Verify the Postgres v2-to-v3 guide through real harness Runs #1605

Parent

#1540

What to build

Extend the existing Migration Harness with a Postgres-v2 Fixture App starting state and a verified Reference Migration derived from the tested guide. The same external Run Report contract must distinguish a correct Postgres upgrade from an incomplete or corrupt one while preserving the existing DynamoDB baseline. Follow the priority amendment in ADR PR #1575.

Acceptance criteria

• Both Store Sets are independently seeded with actual Protect-written EQL v2 columns before a Postgres Run. The Run Manifest identifies the store procedure, source/target EQL generations, exact Stack source and guide hash.
• The migrated application's database conversion executes through the restricted App Host against Oracle Stores; it cannot read harness assertions or snapshots. Migrator Stores remain independent.
• The Reference Migration passes behaviour, retained-byte and migration-completeness checks for every supported Postgres mapping, including fresh writes and required indexes.
• No-op, row-loss, incorrect column/query mapping, missing required index and unexpected ciphertext rewrite Broken Migrations each fail an explicitly named Oracle check visible in the Run Report.
• Permitted envelope/schema changes are distinguished from unexpected ciphertext/search-term changes using the guide's proven conversion contract. Blanket byte equality of whole v2/v3 envelopes is not required.
• Existing DynamoDB Reference Migration and Broken Migration cases continue to pass their expected outcomes; isolation and outcome precedence remain unchanged.
• Deterministic live self-tests pass in CI with no model invocation. The extended Run seam is available to Migration harness: real Migrator (headless, isolated, Friction Log) #1537–Migration harness: loop with stop condition #1539 for both guide procedures.

Blocked by

• Deliver a tested Protect/EQL v2 to Stack/EQL v3 Postgres procedure #1603 — supplies the proven Postgres procedure and example.
• Migration harness: Reference Migration, static layer and selftest #1536 — supplies the complete Oracle and Reference Migration self-test baseline, transitively including Migration harness: Run skeleton and behaviour checks on Legacy Data #1534 and Migration harness: Oracle no-rewrite layer #1535.

Delivery status — 2026-11-12

The PostgreSQL procedure and review repairs are implemented in #1614 at 8fa8a9714439cbe8275cd9771531025a23c40155. Both same-head Test JS runs passed: 43127027541 and 43127027664. Both Migration harness/isolation workflows passed as well.

The inspected E2E logs each show 217 harness tests passed, zero skipped, including all 21 live cases:

• Eight PostgreSQL cases: reference, no-op, row loss, continued v2 fresh writes, wrong mapping, missing index, ciphertext rewrite and missing friction log.
• Eleven DynamoDB/reference/broken migration cases, including application and lifecycle isolation denial.
• Two no-rewrite cases: Legacy Data remains unchanged through mutations, and a read rewrite is detected.

Each run also passed 40 Protect-DynamoDB compatibility tests, 22 cross-store tests and nine PostgreSQL 18 guide tests. The separate standard E2E suite passed 108 and skipped 16 authentication-gated cases (seven Prisma README walkthrough and nine wizard package-manager prerequisites); no migration suite cases were skipped.

Two earlier CI failures exposed reproducible supervisor defects: late fork results could resurrect exited children, and a successful getsockopt call returning a nonzero SO_ERROR could look like successful forbidden network access. Signed repairs cb79bbddd and 987fb75a4 are included in this head. Regression coverage preserves PID reuse and fail-closed handling of malformed continuations and zero/unknown socket errors. All 25 supervisor tests pass. The exact historical syscall arguments/order were not retained, so the replay proves the defects without claiming to reconstruct either failed run.

Local combined adapter verification passed 213 lightweight tests with 21 credentialed tests skipped locally; both typechecks and scoped lint passed. No local Docker or model calls were made for these supervisor repairs.

Keep this issue open pending integration. #1576 requires an approving reviewer; no merge bypass is used. Fresh model guide-only evidence belongs to #1537, and customer staging rehearsal is separate from this deterministic fixture matrix. Customer publication is prepared in draft cipherstash/docs#118, not deployed.