Repository navigation
Fleet-wide 14-extension manual-only formal publication: migration parity and acceptance #61
Description
Important
Current acceptance basis (2026-10-12 JST): The original 2026-10-11 exploratory acceptance list below is preserved as historical context. It is superseded where it proposed autonomous candidate merge / Catalog auto-merge by the merged Chat-first minimal publication policy. The target is explicit human ChatGPT-instructed Release PUBLISH; Catalog App PR proposal and manual Chat PR merge; no second human approval or unattended release.
Fleet migration + first live E2E: ACCEPTED. 14/14 central & local watch/candidate/manual promotion configuration, latest-main Windows CI and watcher scheduling were rechecked. Real signed wal2json 2.7 Release -> Catalog App PR #54 -> Website EN/JA public smoke 38249404653 passed; see first E2E audit.
Single remaining closure condition: 13/14 extension main branches currently report protected:false; ensure CI-success-required PR protection without a mandatory outside reviewer, or produce evidence of equivalent effective protection. Do this via narrow authenticated GitHub admin UI; do not bypass CI or interfere with upcoming PG14 EOL matrix changes. See final fleet-wide branch-protection audit. Keep issue OPEN until independently verified; no new Release/feature work is needed to resolve this item.
Decision (2026-10-11 JST)
Adopt automatic upstream watch → immutable candidate preparation → Windows matrix and independent artifact verification → one deliberate manual formal Release confirmation → automatically validated Catalog/Website propagation for the whole pgextwin fleet. Human/independent reviewer approval per candidate is not required by product policy; integrity and required CI are mandatory. No automatic formal Release under any circumstance. This is an investigation and migration-preparation issue; creating this issue does not authorize release, merge, permission or live-workflow mutations.
Verified live scope
18 organization repositories: 14 extension repositories + build, catalog, website, .github. All 14 have config/extension.json targeting PG14–18 and at least one publicly published, non-draft GitHub Release (16 assets per latest Release at inspection). Catalog already contains all 14 JSON records. Preserve existing published assets/tags and installed user links.
| Extension(s) | Fleet central policy | Local watch / candidate policy | Formal release path | Change needed |
|---|---|---|---|---|
| pg_bigm, pg_cron, pg_hint_plan, pgaudit, set_user, pg_repack, pg_ivm, pg_qualstats | BUILD/manual-only (8 entries) | present; SHA-pinned auto-candidate draft + Windows dispatch |
release/* attested build + publishing job |
Retire bypass and add shared manual main-only publish gate |
| plpgsql_check | BUILD/manual-only | present | promote.yml main-only confirm_release=PUBLISH; central allowlist currently only this repo |
Generalize without weakening exact candidate/major/hash/attestation gates |
| hypopg, wal2json, pg_partman, pg_stat_monitor, orafce | not registered (5 entries missing) | no update-watch.yml, config/update-watch.json, or config/candidate-build.json |
release/* attested build + publishing job |
Install validated watch/candidate and same publish gate |
Non-negotiable behavior
- Maintain UTC 00:00 daily scheduling (09:00 JST; GitHub cron can start late). Support no-op when no stable upstream changes, and stable release-specific watch patterns for all 14. Existing PG14 support continues only while maintained according to
metadata/postgresql.json; never promise unsupported majors. - Central fleet
metadata/automation-fleet.jsonand local candidate policies must agree; migrate the five new repositories local files and CI first, and update central fleet last, to avoid central-enabled-but-unprepared repos. Add mismatch/fail-closed tests and fleet metrics for 14/14. - Candidate identity: immutable upstream commit/full SHA, upstream tag/version per PG major where applicable, automation-owned branch, source/license/security review and Windows runtime Test Contract. Validate all applicable major ZIPs, PACKAGE-INFO, SPDX 2.3, Grype reports, GitHub build provenance and SBOM attestations. Grype remains report-only, so a passing report must not be presented as vulnerability safety clearance.
- Investigate making candidate transition automatic after independently verified exact-head CI/audit (or using immutable evidence without a merged PR), so the only routine manual action is formal Release confirmation. Keep source or ABI-affecting exceptional candidates quarantined; never bypass branch protection or security checks.
- Expose one reused, fail-closed, main-only
workflow_dispatchpublication operation per extension withconfirm_release=PUBLISH, target release tag, immutable candidate decision/run/PR reference, strict actor check, fresh main identity, exact PG matrix, create-only tag semantics, source-specific release preflight and post-publish verification. No independent human review / approval PR / second authorization is required. - Remove
release/*publisher job invocations from all 13 legacywindows.ymlbefore enabling new gate. A manual branch dispatch without explicit PUBLISH must never publish. Consider a central manual-publish policy switch separate from the existingunattended-publication.jsondefault-DENY/OBSERVE. The latter must NOT be flipped to UNATTENDED. - After confirmed public Release, independent Catalog verification may automatically propose and scoped auto-merge only the verified generated distribution record, then Website may publish/verify automatically.
catalogPR Step 10: disable Grype built-in kernel-header suppression #21 cannot currently be enabled as-is: its auto-merge guard demands central UNATTENDED AND automaticFormalRelease=true; refactor these so manual formal release with independently signed/public receipt permits downstream sync while auto formal release stays prohibited. Keep unrelated PR/Dependabot auto-merge forbidden. Expand beyond pilot plpgsql_check only with exact allowlists/tests. Prefer narrow short-lived App token and existing branch protection. - Release-state machine:
NO_UPDATE,DETECTED,CANDIDATE_BUILDING,VERIFIED,BLOCKED,AWAITING_MANUAL_PUBLISH,PUBLISHING,PUBLISHED,CATALOG_SYNC_PENDING,WEBSITE_VERIFIED; guard duplicate tag/run, stale SHA, upstream tag movement, replays and interrupted partial drafts. Idempotent downstream reconcile and incident/status reporting. - Do not modify historic Releases, retag, delete assets, weaken rulesets, publish pending candidates, or claim CI
queued/in_progress/action_requiredsuccess.
