Authoritative Postgres houses and reversible identity migration #646

Merged

toasterson merged 6 commits from feat/akh-houses into main 2026-10-15 14:04:34 +00:00

Conversation 0 Commits 6 Files changed 26 +1036 -12

toasterson commented 2026-10-15 10:15:19 +00:00

Owner

Copy link

Full native and Roman houses currently keep authoritative state in per-Akh SQLite. Prepare an offline, verified move into shared Postgres, with normal ADR 049 hydration/residency fencing and explicit refusal to start without complete authoritative state.

• Import identities, cognitive snapshots, goals, episodes, portable provenance and WAL atomically per house; preserve epochs and remap global sequences/typed references. Verify all cognitive rows by normalized hashes and reject existing target state. Historical missing turn references remain missing.
• Back up stopped houses, prepare Mac Postgres config candidates, and move core/event idempotency records into house-private Postgres schemas. Nothing changes installed Mac configuration or starts a house.
• Add reversible registry retirement guarded by normal residency locking; no identity is retired or renamed here. Publish core-service image provenance in the image-set for the cluster house.

Validation: cargo check (server/akhomed), cargo fmt, storage crate 44 passed (9 opt-in skipped), fail-closed authoritative-house regression, migration/identity-fold unit tests 11 passed, image publisher 36 passed. Isolated PostgreSQL 17 with the actual migrations accepted all 13 copied identities / 220,394 cognitive rows and 22,639 service records with complete hashes and duplicate refusal. All 13 copied Akhs passed the actual fenced cluster-cache→Mac-cache→cluster-cache hydration test (1,297.31s): equal triple/symbol counts, simultaneous owner refusal and epoch+3 verified. Quiescent retained-WAL backup and generated retirement/rollback SQL also passed disposable fixtures. Mac config candidate rendering passed; current LAN DNS prerequisite is emitted as an uninstalled hosts fragment.

Ready for review; leave unmerged. Production migration, main image publication, exact-model/tool/ritual/restart acceptance and live cross-house test are separate gates. Talos #208 contains DESIGN.md, registry evidence and stopped deployment; stacked #209 carries gated routing/proxy retirement. Exact-head CI is green at ec6a56d1: all 14 checks passed in run 4268. The source PR is ready and mergeable, still unmerged. No Board calls or live binding changes. PR #645 remains valuable with direct ClusterIP HTTP endpoints; its armini inference_cutover.py workflow is cancelled, not executed.

Operator decision update: add a default-dry-run, two-pair identity merger for
thoth-mac→thoth and gemma-mac→gemma. It preserves destination UUID/psyche,
remaps symbols and portable provenance, folds original WAL sequences with
reversible preimages, retains duplicate origins and source snapshots, and retires
source rows. It fails closed on unsnapshotted tails or unsupported nested goal
structures. Transactional merge/rollback passed isolated Postgres fixtures;
production dry runs correctly block pending final snapshots.

CI correction: the core-integration test's CoreConfig literal omitted the new
postgres_schema field. Added None and ran the exact full session-platform feature
combination successfully locally. The exact-head remote run 4268 also passed all 14 checks, including the previously failing session-platform job.

An opt-in isolated cold-wake sizing probe measured Ptah's production snapshot at
323.3s / 608Mi maximum RSS on Mac ARM64, without provider calls or daemon work.
The Talos proposal isolates it at 1536Mi request / 3Gi limit with a 30-minute
startup window. Operator selected astra-impl-4 / gpt-6.1-sol, a separate Ptah
principal, and capacity shared with Apollo. No production state has been changed.

