docs(wish): pgserve-singleton-no-proxy v2.3 — kill proxy + cosign + self-healing#72
Conversation
…ealing v2.3 Major architectural cutover: kill the bun bridge from the data plane; postgres backend listens directly on Unix socket ($XDG_RUNTIME_DIR/pgserve/.s.PGSQL.5432) AND TCP 5432, no proxy. Replace always-on bun daemon with on-demand CLI verbs (provision, verify, gc, trust, doctor). Add cosign-keyless-OIDC publisher attestation as Tier 2 on top of host_signed (Tier 1) and path-based default (Tier 0). Hardcoded blocklist of known-bad versions. Self-healing pgserve update auto-migrates old layout, restarts pm2, runs doctor --fix tiered. Companion wishes (paired, byte-identical SHARED-DESIGN.md): - automagik-dev/genie#pgserve-singleton-no-proxy - automagik/omni#pgserve-singleton-no-proxy Version target: pgserve 2.3 (3.0 reserved for post-npm-departure cutover). 9 execution groups, 4 waves, ~3-4 weeks appetite.
|
Warning Rate limit exceeded
To continue reviewing without waiting, purchase usage credits in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughTwo new design documents for pgserve v2.3: SHARED-DESIGN.md details the architectural shift from bun proxy to dual-transport (Unix socket and TCP), new CLI verbs, cosign-based verification, self-healing updates, and cross-CLI migration strategy. WISH.md frames the scope, execution waves, acceptance criteria, and rollout plan for the initiative. Changespgserve Singleton No-Proxy Design
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related issues
Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Code Review
This pull request introduces a new design and implementation plan for pgserve v2.3.0, transitioning to a singleton architecture that replaces the Bun-based proxy with native PostgreSQL transports and an on-demand CLI. The reviewer provided several technical corrections: the attestation cache should use content hashes instead of modification times for security, redundant database grants should be removed, function privileges must be corrected from USAGE to EXECUTE, and peer authentication mappings should use system usernames instead of numeric UIDs to function correctly.
I am having trouble creating individual review comments. Click here to see my feedback.
.genie/wishes/pgserve-singleton-no-proxy/SHARED-DESIGN.md (72)
Using only the binary's mtime for cache invalidation is potentially unreliable as timestamps can be manipulated or preserved during file operations (e.g., cp -p). For a security-sensitive attestation cache, it is safer to include a content hash (e.g., SHA-256) of the binary in the verification logic. This ensures the cache is correctly invalidated if the binary is replaced, even if the mtime remains the same.
.genie/wishes/pgserve-singleton-no-proxy/SHARED-DESIGN.md (186)
This GRANT is redundant. In PostgreSQL, the owner of a database (assigned in line 185) automatically possesses all privileges on that database. Explicitly granting all privileges to the owner does not change the effective permissions.
.genie/wishes/pgserve-singleton-no-proxy/SHARED-DESIGN.md (187)
In PostgreSQL, the privilege required to run a function is EXECUTE, not USAGE. USAGE is typically used for schemas, sequences, types, and domains.
GRANT EXECUTE ON FUNCTION install_whitelisted_extension(text) TO app_<fp>;
.genie/wishes/pgserve-singleton-no-proxy/SHARED-DESIGN.md (204)
PostgreSQL peer authentication identifies the connecting user by their operating system username. If <uid> refers to the numeric User ID, the mapping in pg_ident.conf will fail to match the system user name provided by the kernel during authentication. Ensure the mapping uses the system username as the map key.
.genie/wishes/pgserve-singleton-no-proxy/WISH.md (39)
Relying solely on mtime for cache invalidation is insecure. It is recommended to use a content hash (e.g., SHA-256) of the binary to ensure the cache is invalidated if the binary content changes, regardless of the timestamp.
.genie/wishes/pgserve-singleton-no-proxy/WISH.md (66)
PostgreSQL peer authentication uses the OS username, not the numeric UID. Ensure pg_ident.conf is populated with usernames to avoid authentication failures when connecting natively to the Postgres backend.