Evidence and current blockers
- Central 9-entry fleet: https://github.com/pgextwin/build/blob/main/metadata/automation-fleet.json
- Plpgsql manual promotion and allowlist: https://github.com/pgextwin/plpgsql_check/blob/main/.github/workflows/promote.yml and https://github.com/pgextwin/build/blob/main/metadata/release-promotion.json
- Eight Step 23 acceptance tracking: Step 23 acceptance: nine BUILD candidate dry-runs and safe manual release path #47 (must retain or reconcile, not conflate).
- Old unattended admin plan: Step 22: one-time GitHub admin acceptance and unattended publication rollout gates #44 (objective superseded by manual-only formal publication; do not turn UNATTENDED on).
- Catalog auto merge pilot PR: Step 22: scoped opt-in automatic merge of independently verified Catalog Release PRs catalog#21 (open, default disabled, incompatible central gate until refactored).
plpgsql_checkv2.10.14 has an open export-audit source pin fix: fix: revalidate v2.10.14 SQL/C Windows DLL exports and pin source-specific audit plpgsql_check#21 . Latest main Windows failure documented in this PR. Do not publish 2.10.14 until new main release gate succeeds.wal2jsonupstream latest stable 2.7 published 2026-10-09 versus current local 2.6: https://github.com/eulerto/wal2json/releases/tag/wal2json_2_7 . Use as real stable-candidate pilot after independent compatibility checks.
Migration sequence / acceptance
- A. Extend registry schemas, cross-repository 14-extension parity/audit tests, handoff and status reporting. Read-only findings first.
- B. Install new extension watchers, tag strategies, candidate policies and verifier in the five new repos, safely and independently. Run real dry-run detection plus maintained-PG Windows regression.
- C. Prepare shared manual promotion gate, make 13 caller workflows remove legacy publisher and add explicit PUBLISH dispatch, with exact full-SHA pin upgrades and release tests; validate no accidental release from release/*, PR, push or scheduled watch.
- D. Prove exact-head candidate lifecycle, quarantined failure paths and optional automatic verified candidate merge (no human requirement). Keep formal publish manual.
- E. Refactor Catalog PR Step 10: disable Grype built-in kernel-header suppression #21 to allow auto downstream merge ONLY after deliberate manual formal Release with newly verified signed public assets. Complete Website public audit and incident recovery; keep central unattended mode OBSERVE/DENY.
- F. After local CI and fail-closed configuration checks all pass, merge central 14-entry BUILD fleet policy last. Check daily watch decisions and fresh candidate artifacts for every eligible extension.
- G. Conduct at least one real end-to-end test of a new stable candidate to verified candidate and manually confirmed Release to Catalog and Website, then check all 14 have consistent operational controls. Do not treat a planned design or passing dry-run as end-to-end proof.
Out of scope for this preparation issue: initiating Releases; rewriting existing Releases; unreviewed merges or branch-protection changes; switching on fully unattended formal publication.
Activity
ShutenOishi commentedon Oct 11, 2026
2026-10-11 rollout progress — staged 14-extension manual Release pipeline
Shared safety layer merged with required Build CI SUCCESS:
2e36e655c419daa1ac56a23274e19e6279594f99: 14 authoritative fleet members; original 9 retain BUILD and new 5 (hypopg,wal2json,pg_partman,pg_stat_monitor,orafce) are OFF / candidateEnabled=false. Both the original fleet and unattended-publication code and regression fixtures now reject premature five-member activation. Build CI SUCCESS 38138996807 and main follow-up 38139363420.21252863d89ea09f8147d670157e7a07cfba19e0: validated 14 source/release naming conventions, per-PG SHA identities for pgaudit/pg_hint_plan, dated pg_bigm tag, maintained-PG lifecycle (PG14 EOL), and fail-closed manual candidate/watch receipt with central/local allowlist and operator PUBLISH. Required CI SUCCESS 38139313923.455f0ccc667697f600700a6e64bcfd6c57b6a977: all-14 shared attested publisher with immutable receipt, per-PG source/PACKAGE-INFO, exact ZIP/SPDX/Grype matrix and GitHub attestation checks, CREATE-ONLY Git tag, immutable numeric draft Release ID and 16 SHA256 (or 3N+1 after PG14 EOL), guarded public Release download rehash. CI SUCCESS 38140571897.13 extension-specific staging PRs created, latest-head Windows CI still running/pending; do not claim merged:
All 13 stage-local PRs now include: (1) removal of old
release/*automatic formal publisher, (2) localconfig/release-promotion.jsonmanual gate, (3) newpromote.ymlwith main-only operatorworkflow_dispatch/confirm_release=PUBLISH, immutable common build commit455f0ccc667697f600700a6e64bcfd6c57b6a977, fresh PG14–18 attested build, full release/recovery state guard. New five additionally have stable-only watch pattern, UTC 00:00 schedule, dry-run default and centrally gated bot candidate preparation + candidate audit.Current guarded state: central
metadata/release-promotion.json.allowedRepositoriesdeliberately remains plpgsql_check ONLY and new five remain centrally OFF. Do not enable the 13 to issue formal Releases until each exact-head CI passes, candidate/metadata source pins verified, and central policy is updated after controlled rollout. Historical published Releases/tags and Website Catalog remain unchanged. The latest-head Windows checks for the 13 active PRs are queued/pending at this checkpoint, and early runs with Chocolatey package installation failures are not SUCCESS evidence. Public formal release must stay a deliberate operation; no independent reviewer/approval PR required.Remaining: achieve green full exact-head Windows CI for the 13, merge staged local workflows with central deny state, pin legacy upstream SHAs and validate new candidate flows, expand central allowlist and transition 5 OFF→BUILD only after local contracts, generalize Release→Catalog signed record generator and scoped auto-merge under
manual-onlywithout turningunattended-publication.jsonmode to UNATTENDED, validate website fleet smoke, reconcile Issues #44 and #47. Keep Issue #61 OPEN pending full rollout.ShutenOishi commentedon Oct 11, 2026
2026-10-11 checkpoint — 14-extension manual-only migration
Shared Build PRs #63, #64 and #65 are merged with CI SUCCESS. Current tested common Build SHA: 455f0cc. Central fleet registry has original 9 BUILD plus new 5 OFF. New common source identity, fail-closed manual operator receipt and ID-scoped attested publisher are merged and NEVER self-dispatch.
