[E00-S03-T01] PostgreSQL 18.6 container #390

Merged

kpcto merged 2 commits from feature/176 into main 2026-08-29 11:04:32 +00:00

Conversation 4 Commits 2 Files Changed 4

+80 -10

bot-implementer commented 2026-08-29 10:45:15 +00:00

Member

Copy Link

Copy Source

What changed

Implements [E00-S03-T01] PostgreSQL 18.6 container (#176): the workspace database container is pinned to PostgreSQL 18.6 and the criterion is locked in by tests and enforced in CI.

• compose.yaml — db.image pinned to postgres:18.6-bookworm (exact 18.6 minor on the same Debian bookworm flavor as before — no Alpine drift, Technology-Stack §5.2/§5.4/§6.2, golden tuple §7). The floating major tag (postgres:18-bookworm) would not guarantee the container exposes the expected version; the exact-minor pin makes the database container reproducible. Rollback: revert image to postgres:18-bookworm.
• tests/compose-config.test.mjs — the pinned image is asserted statically (assertDbService requires postgres:18.6-bookworm), the parser probe and the db-mutation fixture are updated, and a mutation probe proves non-vacuousness: reverting to the floating postgres:18-bookworm tag fails the criterion.
• tests/compose-config.test.mjs — new Docker-gated real-stack probe "the database container exposes the expected PostgreSQL version (18.6)": starts the stack and runs SHOW server_version against the running db container, asserting the exposed version is 18.6 — the issue's test plan ("start the container and confirm PostgreSQL 18.6") executed end to end. Skips cleanly where no Docker daemon exists (same pattern as the T01..T08 real-stack probes).
• .gitea/workflows/ci.yml — new compose-config job runs node --test tests/compose-config.test.mjs on every PR, so the pinned-version criterion gates merges (the Docker-gated probes run where a daemon exists and skip cleanly otherwise).

Explicitly out of scope per the brief, not touched: pg/Kysely isolation (E00-S03-T02), migration ledger (E00-S03-T03), advisory lock (E00-S03-T04).

Criterion → test table

Acceptance criterion	Test (fails without the committed state)
PostgreSQL 18.6 container is used as the database	tests/compose-config.test.mjs — "the database service is defined so `docker compose up -d` starts the database" (static: assertDbService requires db.image === 'postgres:18.6-bookworm'); "reverting the db image to a floating major tag fails the PostgreSQL 18.6 criterion (mutation probe)" proves non-vacuous — postgres:18-bookworm / postgres:18 would not satisfy the exact-minor pin
the container exposes the expected PostgreSQL version	tests/compose-config.test.mjs — "the database container exposes the expected PostgreSQL version (18.6)" (Docker-gated real-stack probe): docker compose up -d the committed stack, docker compose exec db psql … -c 'SHOW server_version;', assert the running server reports 18.6 — verifies the exposed version end to end, not just the declared tag
the guarantee is enforced in CI	.gitea/workflows/ci.yml — compose-config job runs node --test tests/compose-config.test.mjs on every PR (static assertions gate merges; docker-gated probes skip cleanly without a daemon)

Test plan executed

• node --test tests/compose-config.test.mjs → 18 pass / 0 fail / 4 skip (the 4 skips are the Docker-gated real-stack probes — no Docker daemon in this sandbox, matching the CI runner).
• node --test tests/build-targets.test.mjs tests/secrets-not-embedded.test.mjs → pass (fixtures updated to the pinned tag; no behavior change).
• Full suite (node --test "tests/**/*.test.mjs") → 102 pass / 12 fail / 9 skip; the 12 failures are byte-identical to clean main (frozen-install / root-commands / strict-tsconfig / node-engine / typescript-pin suites need pnpm install + Node 24 — absent here: no node_modules, Node 22.23.2) — zero new failures, +2 tests net (+1 pass, +1 Docker-gated skip) vs main's 101/12/8.

Risks / notes

• The image flavor is unchanged (-bookworm); only the minor version is pinned, so the runtime behavior of the existing stack (health gate, volume persistence, app startup) is unaffected.
• The Docker-gated version probe asserts SHOW server_version matches /^18\.6\b/, which matches both the bare 18.6 and the PGDG build string (18.6 (Debian 18.6-1.pgdg120+1)) — no over-constraining on the distro suffix.
• The new CI job runs the whole compose-config suite (not just the pinned-version tests), so the previously CI-ungated T02..T08 compose assertions now gate merges too.

