You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Normal execution, heartbeat loss and graceful shutdown
Design diagram
R03.52.1 does not select Python as the production Worker runtime (DEC-03 OPEN), nor a DB/migration adapter (DEC-04), broker (DEC-05/30), tenant trust boundary (DEC-19), or observability stack (DEC-13). No production readiness claim.
R03.52.2 — Bounded Worker Poller Pool & Concurrency Supervision
This is not a distributed Scheduler or production process supervisor. PostgreSQL claim remains the durable scheduling authority. No fairness, autoscaling, global replica concurrency, DB adapter or broker is selected.
R03.52.3 — Process Signal & Graceful Shutdown Bridge
The bridge does not enforce a hard termination deadline, cancel non-cooperative threads, or configure a container supervisor. Forced termination relies on R03.51 lease expiry/reclaim/fencing.
Authorization, tenant/job scope, status, replay limit and audit context
Run #41444145950 PASS (8 tests)
This creates an authorization preflight plan only. It does not authenticate the actor or atomically create a new Job/update DLQ/audit records in PostgreSQL.
R03.52.6 — Tenant Trust Boundary & Production Store Architecture
The spike verifies HMAC assertions inside a SECURITY DEFINER function called by RLS. The test key is ephemeral and shared with the fixture issuer; production issuer, key custody, replay consumption, asymmetric verification and Store integration are not implemented.
CI Run #41448568243 SUCCESS; 12/12 PostgreSQL verifier tests pass. This is reference-spike evidence only; no production security claim is made.
Current result: pgcrypto HMAC is a passing reference spike; Ed25519 asymmetric verification is preferred. pgsodium is the leading database-side candidate where supported; a DB-exclusive trusted gateway is the fallback candidate for managed providers without the extension.
Production algorithm/provider remains NOT_SELECTED pending DEC-14 deployment topology and DEC-03 runtime constraints.
Contract validation adds an isolated tenant-ed25519-verifier job. The issuer private key remains in the test process; PostgreSQL stores only public keys.
CI: Run #305 SUCCESS; PostgreSQL Ed25519 verifier 15/15 tests PASS and Contract validation SUCCESS. Production provider compatibility and named security review remain open.
Preliminary priority: Psycopg 3 + psycopg_pool for a Python Worker; node-postgres pg-pool for a TypeScript API; asyncpg as the Python asyncio challenger; SQLAlchemy is an optional abstraction, not a driver.
No production stack selected. DEC-03 runtime and DEC-14 deployment/provider remain OPEN.
CI Run #330 SUCCESS: PostgreSQL 17.11 + Ed25519 verifier/RLS exercised through Psycopg sync/async, asyncpg and node-postgres pools.
Initial measurements are smoke evidence only; node-postgres led this CI run at concurrency 8/32, while Psycopg sync led at concurrency 1. No production performance ranking or driver selection is made.
DEC-03 and DEC-14 remain OPEN; next increment is controlled full-operation and fault benchmarking.
Benchmark harness now supports explicit smoke and controlled profiles, repetitions, concurrency overrides and environment manifests.
Controlled profile has not yet been run; it requires an isolated operator-provisioned host. The current workload is still a protected RLS row read, not the full Store operation mix.
No production runtime/driver/pool selected; DEC-03 and DEC-14 remain OPEN.
Controlled benchmark harness verification: CI Run #333 SUCCESS. Run #332 failed on an intermediate Python/Node token-handoff mismatch and is retained in the audit trail; the subsequent synchronized commit passed.
Second smoke run #333 SUCCESS; environment manifest captured. Results vary materially from Run #330, so no production driver ranking is claimed. See the expanded benchmark report.
R03.52.7.3.4 — Full Store Workload Benchmark Design
Identifies the unresolved resource-scoped RLS mapping for Job/Session/Receipt/Transition/Outbox and assertion replay semantics. This is a security gate before benchmark fixture implementation.
Current CI benchmark remains a protected row-read smoke test; no full Store workload or production adapter is implemented.