All 13 extension staging PR branches now remove the push-triggered release/* publisher, add main-only promote.yml with explicit operator confirm_release=PUBLISH and central policy gating, include local manual-dispatch policy and fresh signed PG-major source/ZIP/SBOM/Grype checks. The five new repos also introduce stable-only daily watch, dry-run by default and central candidate audit. All 13 Windows CI workflows were updated to the validated common SHA above (bounded 3-attempt Chocolatey install retries). Original 8 candidate-verifier pins were refreshed to ecf8424. Latest PR CI queued/pending; no local PR has been merged on incomplete checks.
Build PR #66 adds immutable same-version stable-tag baseline SHA pinning through bot-owned manifest-only candidate PR, exact-head Windows CI, and VERIFIED candidate audit; latest-head Build CI 38141383888 is QUEUED. Do not merge until required Build CI SUCCESS.
13 local PRs: pg_bigm #28, pg_cron #19, pg_hint_plan #16, pgaudit #16, set_user #16, pg_repack #16, pg_ivm #16, pg_qualstats #18; hypopg #3, wal2json #3, pg_partman #8, pg_stat_monitor #4, orafce #5. Central release-promotion allowedRepositories deliberately remains ONLY pgextwin/plpgsql_check, and new five entries OFF; no automated formal release permitted. Past released tags/assets untouched.
Remaining: required latest-head CI/approval where pending, safely merge local replacement workflows, run source-pin bot candidate and exact PG audit, activate 5 OFF->BUILD only after local validation, expand central manual allowlist only after full acceptance, generalize signed Release->Catalog->Website (Catalog PR #21 currently UNATTENDED-dependent, unsafe to enable as-is), then close resolved Issues #44/#46/#47 with proof. Keep Issue #61 OPEN.
ShutenOishi commentedon Oct 11, 2026
2026-10-11 14-extension manual-only migration — current implementation checkpoint
Completed, merged with mandatory Build CI SUCCESS
fleet-promotion-gate.py+fleet-publish-release.py, PUBLISH-main-only, merged owned candidate/audit and attested PG-major ZIP/SPDX/Grype, create-only tags, exact release ID/digesta036f8315c103b316c8a8313ee3410e03ef0fcb3Staged local changes — 13 PRs NOT YET MERGED, latest-head Windows CI must pass:
Each branch now includes three-step safe replacement: old
release/*push publishing removed, newconfig/release-promotion.jsonandpromote.ymlwith PUBLISH/manual-only signed gates, no GitHub Release mutation while branch PR is open. Five new extension branches additionally contain stable-only daily 00:00 UTC upstream watch, local immutable candidate policy and explicit candidate-audit. Central registry holds them OFF until each is verified.Critical cutover sequence, do not reorder:
allowedRepositories == ['pgextwin/plpgsql_check']and would DENY future Release if central list is expanded without switching to the generic gate. This PR keeps Catalog auto dispatch for plpgsql unchanged.unattended-publication.jsonon.UNATTENDED+ automaticFormalRelease, contradictory to manual-only publication and must NOT be enabled as-is.Initial local PR CI failures on pg_bigm/pg_cron/pgaudit/wal2json included transient Chocolatey
Install PostgreSQLfailures while other PG-major jobs succeeded; these are NOT grounds to lower CI requirements. Newly updated heads have fresh Windows runs queued/in progress. This checkpoint does not claim 13 local merges or 14/14 LIVE acceptance.ShutenOishi commentedon Oct 11, 2026
2026-10-11 later checkpoint: Build #66 merged; secure promotion cutover and downstream policy under CI
a036f8315c103b316c8a8313ee3410e03ef0fcb3. Stable unchanged refs without full SHA now generate bot-owned pin-only candidate PRs, not Releases; changed ref/version on pin-only is denied.release/*publisher retirement plus new main-only explicitPUBLISHand SHA-pinned generic signature checks remain OPEN under latest-head PG14–18 CI. The five new local PRs contain verified stable-release watchers and candidate-audit, and central policy stays OFF. No new Release or tag created.metadata/manual-release-downstream.jsoninstead of requiringUNATTENDED/automaticFormalRelease; CI 38142438280 queued. catalog PR #21 was amended to use this policy and to require native exact-HEAD pull_request CI, never manual workflow_dispatch as replacement for protected checks; CI 38142538922 queued. Production Catalog automerge stays OFF pending dedicated App PR identity and branch protection acceptance.Do not claim 14/14 main cutover until PR-native full CI, protected merge, post-main Windows/watch/audit and lifecycle verification complete. Maintain former formally published assets untouched. No automatic formal Release, approval JSON, extra reviewer or branch-protection relaxation introduced.