Refs #176

## What changed Implements [E00-S03-T01] PostgreSQL 18.6 container (#176): the workspace database container is **pinned to PostgreSQL 18.6** and the criterion is locked in by tests and enforced in CI. - **`compose.yaml` — `db.image` pinned to `postgres:18.6-bookworm`** (exact 18.6 minor on the same Debian bookworm flavor as before — no Alpine drift, Technology-Stack §5.2/§5.4/§6.2, golden tuple §7). The floating major tag (`postgres:18-bookworm`) would not guarantee the container exposes the expected version; the exact-minor pin makes the database container reproducible. Rollback: revert `image` to `postgres:18-bookworm`. - **`tests/compose-config.test.mjs` — the pinned image is asserted statically** (`assertDbService` requires `postgres:18.6-bookworm`), the parser probe and the db-mutation fixture are updated, and a **mutation probe proves non-vacuousness**: reverting to the floating `postgres:18-bookworm` tag fails the criterion. - **`tests/compose-config.test.mjs` — new Docker-gated real-stack probe** "the database container exposes the expected PostgreSQL version (18.6)": starts the stack and runs `SHOW server_version` against the running `db` container, asserting the exposed version is 18.6 — the issue's test plan ("start the container and confirm PostgreSQL 18.6") executed end to end. Skips cleanly where no Docker daemon exists (same pattern as the T01..T08 real-stack probes). - **`.gitea/workflows/ci.yml` — new `compose-config` job** runs `node --test tests/compose-config.test.mjs` on every PR, so the pinned-version criterion gates merges (the Docker-gated probes run where a daemon exists and skip cleanly otherwise). Explicitly out of scope per the brief, **not touched**: pg/Kysely isolation (E00-S03-T02), migration ledger (E00-S03-T03), advisory lock (E00-S03-T04). ## Criterion → test table | Acceptance criterion | Test (fails without the committed state) | | --- | --- | | `PostgreSQL 18.6 container is used as the database` | `tests/compose-config.test.mjs` — **"the database service is defined so \`docker compose up -d\` starts the database"** (static: `assertDbService` requires `db.image === 'postgres:18.6-bookworm'`); **"reverting the db image to a floating major tag fails the PostgreSQL 18.6 criterion (mutation probe)"** proves non-vacuous — `postgres:18-bookworm` / `postgres:18` would not satisfy the exact-minor pin | | `the container exposes the expected PostgreSQL version` | `tests/compose-config.test.mjs` — **"the database container exposes the expected PostgreSQL version (18.6)"** (Docker-gated real-stack probe): `docker compose up -d` the committed stack, `docker compose exec db psql … -c 'SHOW server_version;'`, assert the running server reports `18.6` — verifies the exposed version end to end, not just the declared tag | | `the guarantee is enforced in CI` | `.gitea/workflows/ci.yml` — **`compose-config` job** runs `node --test tests/compose-config.test.mjs` on every PR (static assertions gate merges; docker-gated probes skip cleanly without a daemon) | ## Test plan executed - `node --test tests/compose-config.test.mjs` → **18 pass / 0 fail / 4 skip** (the 4 skips are the Docker-gated real-stack probes — no Docker daemon in this sandbox, matching the CI runner). - `node --test tests/build-targets.test.mjs tests/secrets-not-embedded.test.mjs` → **pass** (fixtures updated to the pinned tag; no behavior change). - Full suite (`node --test "tests/**/*.test.mjs"`) → **102 pass / 12 fail / 9 skip**; the **12 failures are byte-identical to clean `main`** (frozen-install / root-commands / strict-tsconfig / node-engine / typescript-pin suites need `pnpm install` + Node 24 — absent here: no `node_modules`, Node 22.23.2) — **zero new failures**, +2 tests net (+1 pass, +1 Docker-gated skip) vs main's 101/12/8. ## Risks / notes - The image flavor is unchanged (`-bookworm`); only the minor version is pinned, so the runtime behavior of the existing stack (health gate, volume persistence, app startup) is unaffected. - The Docker-gated version probe asserts `SHOW server_version` matches `/^18\.6\b/`, which matches both the bare `18.6` and the PGDG build string (`18.6 (Debian 18.6-1.pgdg120+1)`) — no over-constraining on the distro suffix. - The new CI job runs the whole `compose-config` suite (not just the pinned-version tests), so the previously CI-ungated T02..T08 compose assertions now gate merges too. Refs #176

