docs(kbn): freeze KBN-101 database role split contract #774

jason.woltje · 2026-07-15T13:27:24Z

jason.woltje commented

2026-07-15 13:27:24 +00:00

Summary

Freezes KBN-101 rc.16: the fail-closed PostgreSQL migration-owner/runtime-role split required before KBN-100 can certify deployed immutable-table privileges.

Parent tracking: #771 remains open for implementation cards KBN-101-00 through KBN-101-09; this planning PR does not close the parent.

Contract

DATABASE_URL is runtime non-owner only.
DATABASE_MIGRATION_URL is migrator-only through the sole mosaic-db-migrator control plane.
Exact manifest/0009 reconciliation, fixed advisory lock, schema readiness, PostgreSQL role/pgvector ownership, public→mosaic relocation, verified TLS, Vault/attestation materials, N-1/rollback and atomic activation are frozen.
Complete disjoint one-card/one-PR implementation manifest and KBN-100/KBN-105 serial gates are defined.
Current unsafe documentation routes are explicitly held/non-operative; this PR performs no source, migration, secret, deployment, CI, database or live mutation.

Verification

Independent exact-head rereview: APPROVE at 8a13286e.
Ultron exact-head reverification: GO at 8a13286e.
Full 106-document authority scan: PASS.
Prettier, links, Native Kanban contract TypeScript, diff, manifest-overlap and source-consistency checks: PASS.
Branch rebased on current main (bc5e736); final head 8a13286ea6f4fa44ec508274b966d1501df5ced2.

Holds

No KBN-100 continuation, KBN-105, production role activation, database migration, Vault mutation, deployment or live authority follows until the declared implementation and certification gates pass.

## Summary Freezes KBN-101 rc.16: the fail-closed PostgreSQL migration-owner/runtime-role split required before KBN-100 can certify deployed immutable-table privileges. Parent tracking: #771 remains open for implementation cards KBN-101-00 through KBN-101-09; this planning PR does **not** close the parent. ## Contract - `DATABASE_URL` is runtime non-owner only. - `DATABASE_MIGRATION_URL` is migrator-only through the sole `mosaic-db-migrator` control plane. - Exact manifest/0009 reconciliation, fixed advisory lock, schema readiness, PostgreSQL role/pgvector ownership, public→mosaic relocation, verified TLS, Vault/attestation materials, N-1/rollback and atomic activation are frozen. - Complete disjoint one-card/one-PR implementation manifest and KBN-100/KBN-105 serial gates are defined. - Current unsafe documentation routes are explicitly held/non-operative; this PR performs no source, migration, secret, deployment, CI, database or live mutation. ## Verification - Independent exact-head rereview: APPROVE at `8a13286e`. - Ultron exact-head reverification: GO at `8a13286e`. - Full 106-document authority scan: PASS. - Prettier, links, Native Kanban contract TypeScript, diff, manifest-overlap and source-consistency checks: PASS. - Branch rebased on current `main` (`bc5e736`); final head `8a13286ea6f4fa44ec508274b966d1501df5ced2`. ## Holds No KBN-100 continuation, KBN-105, production role activation, database migration, Vault mutation, deployment or live authority follows until the declared implementation and certification gates pass.

jason.woltje added 20 commits 2026-07-15 13:27:24 +00:00

docs(#771 ): freeze database runtime role split d1b657d2b6

docs(#771 ): record role-split review evidence 4d9f99f76e

docs(#771 ): remediate database role split review 315f388f4f

docs(#771 ): close role split residuals 256f9f6222

docs(#771 ): close role split rc.8 residuals dad1179fc7

docs(#771 ): record rc.8 delivery evidence 7efe2e29bd

docs(#771 ): close role split rc.9 residuals cb50965ce1

docs(#771 ): record rc.9 delivery evidence 1f66793d63

docs(#771 ): remediate Ultron role and migration findings fcb73352ed

docs(#771 ): bind tier importer to verified target b1a4ef5ce7

docs(#771 ): record attestation remediation delivery 87bbb222f6