ShutenOishi commentedon Oct 11, 2026
2026-10-11 JST — Fleet-wide manual-only Release migration checkpoint
Merged and CI-verified: Build PR #63 (14 registry entries: first 9 BUILD, newer 5 OFF), Build PR #64 (strict heterogeneous 14-extension tag/source/asset identities), generalized candidate/manual-PUBLISH + ID-scoped attested publisher, and Build PR #68 (downstream Catalog policy initially disabled, automaticFormalRelease=false), merge 22779a0.
Eight original extensions have separate OPEN cutover PRs, now also pinning current upstream tag to fully peeled 40-character Git commit SHAs: pg_bigm #28, pg_cron #19, pg_hint_plan #16, pgaudit #16, set_user #16, pg_repack #16, pg_ivm #16, pg_qualstats #18. All remove old release/* automatic publisher; include main-only workflow_dispatch PUBLISH. pg_hint_plan and pgaudit pin each of the 5 PG14–18 series independently. Native exact-head Windows CI is pending, so DO NOT MERGE YET.
Five new local OPEN PRs include stable-only daily UTC00/JST09 watch, immutable candidate config, explicit candidate audit and manual-only Promotion, with old release/* publisher removed: hypopg #3, wal2json #3, pg_partman #8, pg_stat_monitor #4, orafce #5. Central mode remains OFF for all five until local CI and manual release gates are accepted.
Build PR #67 conflicted with newer main; safely superseded and closed by Build PR #69, built on current main and currently OPEN, with exact nine-BUILD manual Promotion allowlist/five-OFF denials. Do not merge #69 before eight local PRs have passed exact-head PG14–18 CI and merged. Catalog PR #21 now checks central POST_MANUAL_RELEASE_ONLY (rather than UNATTENDED) and requires native exact-head pull_request validation, but is default-disabled and still awaiting latest CI.
No formal Release/tag was created or modified; no automatic formal publication, Catalog autocommit or protection change. Keep Issue #61 and Step23 #47 OPEN until full 14/14 rollout proven. The only routine human gate is operator-confirmed manual PUBLISH; no separate human reviewer/approval JSON.
ShutenOishi commentedon Oct 11, 2026
2026-10-11 14-extension cutover checkpoint (operator-only PUBLISH)
6230cf4802b14e250387143a1c9da2dc38724943, five PG14–18 Windows CI 38141872775 SUCCESS, syntax and release preflight tests SUCCESS; merged mainca255bd87523288ecbf4b9ec2bf7047e683d3723. The single-repo special promotion pin is now generalized before any central nine-repo expansion, preserving existing operator-only PUBLISH and signed build.POST_MANUAL_RELEASE_ONLYauto-Catalog-merger, not automatic formal Release. Previous validated branch was behind Catalog main and GitHub protection properly denied merge. Non-conflicting current mainedae6504a12acb4f33fb5e28599d3dfb27e72bbfwas merged into its PR branch as new head4decebdbd0a37041b2dd6735adf9376902c1d2de; native required Catalog CI 38144303529 queued. Do not merge prior to this SHA's required successfulvalidate.ShutenOishi commentedon Oct 11, 2026
Fleet manual-only migration — latest verified checkpoint (2026-10-11 JST)
Merged with protected, exact-head CI SUCCESS:
ca255bd87523288ecbf4b9ec2bf7047e683d3723. The pilot now uses the generic 14-extension candidate/manual-PUBLISH verifier and ID-scoped signer BEFORE policy expansion.validate38144303529 SUCCESS, main merge36eace0f2b1f7fafd98b98634d7b871095044564. The independent post-manual-Release Catalog auto-merge controller remains DEFAULT OFF in both local config and central build#68; its tests deny any automatic formal Release and untrusted PR head.Additional Catalog post-manual Release compatibility: catalog #46 changes the Wave 3 signed public Release ingestion from historical release-branch-only to also accept manual main
promote.ymlafter verifying signed ZIP+SPDX/SHA256 and exact upstream source, actual workflow run's main SHA/path/event and non-bot operator. Denies normal CI, fake runs and mixed legacy/main origins. Current protected PR head62c2d21a561eefac90fb9723254e96a13c87cb84incorporates Catalog main #21 and requiredvalidaterun 38145064880 is QUEUED; do not merge before SUCCESS.13-local PR structural audit PASS on staged branches (NOT merged): first eight and new five have zero
release/*automatic publisher jobs, exact main-onlyconfirm_release=PUBLISHgeneralized Promotion, SHA-pinned build, local manual-dispatch opt-in, source commits pinned to full upstream SHA (pgaudit and pg_hint_plan per PG major). New five also have stable-only daily JST09/UTC00 watch/candidate and candidate-audit. Their latest-head PG14–18 Windows CI runs are pending/queued; some earlier runs are cancelled because PR heads advanced, not successful proof. Do not cherry-pick stale head checks. Original eight URLs: pg_bigm #28, pg_cron #19, pg_hint_plan #16, pgaudit #16, set_user #16, pg_repack #16, pg_ivm #16, pg_qualstats #18. New five: hypopg #3, wal2json #3, pg_partman #8, pg_stat_monitor #4, orafce #5.build #69 has required main-eligible CI 38143630569 SUCCESS, but MUST stay OPEN until all 8 original local PRs have passed latest-head CI and merged. It allows human PUBLISH only for original nine BUILD, deliberately excludes five new centrally OFF entries. Next: 13 CI & protected merges, then policy, five OFF->BUILD separately, generalized release->Catalog for non-Wave3 groups and live Website audit. No Release/tag created, no independent human reviewer, no protections weakened. Keep Issue #61 OPEN.