bot-implementer added 2 commits 2026-08-29 10:45:16 +00:00

feat: pin the database container to PostgreSQL 18.6 (E00-S03-T01) ... 4cd68c9193

- compose.yaml: db.image pinned to postgres:18.6-bookworm (exact 18.6 minor,
  same bookworm flavor, no Alpine drift) so the database container is
  reproducible and exposes the expected PostgreSQL version; document the
  rollback (revert image to postgres:18-bookworm)
- .gitea/workflows/ci.yml: new compose-config job runs
  tests/compose-config.test.mjs on every PR so the pinned-version criterion
  gates merges (docker-gated real-stack probes skip cleanly without a daemon)

test: lock in the PostgreSQL 18.6 container criteria (E00-S03-T01) ... a78ffea4c5

- compose-config.test.mjs: assertDbService requires the pinned
  postgres:18.6-bookworm image; new docker-gated real-stack probe starts the
  stack and asserts SHOW server_version exposes 18.6; mutation probe proves
  reverting to a floating major tag fails the criterion; parser probe updated
- build-targets.test.mjs: db-service mutation fixture updated to the pinned
  image tag

bot-security referenced this pull request 2026-08-29 10:46:39 +00:00

[E00-S03-T01] PostgreSQL 18.6 container #176

bot-tester commented 2026-08-29 10:49:06 +00:00

Member

Copy Link

Copy Source

agent: tester
issue: 176
pr: 390
objective: independently probe the PR for #176
status: start
plan:
  - inspect PR #390 diff (compose.yaml, tests/compose-config.test.mjs, .gitea/workflows/ci.yml)
  - verify "PostgreSQL 18.6 container is used as the database"
  - verify "the container exposes the expected PostgreSQL version"
  - check CI runs and collect evidence links
constraints:
  - never edit the implementer's tests in the same PR
acceptance:
  - PostgreSQL 18.6 container is used as the database
  - the container exposes the expected PostgreSQL version

```yaml agent: tester issue: 176 pr: 390 objective: independently probe the PR for #176 status: start plan: - inspect PR #390 diff (compose.yaml, tests/compose-config.test.mjs, .gitea/workflows/ci.yml) - verify "PostgreSQL 18.6 container is used as the database" - verify "the container exposes the expected PostgreSQL version" - check CI runs and collect evidence links constraints: - never edit the implementer's tests in the same PR acceptance: - PostgreSQL 18.6 container is used as the database - the container exposes the expected PostgreSQL version ```

bot-tester commented 2026-08-29 10:51:50 +00:00

Member

Copy Link

Copy Source

agent: tester
issue: 176
pr: 390
status: done
verdict: PASS
summary: >
  PR #390 pins compose.yaml db.image to postgres:18.6-bookworm and locks both
  acceptance criteria in tests + CI. Both acceptance criteria verified.

acceptance:
  - criterion: PostgreSQL 18.6 container is used as the database
    result: PASS
    evidence:
      - "compose.yaml services.db.image = postgres:18.6-bookworm (feature/176 @ a78ffea)"
      - "tests/compose-config.test.mjs assertDbService() requires db.image === 'postgres:18.6-bookworm'"
      - "mutation probe 'reverting the db image to a floating major tag fails the PostgreSQL 18.6 criterion' passes (non-vacuous)"
      - "local run: node --test tests/compose-config.test.mjs -> 18 pass / 0 fail / 4 skip"
  - criterion: the container exposes the expected PostgreSQL version
    result: PASS
    evidence:
      - "Docker-gated test 'the database container exposes the expected PostgreSQL version (18.6)' runs docker compose up -d then SHOW server_version and asserts /^18\\.6\\b/"
      - "independent registry check: postgres:18.6-bookworm tag exists (docker.io digest sha256:1c59e2c3c818eaa0f0628f695b36e7c9e362d6b219b36a54a32df645cbd7e1af)"
      - "image config (amd64): PG_MAJOR=18, PG_VERSION=18.6-1.pgdg12+2 -> container exposes PostgreSQL 18.6"
      - "PostgreSQL 18.6 is a real release (2026-08-13, alongside 17.11/16.15/15.19/14.24)"

ci:
  run: http://gitea:3000/Fabrika/PersonalBlog/actions/runs/80
  head_sha: a78ffea4c55a6fdfcb97f590a815237acb234a77
  conclusion: success
  jobs:
    - name: Frozen lockfile install
      url: http://gitea:3000/Fabrika/PersonalBlog/actions/runs/80/jobs/95
      conclusion: success
    - name: Secrets not embedded (E00-S02-T08)
      url: http://gitea:3000/Fabrika/PersonalBlog/actions/runs/80/jobs/96
      conclusion: success
    - name: Compose config (E00-S03-T01)
      url: http://gitea:3000/Fabrika/PersonalBlog/actions/runs/80/jobs/97
      conclusion: success
      note: "22 tests / 18 pass / 0 fail / 4 skip; the 4 skips are the Docker-gated real-stack probes (no Docker daemon in runner)"

constraints:
  - "never edit the implementer's tests in the same PR: honored (no edits made)"

notes:
  - "The end-to-end version probe is Docker-gated and skips in CI (runner has no Docker daemon), so CI enforces the static 18.6 pin; the runtime version is verified by the Docker-gated test (on Docker-enabled runners) and independently confirmed here via the published image config (PG_VERSION=18.6-1.pgdg12+2)."
  - "postgres:18.6-bookworm and postgres:18-bookworm currently share the same digest (18.6 is the latest 18.x minor); the exact-minor pin is still correct for reproducibility and prevents drift to 18.7+."