Full native and Roman houses currently keep authoritative state in per-Akh SQLite. Prepare an offline, verified move into shared Postgres, with normal ADR 049 hydration/residency fencing and explicit refusal to start without complete authoritative state. - Import identities, cognitive snapshots, goals, episodes, portable provenance and WAL atomically per house; preserve epochs and remap global sequences/typed references. Verify all cognitive rows by normalized hashes and reject existing target state. Historical missing turn references remain missing. - Back up stopped houses, prepare Mac Postgres config candidates, and move core/event idempotency records into house-private Postgres schemas. Nothing changes installed Mac configuration or starts a house. - Add reversible registry retirement guarded by normal residency locking; no identity is retired or renamed here. Publish core-service image provenance in the image-set for the cluster house. Validation: cargo check (server/akhomed), cargo fmt, storage crate 44 passed (9 opt-in skipped), fail-closed authoritative-house regression, migration/identity-fold unit tests 11 passed, image publisher 36 passed. Isolated PostgreSQL 17 with the actual migrations accepted all 13 copied identities / 220,394 cognitive rows and 22,639 service records with complete hashes and duplicate refusal. All 13 copied Akhs passed the actual fenced cluster-cache→Mac-cache→cluster-cache hydration test (1,297.31s): equal triple/symbol counts, simultaneous owner refusal and epoch+3 verified. Quiescent retained-WAL backup and generated retirement/rollback SQL also passed disposable fixtures. Mac config candidate rendering passed; current LAN DNS prerequisite is emitted as an uninstalled hosts fragment. **Ready for review; leave unmerged.** Production migration, main image publication, exact-model/tool/ritual/restart acceptance and live cross-house test are separate gates. Talos [#208](https://github.com/Toasterson/talos/pull/208) contains DESIGN.md, registry evidence and stopped deployment; stacked [#209](https://github.com/Toasterson/talos/pull/209) carries gated routing/proxy retirement. Exact-head CI is green at ec6a56d1: all 14 checks passed in run 4268. The source PR is ready and mergeable, still unmerged. No Board calls or live binding changes. PR #645 remains valuable with direct ClusterIP HTTP endpoints; its armini inference_cutover.py workflow is cancelled, not executed. Operator decision update: add a default-dry-run, two-pair identity merger for thoth-mac→thoth and gemma-mac→gemma. It preserves destination UUID/psyche, remaps symbols and portable provenance, folds original WAL sequences with reversible preimages, retains duplicate origins and source snapshots, and retires source rows. It fails closed on unsnapshotted tails or unsupported nested goal structures. Transactional merge/rollback passed isolated Postgres fixtures; production dry runs correctly block pending final snapshots. CI correction: the core-integration test's CoreConfig literal omitted the new postgres_schema field. Added None and ran the exact full session-platform feature combination successfully locally. The exact-head remote run 4268 also passed all 14 checks, including the previously failing session-platform job. An opt-in isolated cold-wake sizing probe measured Ptah's production snapshot at 323.3s / 608Mi maximum RSS on Mac ARM64, without provider calls or daemon work. The Talos proposal isolates it at 1536Mi request / 3Gi limit with a 30-minute startup window. Operator selected astra-impl-4 / gpt-6.1-sol, a separate Ptah principal, and capacity shared with Apollo. No production state has been changed.

toasterson added 1 commit 2026-10-15 10:15:20 +00:00

Prepare authoritative Postgres houses and verified offline state imports 88e078269e

toasterson added 1 commit 2026-10-15 10:20:54 +00:00

Constrain operator import commands to the akhomed database 15dfa9bfc3

toasterson added 1 commit 2026-10-15 10:25:26 +00:00

Prepare explicit Mac LAN name resolution prerequisite 5c02246399

toasterson added 1 commit 2026-10-15 12:58:28 +00:00

Fix CoreConfig fixture in platform integration feature tests 14f7725a24

toasterson added 1 commit 2026-10-15 13:03:22 +00:00

Add isolated single-house cold-wake sizing probe d39f93ca65

toasterson added 1 commit 2026-10-15 13:17:16 +00:00

Prepare reversible provenance-preserving registry identity folds ec6a56d1da

toasterson changed title from WIP: Authoritative Postgres houses and verified offline state migration to Authoritative Postgres houses and reversible identity migration 2026-10-15 13:29:39 +00:00

toasterson merged commit 6505dd2c6f into main 2026-10-15 14:04:34 +00:00

toasterson referenced this pull request from a commit 2026-10-15 14:04:37 +00:00

Authoritative Postgres houses and reversible identity migration (#646)

toasterson deleted branch feat/akh-houses 2026-10-15 14:04:38 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

follow-up

Documented operational follow-up

No labels

follow-up

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

toasterson/akh-medu!646

No description provided.