ShutenOishi commentedon Oct 11, 2026
2026-10-11 continuation checkpoint — manual-only 14-extension cutover (not yet complete)
Already merged in central build: 14-record authoritative fleet with original 9 BUILD and five SAFE OFF, immutable heterogeneous 14-extension source/tag/ZIP identity checks, generalized fail-closed
fleet-promotion-gate.pyand ID-scoped signedfleet-publish-release.py. Current build main SHA22779a0c0177381993edbad03f937cc459a8d51b; build validation 38143248500 SUCCESS.13 local migration PRs staged but NOT merged:
promote.yml, with legacy release-branch auto-publish removed. Latest PR Windows CI 38141614336, 38141619732, 38141623955, 38141627914, 38141632852 each currently IN_PROGRESS with multiple PG14–18 successes; no false all-green claim or early merge.Strict security posture: central
metadata/release-promotion.jsonSTILL allowlists onlyplpgsql_check, and five new repos remain OFF. build PR #69 passes CI 38143630569 but is intentionally UNMERGED until original 8 local cutovers complete with exact-head CI. Never enable automatic formal releases; independent human PR approval/approval JSON are not required, while human operatorworkflow_dispatch+ literal PUBLISH + candidate origin/SHA audit + fresh signed build + ID-scoped immutable Release checks remain required.Downstream: Catalog PR #21 was merged to main with the post-manual-release-only controller; central
metadata/manual-release-downstream.jsonand Catalog local config currentlyenabled=false,automaticFormalRelease=false. Do not auto-enable App token or scope 14-way merge until generator and source-bound attestation verification generalize beyond plpgsql_check, requiredvalidatechecks pass natively, and the policies are explicitly allowed.Next order: approve/run exact-head pending CI for 8; merge accepted five OFF repos (may be safely done before central BUILD); merge 8 only once all local release-branch retirement + replacement workflows/CI verified; then and only then merge central PR #69; review staged new-five BUILD activation separately and maintain permanent manual formal publication. Update Issue #47 only with verified evidence, never close the fleet issue prematurely.
ShutenOishi commentedon Oct 11, 2026
2026-10-11 continuation — all five NEW fleet repositories safely merged with policy OFF
All five local staged cutovers have been MERGED into their own protected
mainafter exact-HEAD PG14, PG15, PG16, PG17, PG18 Windows x64 CI each SUCCESS (5/5):b91fe101d4c4e332fd90c44f628d0c31b77fe4e0.34dc1b70b91b967c853b587abae407df124978c0.d494f98aa87f65401573ad2e3e201bb9e905226b.bc2a7b79fb59d4e1e5071ecdfd73fb55467c32d8.0e1afb93684426b86f0fcd5120c60fbdbac184bc.Each merged main has
config/release-promotion.jsonand a SHA-pinned, operator-onlypromote.yml, retiredrelease/**push publisher, UTC 00 daily watch with main-push dry-run, SHA-pinned candidate policy and artifact-audit dispatch path. All five remain centrally OFF: no enabled candidate automation, no formal publication. Their post-merge main push Windows/watch runs are queued/running; do not claim those runs passed until separately confirmed. No historic Release, tag or public downloads changed.Original eight migration branches now have full upstream SHA pins peeled from the actual existing stable tags (including 5 refs each for
pg_hint_planandpgaudit), plus local manual Release gates; exact-head PR Windows runs 38144940035, 38144951790, 38144962198, 38144965380, 38144971641, 38144977328, 38144984964, 38144991996 are PENDING/QUEUED (first seven pending, pg_ivm queued, no current exact-head acceptance). GitHub Cloud Browser approval/dispatch may be required; do not merge those eight yet.Central allowlist PR #69 exact-head CI 38143630569 SUCCESS but deliberately OPEN until original eight local replace-publisher PRs are CI green and merged. Central
release-promotion.jsonstill allows onlyplpgsql_check. Downstream verified Catalog auto-merge is additionally disabled by central and local policies; do not turn automatic formal release on. No new release dispatched.ShutenOishi commentedon Oct 11, 2026
2026-10-11 continuation: 14-extension manual-only cutover acceptance checkpoint
Reconciled against live GitHub, not the original stale Issue snapshot:
22779a0c0177381993edbad03f937cc459a8d51b, main CI 38143248500 SUCCESS. Central publication allowlistmetadata/release-promotion.jsonis still plpgsql_check only, fail closed for other repos.promote.ymlwith explicit manualconfirm_release=PUBLISH, local authorization policy, new stable-only watch/candidate source patterns and immutable Windows candidate-audit. The dangerousrelease/**Windows publisher is removed. They remain central OFF pending full main Windows CI and final 14-way rollout. Main push watch performs dry-run and does not create candidates while OFF.promote.yml, local promotion policy, retired release-branch publisher, full PG14–18 CI and candidate verifier. Latest exact-head Windows runs are pending/queued, not yet all SUCCESS, so no merge reported.promote.ymlorigin for Wave 3 in independent Catalog verification; reject mixed legacy/manual sources) passed native validate CI 38145064880 SUCCESS and was merged now into catalog/main asc49d0c69b501f131fbc6376b54e764bb59c7cbf0. It did not publish a Release or alter catalog records.unattended-publication.jsonremains OBSERVE/default DENY, formal Releases must only occur upon deliberate human operator workflow_dispatch/PUBLISH; the downstream Catalog auto-merge is not the same as formal auto-publication. No Releases, tags, security settings or old assets were changed.Next blockers: success of 8 latest local PG14–18 Windows matrix checks, local protected merge, then protected central PR #69, cautious enablement of the five OFF lanes after their own main matrix acceptance, and end-to-end stable candidate → verified → deliberate manual Release → independent Catalog/Website proof. Keep Issue OPEN; CI queued/pending is not a pass.
ShutenOishi commentedon Oct 11, 2026
2026-10-11 23:27 JST — manual-only 14-extension rollout checkpoint
Completed common foundations: build PRs #63 (14 registry, five OFF), #64 (all source/tag/asset identities), #65 (signed Release ID-scoped publisher), #66 (full-SHA pinning), #68 (default-DENY post-manual Catalog policy); mandatory Build CI SUCCESS.