```yaml agent: tester issue: 176 pr: 390 status: done verdict: PASS summary: > PR #390 pins compose.yaml db.image to postgres:18.6-bookworm and locks both acceptance criteria in tests + CI. Both acceptance criteria verified. acceptance: - criterion: PostgreSQL 18.6 container is used as the database result: PASS evidence: - "compose.yaml services.db.image = postgres:18.6-bookworm (feature/176 @ a78ffea)" - "tests/compose-config.test.mjs assertDbService() requires db.image === 'postgres:18.6-bookworm'" - "mutation probe 'reverting the db image to a floating major tag fails the PostgreSQL 18.6 criterion' passes (non-vacuous)" - "local run: node --test tests/compose-config.test.mjs -> 18 pass / 0 fail / 4 skip" - criterion: the container exposes the expected PostgreSQL version result: PASS evidence: - "Docker-gated test 'the database container exposes the expected PostgreSQL version (18.6)' runs docker compose up -d then SHOW server_version and asserts /^18\\.6\\b/" - "independent registry check: postgres:18.6-bookworm tag exists (docker.io digest sha256:1c59e2c3c818eaa0f0628f695b36e7c9e362d6b219b36a54a32df645cbd7e1af)" - "image config (amd64): PG_MAJOR=18, PG_VERSION=18.6-1.pgdg12+2 -> container exposes PostgreSQL 18.6" - "PostgreSQL 18.6 is a real release (2026-08-13, alongside 17.11/16.15/15.19/14.24)" ci: run: http://gitea:3000/Fabrika/PersonalBlog/actions/runs/80 head_sha: a78ffea4c55a6fdfcb97f590a815237acb234a77 conclusion: success jobs: - name: Frozen lockfile install url: http://gitea:3000/Fabrika/PersonalBlog/actions/runs/80/jobs/95 conclusion: success - name: Secrets not embedded (E00-S02-T08) url: http://gitea:3000/Fabrika/PersonalBlog/actions/runs/80/jobs/96 conclusion: success - name: Compose config (E00-S03-T01) url: http://gitea:3000/Fabrika/PersonalBlog/actions/runs/80/jobs/97 conclusion: success note: "22 tests / 18 pass / 0 fail / 4 skip; the 4 skips are the Docker-gated real-stack probes (no Docker daemon in runner)" constraints: - "never edit the implementer's tests in the same PR: honored (no edits made)" notes: - "The end-to-end version probe is Docker-gated and skips in CI (runner has no Docker daemon), so CI enforces the static 18.6 pin; the runtime version is verified by the Docker-gated test (on Docker-enabled runners) and independently confirmed here via the published image config (PG_VERSION=18.6-1.pgdg12+2)." - "postgres:18.6-bookworm and postgres:18-bookworm currently share the same digest (18.6 is the latest 18.x minor); the exact-minor pin is still correct for reproducibility and prevents drift to 18.7+." ```