💡 Codex Reviewhttps://github.com/namastexlabs/pgserve/blob/9b8200bb39399d472669e90194afc038a60c191f/.genie/wishes/pgserve-singleton-no-proxy/SHARED-DESIGN.md#L131 Step 6 hardcodes https://github.com/namastexlabs/pgserve/blob/9b8200bb39399d472669e90194afc038a60c191f/.genie/wishes/pgserve-singleton-no-proxy/SHARED-DESIGN.md#L203-L205 The proposed https://github.com/namastexlabs/pgserve/blob/9b8200bb39399d472669e90194afc038a60c191f/.genie/wishes/pgserve-singleton-no-proxy/WISH.md#L345-L347 This execution group requires automatic rollback from snapshot on migration failure, but the shared design’s update contract defines rollback as manual and explicitly forward-only after failure. Keeping both statements creates conflicting implementation targets for parallel agents and can produce inconsistent update behavior across repos; one contract should be removed so all implementations converge on the same failure semantics. ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Applies all gaps from /review (plan-review pipeline): CRITICAL: out-of-trio consumer fallout - Add explicit "BREAKING — accept-downtime" notice to Summary - TCP 8432 dies; brain/rlmx/hapvida-eugenia/email break silently - Intentional for major bump; CHANGELOG warns - New G9 deliverable: consumer-fanout smoke test on canary host HIGH: Wave 2 false parallelism - Re-sequence to G4 (schema) -> G3 (provision) -> G7 (roles) - All three author pgserve provision + share pgserve_meta schema - Sequential, not parallel HIGH: Cosign primitive choice locked - Decision P5: shell out to cosign CLI; vendor sigstore-rs deferred - Single verifier path simplifies test matrix MEDIUM: G8 atomic-rollback overclaim reworded - Now: "best-effort with restore-bridge escape hatch" - Snapshot scope: admin.json + pm2 dump only MEDIUM: G2 validation strengthened - Positive checks: psql connects via canonical socket + TCP 5432 MEDIUM: G9 CI fixture provisioning declared - bunx pm2-runtime + pgserve install --skip-system-units - No sudo required on Linux Blacksmith / macOS LOW: Cat 1/2/3 boundary rule (cross-trio in SHARED-DESIGN.md) - "Cat 1 = reversible within 1 command" - "Cat 2 = data-touching but recoverable" - "Cat 3 = irreversible / destructive" LOW: Operator update order locked (cross-trio) - pgserve update -> genie update -> omni update - Pre-install peer check enforces Doc-only PR. Original lint passed; these are text expansions.
Major architectural cutover. Companion wishes paired with
automagik-dev/genieandautomagik/omni(byte-identical SHARED-DESIGN.md across all three).Summary
Kill the bun bridge from the data plane: postgres backend listens directly on Unix socket (
\$XDG_RUNTIME_DIR/pgserve/.s.PGSQL.5432) AND TCP 5432, no proxy. Replace always-on bun daemon with on-demand CLI verbs (provision,verify,gc,trust,doctor). Add cosign-keyless-OIDC publisher attestation as Tier 2 on top of host_signed (Tier 1) and path-based default (Tier 0). Hardcoded blocklist of known-bad versions. Self-healingpgserve updateauto-migrates old layout, restarts pm2, runsdoctor --fixtiered.Version target: pgserve 2.3 (3.0 reserved for post-npm-departure cutover per
distribution-exodus).Scope
9 execution groups, 4 waves, ~3-4 weeks appetite. See WISH.md + SHARED-DESIGN.md.
Test plan
genie wish lint pgserve-singleton-no-proxycleanCompanion PRs
automagik-dev/genie#pgserve-singleton-no-proxy(consumer-side wiring)automagik/omni#pgserve-singleton-no-proxy(consumer-side wiring)🤖 Generated with Claude Code
Summary by CodeRabbit