# Shared PostgreSQL 18 layout qualification

Implementation: [decision 0048](../decisions/0048-shared-development-infrastructure.md).
The conversion design follows ikons' [consolidation hand-off](../decisions/0047-dev-box-consolidation.md).

## Automated checks

On 16 October 2026, the combined DX/Project checkout passed:

- `pnpm verify`, including 383 shared DX tests, 53 Metallo DX tests, six Themelio
  DX tests, and the architecture/security/render and service test lanes.
- `pnpm check:large-file-review`.
- The desktop build and 22 browser interaction runs across OS light/dark modes.

Verification was repeated after incorporating main at `a09251c5d`, including
its Run cancellation and Waldur readiness changes; all 1,282 Metallo tests passed. Merge resolution
retained the cluster-test namespace fix under the new DX import paths.

The live Waldur readiness probe exposed an existing-database role update gap after
PR 695: the rendered permissions disabled `PROJECT.ADMIN`, while the database still
allowed it. The PostSync bootstrap now feeds the current role ConfigMap to Waldur's
idempotent override command. Negative fixtures reject missing or premature hooks,
stale input files and incorrect mounts. The remaining invitation and identity-manager
checks passed in the initial probe.

After ordinary reconciliation at `7c6a2002a`, all 35 Waldur checks passed. The API
pod still mounted the old role input at that point, confirming that the hook used
the current ConfigMap. The API container was then restarted within the same pod;
it became ready, and all 35 checks passed again. The probe removed its temporary
users and invitations and marked its test Project removed.

Conversion regressions simulate an interruption after each committed deletion,
then resume through the original checkpoint. They reject changed namespace UIDs,
foreign applications/workloads, retained storage, unknown PostgreSQL generations,
changed machine/node/disk/target/owner bindings and competing maintenance. Once
`installing` or `ready`, repeated deploy preparation preserves new resources and
credentials. A failed Argo health gate leaves installation pending.

GitLab chart 10.4.2 and its 19.4.2 images are pinned by SHA-256. Render checks
reject upstream Gateway API/cluster-resource installation and unreviewed images.
Shared PostgreSQL checks require the version 18 data directory on its persistent
root mount. Waldur seed restore and capture use the PostgreSQL 18.6 client.

## Live acceptance

On `dev-vasilis-1`, ordinary `make deploy` converted the intermediate shared
PostgreSQL 17 installation to PostgreSQL 18.6 and GitLab 19.4.2. Qualification
deliberately stopped the delivery container after the `cleaning` checkpoint was
written. The next ordinary deploy resumed the recorded operation. A subsequent
retry during `installing` retained the newly created providers and credentials.

The completed deployment at `e37c67efd` passed:

- All nine Argo Applications Synced, Healthy and Succeeded at that commit;
  storage and every configured route probe passed, and maintenance cleared.
- One physical PostgreSQL server and RabbitMQ broker, separate consumer
  databases/vhosts, and the four intended Redis/Valkey workloads.
- Waldur seed restoration with the PostgreSQL 18 client.
- Zero root-owned entries in the shared private state and SSH delivery runner.
- API-to-Beto Project queries through the shared broker.
- Both Account Consoles, the identity exchange/offline-refresh contract and
  staging-like baseline restrictions.
- Git/LFS through the retained Themelio origin: checksum restoration, authorised
  branch pushes, protected-branch rejection and outsider/anonymous rejection.
- A repeated setup through the native macOS app, ending at its success screen.
  All six volume UIDs, five object-bucket UIDs and 63 Secret UIDs/content hashes
  were unchanged. An isolated database row survived; its test schema was removed
  afterwards.

The exact-revision Argo gate exposed an unchanged child whose successful operation
still named an older commit. The delivery waiter now requests one Argo operation
when that child's desired and compared revisions match the delivered commit.
This preserves root sync-wave ordering and leaves all resource writes with Argo.