bot-security referenced this pull request 2026-08-29 10:54:26 +00:00

[E00-S03-T01] PostgreSQL 18.6 container #176

bot-analyst referenced this pull request 2026-08-29 10:57:48 +00:00

[E00-S03-T01] PostgreSQL 18.6 container #176

bot-analyst referenced this pull request 2026-08-29 10:57:57 +00:00

[E00-S03-T01] PostgreSQL 18.6 container #176

kpcto referenced this pull request 2026-08-29 11:01:10 +00:00

[E00-S03-T01] PostgreSQL 18.6 container #176

kpcto merged commit 797a1b8dc2 into main 2026-08-29 11:04:32 +00:00

kpcto deleted branch feature/176 2026-08-29 11:04:32 +00:00

bot-tester commented 2026-08-29 11:05:29 +00:00

Member

Copy Link

Copy Source

agent: tester
issue: 176
pr: 390
objective: independently probe the PR for #176
status: start
plan:
  - inspect PR #390 diff (compose.yaml, tests/compose-config.test.mjs, tests/build-targets.test.mjs, .gitea/workflows/ci.yml)
  - verify "PostgreSQL 18.6 container is used as the database" (static pin + non-vacuous mutation check)
  - verify "the container exposes the expected PostgreSQL version" (Docker-gated probe + independent registry image-config check)
  - verify CI enforcement (compose-config job on every PR) and collect run/job evidence links
constraints:
  - never edit the implementer's tests in the same PR
acceptance:
  - PostgreSQL 18.6 container is used as the database
  - the container exposes the expected PostgreSQL version
  - the pinned-version guarantee is enforced in CI (compose-config job runs tests/compose-config.test.mjs on every PR, gating T02..T08)

```yaml agent: tester issue: 176 pr: 390 objective: independently probe the PR for #176 status: start plan: - inspect PR #390 diff (compose.yaml, tests/compose-config.test.mjs, tests/build-targets.test.mjs, .gitea/workflows/ci.yml) - verify "PostgreSQL 18.6 container is used as the database" (static pin + non-vacuous mutation check) - verify "the container exposes the expected PostgreSQL version" (Docker-gated probe + independent registry image-config check) - verify CI enforcement (compose-config job on every PR) and collect run/job evidence links constraints: - never edit the implementer's tests in the same PR acceptance: - PostgreSQL 18.6 container is used as the database - the container exposes the expected PostgreSQL version - the pinned-version guarantee is enforced in CI (compose-config job runs tests/compose-config.test.mjs on every PR, gating T02..T08) ```

bot-tester commented 2026-08-29 11:05:42 +00:00

Member

Copy Link

Copy Source

agent: tester
issue: 176
pr: 390
status: done
verdict: PASS
summary: >
  PR #390 (feature/176 @ a78ffea) pins compose.yaml db.image to postgres:18.6-bookworm,
  locks both the pin and the exposed-version criterion in tests, and enforces the whole
  compose-config suite (including the T02..T08 assertions) in CI via a compose-config job.
  All three acceptance criteria verified independently.

acceptance:
  - criterion: PostgreSQL 18.6 container is used as the database
    result: PASS
    evidence:
      - "compose.yaml services.db.image = postgres:18.6-bookworm (feature/176 @ a78ffea4c55a6fdfcb97f590a815237acb234a77)"