New five local cutovers MERGED: hypopg, wal2json, pg_partman, pg_stat_monitor, orafce. Each removed release-branch automatic publication and added stable-only watch/candidate, immutable candidate audit and main-only operator PUBLISH promotion. Central policy remains OFF for these five. Exact main PG14–18 CI: wal2json run 38145705539 SUCCESS; pg_stat_monitor 38145529215 SUCCESS; hypopg 38145579632 in_progress; pg_partman 38145847444 in_progress; orafce 38145879641 queued.
Original eight local cutover PRs OPEN: pg_bigm #28, pg_cron #19, pg_hint_plan #16, pgaudit #16, set_user #16, pg_repack #16, pg_ivm #16, pg_qualstats #18. pg_ivm latest exact-head CI 38144984964 SUCCESS; remaining seven queued/running. No merge before all required checks succeed.
Central Build PR #69: add the original 9 to manual Promotion allowedRepositories, preserving five OFF and explicit PUBLISH. Exact head CI 38143630569 SUCCESS. HOLD until eight legacy release-branch publishers are retired on main to avoid dual active publication routes.
Central Build PR #70 (#70): enable the additional five OFF→BUILD for automatic immutable candidate CI, but DO NOT add to formal publication allowlist or enable automatic Release. Initial CI 38147829202 failed on obsolete nine-member test count; corrected on head aea59b1. Recheck 38148021955 queued. HOLD until all five new local main PG14–18 Windows CI jobs succeed and this exact-head Build CI is SUCCESS.
Formal Release remains manual only. No new Release, tag, Catalog or Website mutation, no auto publication and no branch protection changes in this sequence. Post-manual signed Catalog auto-sync, fleet-wide candidate evidence and 14/14 end-to-end acceptance remain OPEN.
ShutenOishi commentedon Oct 11, 2026
2026-10-11 23:49 JST — restart-log CI regression found and isolated
14-extension consistency audit identified a real new-repository main regression, not a transient Chocolatey install failure: pg_partman main Windows run 38145847444, PG15 job 114489946791. PostgreSQL installed successfully at its pinned 15.19.0 version and BGW's intentionally denied role emitted
permission denied for schema partman; the failure is a PowerShellSubstring(startIndex)exception inpilot/bgw/smoke-test.ps1:124, because the restarted server's log was shorter than the previously stored text offset.A scoped fix has been committed in pg_partman PR #10, commit
19bedbc18c7de7073c045e4dd4ada582d6e54f09, preserving denied-role and fresh-maintenance/crash-recovery assertions, and repairing all three restart log-offset reads. Native PG14–18 Windows CI 38148676010 and optional BGW technical pilot 38148675441 were QUEUED at last check, NOT yet accepted.Central build PR #70 was repaired to expect 14 BUILD candidate lanes and its exact-head required infrastructure CI 38148242334 succeeded. Do not merge #70 before (1) PG_partman PR #10 passes native CI and protected merge followed by main Windows re-verification, (2) all other new-five main Windows matrices are green, and (3) preceding nine-member manual-PUBLISH allowlist #69 has completed its eight-local publisher cutover. Keep formal publication manual-only and central OBSERVE/DENY; no new Release, tags or downstream publications were created by these repairs.
ShutenOishi commentedon Oct 11, 2026
2026-10-11 manual-only 14-extension cutover continuation (CI-gated; NOT complete)
BUILD / allowed=true / dry_run=truecandidate-decision artifacts, and remaining queued pg_repack in Step 23 acceptance: nine BUILD candidate dry-runs and safe manual release path #47.promote.ymlPRs remain OPEN. Their branches were safely advanced onto their now-updated protected main via two-parent merge commits, after verifying main had only changed.github/workflows/update-watch.ymland that the resulting PR diff remained exactly{.github/workflows/promote.yml, .github/workflows/windows.yml, config/extension.json, config/release-promotion.json}:54e2b5799c787a95cbb2c6f83fe9be03bb840a80b84d1a236029280bfab55aaedef9ed7f06d4084a8df3aca104f893e749b732bd38cd31d2418c64b2838b2368a75489f5db068635b272a81d6361c85b42b7e4e7dab22ef0bb35b9d4a8a6c21a6680fa9c3d8a5c0fb2c9ce71a122a2ace635c602bc6b67fabcbe24de7bfcc87f7d1f2e03a35fb395471a2af4eecfda0f66c79d7ed258fbc878919bf0a947d069These have new latest-head native Windows PR CI queued/pending; NO local cutover merge until all PG14–18 jobs succeed at current head.
Substring($logOffset)afterpg_ctl -lrestarted/truncated log and threwstartIndex cannot be larger than length of string. New protected pg_partman PR #11 isolates denied-role, restart and post-crash phase logs without weakening BGW assertions; both native Windows and BGW-pilot CI queued. Keep feat(fleet): activate remaining 5 automated candidate BUILD lanes, keep Release manual #70 blocked until Step 6: add release build provenance attestations #11 exact-head CI, merge and new main PG14–18 matrix succeed.confirm_release=PUBLISH, strict per-source evidence and immutable signed Release; central unattended release remains OBSERVE / DENY. No new Release, retag, automatic formal promotion, auto-Catalog merge or permission change performed.Next gated sequence: eight exact-head CI successes → eight merges → Build #69 latest CI and merge; finish pg_partman #11/main CI and all five new main matrices → refresh Build #70 onto latest main, run full tests and only then merge candidate-only 14 BUILD. Keep this Issue #61 OPEN for downstream Catalog/Website and real E2E acceptance.
