Repository navigation
Conversation
The cited compatibility assertion compares stored item objects in memory. Name that scope beside the byte-preservation claim so readers do not infer an AWS persistence guarantee. Refs #1604.
Contributor
Pre-merge checks:
  |
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Title check |  |
This assessment has not completed. The check will be retried on the next pre-merge check run. |
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled.
|
7 tasks done
…als self-contained The first real guide-only Runs (Claude Sonnet, isolated Migration Harness) found two gaps on the PostgreSQL path. Step 3 handed the conversion to e2e/migration-guide/postgres.ts, which a reader of the guide alone does not have, so the agent rebuilt it from the prose list. The guide never showed how to pass credentials to Encryption explicitly, so the agent read the package typings. Step 3 now carries the core of the tested conversion script and says to run it as a one-off script in the maintenance window, not at application startup (the agent had put DDL in createApp). Both step 2s show Encryption's `config` with the four credential fields. Links into this repository are now absolute GitHub URLs, so they resolve from the published guide. Refs #1603 Refs #1604
…onversion script The in-guide conversion script decrypted the source with a Protect 10.2.1 client, but PostgreSQL step 2 had just uninstalled Protect. A real Claude Migrator recorded this as actionable friction and decrypted the v2 envelopes with Stack instead, a path no suite tested. A new credentialed test in protect-postgres-upgrade proves Stack 1.x decrypts every Protect-written v2 envelope read from the eql_v2_encrypted columns to the same plaintext as Protect. The guide's script now decrypts the source with client.decrypt in both the validate and verify steps and cites that test. The executable example still cross-checks with the preserved Protect build, which the guide says. Refs #1603
tobyhede
changed the title
This was referenced Nov 12, 2026
tobyhede
added a commit
to cipherstash/docs
that referenced
this pull request
Nov 12, 2026
Pin the customer page to the source revision that includes dependency checks directly and explains safe refusal on repeated conversion. Keep the added customer rehearsal checklist separate from the verified procedure. Refs cipherstash/stack#1620.
1 of 6 tasks
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Make the Protect-to-Stack migration guide actionable when credentials are supplied explicitly and when the PostgreSQL application has already removed Protect. The guide now includes the PostgreSQL conversion core using Stack to decrypt the existing v2 source, backed by a live regression test against real Protect-written rows.
Changes
Encryptionconfiguration.Verification
Fresh independently audited guide-only runs used source guide SHA-256
46106cc0a71dbeb757bcb0b3889c6fc5741bac201afe807ed8cde0a035d3d649and harness5261d3a5c0ae6a4750a7a1102d08436a1d314725:claude-sonnet-5-5on the existing Colima Linux host, outside CI.Latest guide-only update at
0ecabc3f62ee8a117c467981ce00d312e6cfc636:git diff --checkpassed.checkDependencies(tx, false): it preserves incoming foreign-key, PostgreSQL 18 primary-key NOT NULL, source-column NOT NULL, view, trigger, policy, RLS and inheritance checks. Initial conversion rejects every non-primary index.G. The edit itself changed only guide prose and the inline example; subsequent live guide-only verification is recorded above.Prior executable regression evidence at
8fb583930bebd79c27a785a463dcf416a6bf1889:Related
Refs #1604, #1603, #1540.
Review notes
The PostgreSQL snippet is the conversion core, not a general production backfill runner: follow the linked complete example's dependency preflight and the guide's supported mappings and rollback boundary. The guide targets Stack 1.2.1 and EQL v3, not EQL v4. Docs-site publication and customer-specific staging rehearsal remain outstanding.