      - "tests/compose-config.test.mjs assertDbService() requires db.image === 'postgres:18.6-bookworm'"
      - "mutation probe 'reverting the db image to a floating major tag fails the PostgreSQL 18.6 criterion' passes"
      - "independent non-vacuous check: reverting compose.yaml image to postgres:18-bookworm makes the suite FAIL (node --test exits non-zero); then restored, working tree clean"
      - "local run: node --test tests/compose-config.test.mjs -> 22 tests / 18 pass / 0 fail / 4 skip"
  - criterion: the container exposes the expected PostgreSQL version
    result: PASS
    evidence:
      - "Docker-gated test 'the database container exposes the expected PostgreSQL version (18.6)' runs docker compose up -d then docker compose exec db psql ... 'SHOW server_version;' and asserts /^18\\.6\\b/"
      - "independent registry check: postgres:18.6-bookworm tag is active (tag digest sha256:1c59e2c3c818eaa0f0628f695b36e7c9e362d6b219b36a54a32df645cbd7e1af)"
      - "amd64 image config (registry-1.docker.io): PG_MAJOR=18, PG_VERSION=18.6-1.pgdg12+2 -> the container exposes PostgreSQL 18.6"
  - criterion: the pinned-version guarantee is enforced in CI
    result: PASS
    evidence:
      - ".gitea/workflows/ci.yml defines a compose-config job running 'node --test tests/compose-config.test.mjs' under 'on: pull_request:' (no branch filter -> every PR) + 'push: [main]'"
      - "CI run #80 (pull_request, head_sha a78ffea) -> success; 'Compose config (E00-S03-T01)' job ran the full suite: 22 tests / 18 pass / 0 fail / 4 skip (4 skips = Docker-gated real-stack probes; CI runner has no Docker daemon)"
      - "the job gates the whole compose-config suite, including the T02..T08 assertions (health gate, app health, volume persistence, Dockerfile, .dockerignore, etc.)"

ci:
  run: http://gitea:3000/Fabrika/PersonalBlog/actions/runs/80
  head_sha: a78ffea4c55a6fdfcb97f590a815237acb234a77
  conclusion: success
  jobs:
    - name: Frozen lockfile install
      url: http://gitea:3000/Fabrika/PersonalBlog/actions/runs/80/jobs/95
      conclusion: success
    - name: Secrets not embedded (E00-S02-T08)
      url: http://gitea:3000/Fabrika/PersonalBlog/actions/runs/80/jobs/96
      conclusion: success
    - name: Compose config (E00-S03-T01)
      url: http://gitea:3000/Fabrika/PersonalBlog/actions/runs/80/jobs/97
      conclusion: success

constraints:
  - "never edit the implementer's tests in the same PR: honored (no test files modified; compose.yaml temporarily reverted locally for the non-vacuous check and restored via git checkout — no commits pushed)"

notes:
  - "No Docker daemon in the tester sandbox or the CI runner, so the runtime SHOW server_version probe is Docker-gated and skips; the exposed-version criterion is independently confirmed via the published image config (PG_VERSION=18.6-1.pgdg12+2)."
  - "postgres:18.6-bookworm and postgres:18-bookworm currently share the same digest (18.6 is the latest 18.x minor); the exact-minor pin still provides reproducibility and prevents silent drift to 18.7+."

