restore target before production safety can be claimed. | |
Contributor
Author
There was a problem hiding this comment.
| | Durable reconciliation candidate/single-flight documentation | ACTIVE-PR | PRs #190 and #191 own current reconciliation additions; protected main has only the scheduler-independent bounded reconciliation primitive. | Update canonical shipped status only after each exact head merges. | | ||
| | Atomic durable result application | ACTIVE-PR | PR #194 contains a current-main-compatible test-first caller-owned PostgreSQL transaction seam for applying one validated streamed result/error record together with checkpoint advancement. It remains an active overlay; FR-4/end-to-end result application stays `PARTIAL` on protected main, and neither this row nor the TRD content-fidelity invariant promotes #194 into shipped truth. | Keep FR-4 and `docs/TRACEABILITY.md` as the validation/status authority until #194 integrates normally; preserve the explicit same-transaction and no-distributed-exactly-once boundary. | | ||
| | Runtime config/schema provisioning separation | ACTIVE-PR | PR #193 is a current-main least-privilege candidate: runtime constructors move away from DDL/default seeding, validate the search-path-resolved base-table shape and current-role read capability through bounded catalog probes, and retain provisioning/default seeding at the explicit schema boundary. #210 is the unshipped operator-contract successor that aligns public install/README/architecture/CHANGELOG wording with that runtime fail-closed Fernet/provisioning seam. Neither is shipped until normal governance integrates the unchanged successor. | Preserve the trusted-search-path/non-ownership caveat; treat #210 as the public-contract overlay rather than a second runtime rewrite; reacquire exact-head checks/review after every push; do not transfer predecessor or earlier-head evidence. | | ||
| | Canonical traceability | ACTIVE-PR | This branch is establishing the first current-main-compatible requirements-to-evidence map and distinguishes integrated recovery evidence from active executable candidates and unsafe predecessor heads. | Maintain `docs/TRACEABILITY.md` using stable code/test/doc authorities, not run IDs; record #212 only as an active overlay until integration. | |
Contributor
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Successor to #214
Do not merge #214 at
8227e82. That head still freezesDraft #212andDraft #210in durable product/status documents after #212 became Ready. This branch keeps the five-file overlay and adds a regression that rejects those transient labels.What to do next
What changed
tests/test_canonical_status_vocabulary.pyfails if canonical status documents persistDraft #N/Ready #Nor contributor SHAs.No runtime, schema, workflow, or package-metadata changes.