The final reset and takeover acceptance at `34bbfda39` passed:

- Reviewed reset/reinstall through the native macOS app. The six application
  namespaces, six volumes and five object buckets were removed. The Kubernetes
  node, ownership record and public CA were preserved. Fresh seed restoration,
  storage, routes, both Account Consoles and identity/baseline probes passed.
- A foreign pod was denied direct provider/backend access, including the shared
  PostgreSQL, Valkey and RabbitMQ endpoints. Forged forwarding headers did not
  permit management access. Public issuer and Waldur access remained available.
- Colima takeover of all seven services, repeated preparation and reload,
  frontend HMR, browser sign-in, catalogue, logout/session replay, connection-loss
  shutdown, reconnection and hand-back. API-to-Beto Project queries passed while
  both services ran locally; GitLab and Waldur sign-in passed during takeover.
- After hand-back, all nine Argo Applications were Synced, Healthy and Succeeded
  at the tested commit. Maintenance and takeover leases were clear, and both
  private state locations contained zero root-owned entries.

Evidence is private under `.local/pg18-*.log` and `.local/pharos-dx/`, including
`pg18-first-ready.json`, `preservation-result.json`, `pg18-reset-ready.json`,
`pg18-final-audit.json` and `pg18-colima-takeover.log`. GitHub installer builds for
macOS, Windows and Linux also passed at `34bbfda39`.

## Main integration and app deployment, 16 October 2026

After PR 696 merged into main, `d29a9f9c0` integrated Python Themelio, newer Beto
messaging, Pipeline Coordination and Waldur logout with the DX layout. Full
`pnpm verify`, generated-contract checks, required CI and all three desktop
installer builds passed. Ordinary `make reconcile` delivered that commit to
`dev-vasilis-1`; all nine Argo Applications completed healthy at that revision.

The native macOS **Compatibility → Deploy this commit** flow then delivered
`bbd566f35`. The app reviewed the source revision, target and SSH alias, streamed
image and Argo stages, displayed completion and refreshed compatibility. The
final audit confirmed the same node and ownership identity, clear maintenance
and takeover leases, all nine applications healthy at the reviewed revision,
and zero root-owned entries in either private-state location.

API-to-Beto Project queries, identity/offline-refresh and baseline restrictions,
both Account Consoles and registered/unregistered Waldur logout redirects passed
on the integrated deployment. A foreign-pod probe again confirmed provider and
management isolation. The new Python Themelio handler also passed a separate
Colima startup, two-reload, authenticated-diagnostics and graceful-stop check.

Evidence is private in `.local/final-main-*.log` and
`.local/pharos-dx/final-main-{d29,bbd}-audit.json`. The current PR's validation
section records subsequent takeover qualification and installer results.

The final integrated Colima run against `bbd566f35` passed for all seven services,
including Python Themelio: repeated preparation and source reload, both frontend
HMR connections, authenticated browser flows, deliberate connection-loss shutdown,
reconnection and hand-back. API-to-Beto queries and GitLab/Waldur sign-in also
passed while the services ran locally. The native app subsequently deployed
`2b060a247`, with all nine applications healthy, unchanged node/owner identity,
clear leases and maintenance, and zero root-owned private-state entries. Required
CI and macOS, Windows and Linux installer builds passed at that commit.

Desktop follow-ups passed full `pnpm verify`, 36 light/dark UI runs, Rust checks
and a native macOS build. The native Settings page shows the macOS checkout path
without WSL controls; the Windows and Linux variants have browser regression
coverage. Unchanged-delivery regressions cover input fingerprints, changed
ownership, application health and preservation of the actual deployed revision.
Live timing and unchanged-pod/Argo-operation evidence for that shortcut are
recorded in the PR's validation section.

The tested conversion baseline was the intermediate shared PostgreSQL 17 layout.
Conversion from the earlier per-service layout has regression coverage and still
needs its own live fixture.

One Linux-only state test is skipped on macOS; the ownership contribution has
separate real Linux evidence. Native Windows/Linux interaction, a fresh VM,
Minikube, reboot recovery, manual UAT and staging/production deployment are outside
this record.