ShutenOishi commentedon Oct 11, 2026
2026-10-11 late checkpoint — additional blockers resolved/staged without publishing
5e7f93ba3a33f9032c37a9996be153150c6570b9(run 38148242334), after fixing obsolete 9-member assumptions. Remains OPEN because new five local full main CI must succeed first. It only enables candidate BUILD; no formal Release allowlist changes.No formal Releases/tags were created or modified, and no branch protection or GitHub App permissions were weakened. Keep Issue OPEN pending full 14/14 acceptance.
ShutenOishi commentedon Oct 11, 2026
Read-only 14/14 Catalog ↔ GitHub public Release inventory audit (2026-10-11 JST)
A fresh GitHub API scan of all 14 extension repositories, each
pgextwin/catalog/extensions/<extension>.json, and each repository's newest published Release found:latest.releaseTagvalues equal the newest GitHub Release tag.SHA256SUMS.txt, 224 assets total.availableZIP records point to filenames present in their respective newest Release; corresponding 70 SPDX and 70 Grype filenames are present.pgauditandpg_hint_plan; no incorrect assumption that the ZIP stem is always the formal Release version.Scope limitation: metadata-only consistency, not remote ZIP download/re-hashing or new attestation verification. Existing independently signed Release evidence remains authoritative; no Release was published or Catalog data changed in this audit.
Remaining commonization gap: Catalog currently has pilot-only
.github/workflows/sync-release.yml/scripts/propose_verified_release.py(plpgsql_check) and separate Wave 3sync-wave3.yml/propose_verified_wave3.py(pg_partman, orafce, pg_stat_monitor). No demonstrated common signed post-manual-PUBLISH ingestion path covers all 14, particularly heterogeneous original 8 + HypoPG/wal2json. Continue fail-closed generator/attestation unification and restrict downstream Catalog auto-merge to verified operator-PUBLISH releases only. Do not switch on unattended formal Release.12 remaining items
ShutenOishi commentedon Oct 12, 2026
wal2json 2.7 — authenticated Work Dispatch confirmed, CI in progress (2026-10-12 JST)
workflow_dispatch, branchauto-candidate/63cfbe30c2e37120e6d6, exacthead_sha=6d46199c4d4d8aa5cfb5306f698bd9287e427140.config/extension.jsondiffers from repaired main; upstream 2.7 full SHA1fd8720d0145fba505822727c30cf0c5cc96f66funchanged.wal2json-pg17-windows-x64Actions artifact uploaded; PG14/15/16/18 were still running PostgreSQL installation steps. Candidate-report/audit not yet complete. Keep Complete the initial eight-extension roadmap #5 DRAFT, do not merge or publish until exact-head Dispatch success andcandidate-auditVERIFIED, stable watch decision 38200640208 aligned.No formal Release,
PUBLISH, Catalog, Website or existing Release/tag mutation performed.ShutenOishi commentedon Oct 12, 2026
wal2json 2.7 — candidate repair and exact-head validation ACCEPTED; PR #5 MERGED (2026-10-12 JST)
Immutable candidate and required CI
workflow_dispatch38223928048 onauto-candidate/63cfbe30c2e37120e6d6, exacthead_sha=6d46199c4d4d8aa5cfb5306f698bd9287e427140.Verify candidate Windows matrix and immutable artifacts / reportjob114730695153SUCCESS.candidate-auditArtifact ID11736540404. Audit job log recordsstatus=VERIFIED,schemaVersion=1,matrixResult=success,runId=38223928048,branchSha=6d46199c4d4d8aa5cfb5306f698bd9287e427140, each PG majorstatus=SUCCESSand identical pinnedsourceSha=1fd8720d0145fba505822727c30cf0c5cc96f66f.6d8fff0cad7f1c94ace5d2e4d9262d83f0b10f53aef6c3e09729e63058d76db7; PG155665a31e920bdfbe9f1ed5ea2760e776ea8f75eefa011b47b3e7ea4802639491; PG16c192886df9f6ebf126e1e18bb7c7844a194da0f6d844d93d9a82826319ef7c73; PG1751c9bf732bd3eea24ec00f66fc72f4eee7da3bdf4ebc22ea4403c20078a87498; PG18ad8bedaa13f377e1030c332487cd715ca4355740c733fb03960fc9a53b5ebbcd.11725565420, job log confirms matching candidate ID, upstream tagwal2json_2_7, version 2.7, fixed commit. Same-head PR Windows run 38223050512 also SUCCESS for PG14–18.Merge record
github-actions[bot], ownership marker and original candidate commit history; effective PR diff exactlyconfig/extension.json(three upstream ref/version/commit fields). No force pushes.6d46199c4d4d8aa5cfb5306f698bd9287e427140.wal2json/main=1198ff30137ee3fd01a9e168647a7167324bb713(2026-10-12T08:43:18Z). Mainconfig/extension.json: wal2json 2.7 /wal2json_2_7/ pinned1fd8720d0145fba505822727c30cf0c5cc96f66f. Build-script fix #6 remains integrated; ABI/export checks intact.Scope / next decision
Candidate repaired and merged; formal publication NOT AUTHORIZED by this request. No
promote.yml,confirm_release=PUBLISH, new Release/tag, Catalog/Website or historical asset mutation. Any later formal Release requires a fresh explicit user instruction and independent main-only Promotion checks. Keep Build Issue #61 OPEN until genuine signed Release→Catalog→Website E2E acceptance.ShutenOishi commentedon Oct 12, 2026
wal2json 2.7 — formal Release preflight READY, human Work Dispatch required (2026-10-12 JST)
Explicit user authorization: publish wal2json 2.7 only if all safety gates pass, using the new
v2.7-windows.1tag; then independently validate and propose one Catalog update. This audit did not initiate a formal Release.Live primary evidence