```yaml agent: tester issue: 176 pr: 390 status: done verdict: PASS summary: > PR #390 (feature/176 @ a78ffea) pins compose.yaml db.image to postgres:18.6-bookworm, locks both the pin and the exposed-version criterion in tests, and enforces the whole compose-config suite (including the T02..T08 assertions) in CI via a compose-config job. All three acceptance criteria verified independently. acceptance: - criterion: PostgreSQL 18.6 container is used as the database result: PASS evidence: - "compose.yaml services.db.image = postgres:18.6-bookworm (feature/176 @ a78ffea4c55a6fdfcb97f590a815237acb234a77)" - "tests/compose-config.test.mjs assertDbService() requires db.image === 'postgres:18.6-bookworm'" - "mutation probe 'reverting the db image to a floating major tag fails the PostgreSQL 18.6 criterion' passes" - "independent non-vacuous check: reverting compose.yaml image to postgres:18-bookworm makes the suite FAIL (node --test exits non-zero); then restored, working tree clean" - "local run: node --test tests/compose-config.test.mjs -> 22 tests / 18 pass / 0 fail / 4 skip" - criterion: the container exposes the expected PostgreSQL version result: PASS evidence: - "Docker-gated test 'the database container exposes the expected PostgreSQL version (18.6)' runs docker compose up -d then docker compose exec db psql ... 'SHOW server_version;' and asserts /^18\\.6\\b/" - "independent registry check: postgres:18.6-bookworm tag is active (tag digest sha256:1c59e2c3c818eaa0f0628f695b36e7c9e362d6b219b36a54a32df645cbd7e1af)" - "amd64 image config (registry-1.docker.io): PG_MAJOR=18, PG_VERSION=18.6-1.pgdg12+2 -> the container exposes PostgreSQL 18.6" - criterion: the pinned-version guarantee is enforced in CI result: PASS evidence: - ".gitea/workflows/ci.yml defines a compose-config job running 'node --test tests/compose-config.test.mjs' under 'on: pull_request:' (no branch filter -> every PR) + 'push: [main]'" - "CI run #80 (pull_request, head_sha a78ffea) -> success; 'Compose config (E00-S03-T01)' job ran the full suite: 22 tests / 18 pass / 0 fail / 4 skip (4 skips = Docker-gated real-stack probes; CI runner has no Docker daemon)" - "the job gates the whole compose-config suite, including the T02..T08 assertions (health gate, app health, volume persistence, Dockerfile, .dockerignore, etc.)" ci: run: http://gitea:3000/Fabrika/PersonalBlog/actions/runs/80 head_sha: a78ffea4c55a6fdfcb97f590a815237acb234a77 conclusion: success jobs: - name: Frozen lockfile install url: http://gitea:3000/Fabrika/PersonalBlog/actions/runs/80/jobs/95 conclusion: success - name: Secrets not embedded (E00-S02-T08) url: http://gitea:3000/Fabrika/PersonalBlog/actions/runs/80/jobs/96 conclusion: success - name: Compose config (E00-S03-T01) url: http://gitea:3000/Fabrika/PersonalBlog/actions/runs/80/jobs/97 conclusion: success constraints: - "never edit the implementer's tests in the same PR: honored (no test files modified; compose.yaml temporarily reverted locally for the non-vacuous check and restored via git checkout — no commits pushed)" notes: - "No Docker daemon in the tester sandbox or the CI runner, so the runtime SHOW server_version probe is Docker-gated and skips; the exposed-version criterion is independently confirmed via the published image config (PG_VERSION=18.6-1.pgdg12+2)." - "postgres:18.6-bookworm and postgres:18-bookworm currently share the same digest (18.6 is the latest 18.x minor); the exact-minor pin still provides reproducibility and prevents silent drift to 18.7+." ```

bot-implementer referenced this pull request 2026-08-29 11:15:13 +00:00

[E00-S03-T02] pg/Kysely imports isolated to database-postgres #391

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

agent/analyst-drafted

agent/analyst-drafted

kind

bug

kind

bug

kind

epic

kind

epic

kind

initiative

EPPP programme initiative

kind

story

kind

story

kind

task

EPPP engineering card/task decomposed from a story

kind

toil

kind

toil

loop

1

loop

1

loop

2

loop

2

loop

3

loop

3

needs/human-decision

needs/human-decision

needs/security-review

needs/security-review

risk

agent-full

risk

agent-full

risk

human-gated

risk

human-gated

risk

human-only

risk

human-only

size

l

size

l

size

m

size

m

size

s

size

s

status

blocked

status

blocked

status

done

Workflow: Done

status

in-progress

status

in-progress

status

proposed

status

proposed

status

ready

status

ready

status

review

status

review

stream

checkout

stream

checkout

stream

onboarding

stream

onboarding

stream

platform

stream

platform

tier/t0

trivial — implementer only, auto-merge

tier/t1

standard — implementer + reviewer + tester

tier/t2

complex — security if triggered, human merge

tier/t3

critical — full chain + security, human merge

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

bot-analyst bot-dispatcher bot-implementer bot-migrations bot-reviewer bot-security bot-tester kpcto

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Fabrika/PersonalBlog#390