wal2json/mainremains1198ff30137ee3fd01a9e168647a7167324bb713.wal2jsonPR #5 CLOSED/MERGED, authorgithub-actions[bot], expected head6d46199c4d4d8aa5cfb5306f698bd9287e427140, merged commit1198ff30137ee3fd01a9e168647a7167324bb713, exactly one effective fileconfig/extension.json. Manifest containswal2json_2_7, version2.7, upstream full SHA1fd8720d0145fba505822727c30cf0c5cc96f66f, PG14–18, x64.candidate-auditartifact11736540404and independent audit job114730695153SUCCESS; audit outputstatus=VERIFIED,branchSha=6d46199c4d4d8aa5cfb5306f698bd9287e427140,matrixResult=success, all five sourceSha pinned and ZIP SHA256 receipts present.candidate-decisionartifact11725565420; decision JSON matches upstream tag/version/commit andcandidateId=63cfbe30c2e37120e6d6..github/workflows/promote.yml(manual main-only, explicitPUBLISH), localconfig/release-promotion.json(enabled/manual-dispatch), live centralmetadata/release-promotion.jsonallowlist andmetadata/automation-fleet.jsonBUILD/manual-only. Gate rejects non-human or bot actor and advanced main SHA; Promotion builds signed binaries and requires independent attestation and create-only publishing.v2.7-windows.1not found via releases/tags endpoint (HTTP 404). Git tagrefs/tags/v2.7-windows.1not found (HTTP 404); matching-refs lookup returned empty list; only published wal2json Release currentlyv2.6-windows.1. Recheck immediately before Dispatch.mainat71a06ba5e1bffaac3fda28541a524d6e4c2e7eea;sync-verified-release.ymlsupports exactextension=wal2json,release_tag=v2.7-windows.1and independently validates signed Release before App proposes exactlyextensions/wal2json.jsonas PR. No Catalog run or PR initiated yet.Explicit handoff (NO alternate publication channel)
The standard Chat GitHub connection cannot originate workflow_dispatch. Delegate ONLY authenticated human GitHub UI
wal2json/.github/workflows/promote.ymlonmainwith:candidate_pr=5,candidate_run_id=38223928048,decision_run_id=38200640208,release_tag=v2.7-windows.1,confirm_release=PUBLISH.Work must independently recheck exact main SHA, main CI, candidate/pr SHA and absence of Release/tag before a single Dispatch. No repeat if failed or an unknown active attempt. Return run URL and ID to normal Chat for authorize/release_build/publish verification. Do not run Catalog sync before signed public Release verification.
Current state: all observed preflight gates PASS; formal Promotion NOT STARTED from normal Chat. No Release assets/tags or Catalog/Website changed. Build Issue #61 remains OPEN pending first genuine signed Release-to-Website E2E.
ShutenOishi commentedon Oct 12, 2026
wal2json 2.7 — formal PUBLISH fully successful; Release audited, Catalog synchronization pending (2026-10-12 JST)
Formal Release successfully published
workflow_dispatchon exact trustedmainSHA1198ff30137ee3fd01a9e168647a7167324bb713, human actor/triggering_actor, completed SUCCESS.114748631991: explicitPUBLISH, verifiedcandidate_pr=5,candidate_run_id=38223928048,decision_run_id=38200640208, central/local manual-only policy and immutable audit receipt, SUCCESS (receipt artifact11738258222).release_buildWindows x64 jobs SUCCESS, including independent signed rebuild, upstream license, build-provenance attestations, SBOM attestations,gh attestation verifyand SBOM predicate checks. Final publish job114753316427SUCCESS, logsFormal Release verified: v2.7-windows.1; recovery artifact11738458344preserved, no retry.v2.7-windows.1, Release ID 410447206,draft=false,prerelease=false, published 2026-10-12T09:46:28Z (18:46:28 JST). Exact tagrefs/tags/v2.7-windows.1resolves directly to1198ff30137ee3fd01a9e168647a7167324bb713; existing 2.6 remains published unchanged.SHA256SUMS.txt; no missing/extra filenames, all positive sizes and correctly formatted full 64-hex GitHub asset SHA256 digests. Final publish Action verifies exact hashes and signatures.SHA256SUMS.txtasset digestsha256:6025fa8a59f9f5f6c3933cd79bf397c5ce42786990d166f14e8acf645b2dbc11.6e4f549c4c43e1695ea400bd045d412b4bec54e13b8be1dd6bdd257d0e7a26b0; PG15fb11e93550a6e413dab55d9688fb64017e0a0ca63bdd4e009d125176b00548f2; PG163d13ec8d8797f5808d896f5b28b0a8a069fa4e183d57acb5b84bd98ca4409545; PG17933de356db8b40faccdcef183863a6e2b6a8864a4353ffc311db65e644259515; PG18bd06bc2755c6ef7ebbde4ddcb04cf5e908c7a01ed8336dd869a4ea77cb6afc56. These are formal re-build hashes, not the previous candidate build hashes.verify_signed_fleet_release.pymust re-download all public bytes and validate the checksums and signatures before proposal; until its success, do not call Catalog verification complete.Catalog next step — only UI workflow_dispatch is unavailable from Chat connector
pgextwin/catalog/mainSHA71a06ba5e1bffaac3fda28541a524d6e4c2e7eea, recordextensions/wal2json.jsonstill points to v2.6. No new wal2json Catalog PR orsync-verified-release.ymlrun was found in GitHub's current Actions/PR listing.sync-verified-release.ymlon main withextension=wal2json,release_tag=v2.7-windows.1, once and no duplicates. Before triggering, verify public Release stable and that no equivalent active/completed sync was already dispatched. Do not modify any repo, App/Actions settings, auto-merge, branch protection, or other extensions.extensions/wal2json.jsononly, latest-head native required CI SUCCESS, merge via Chat with expected_head_sha, then verify Catalog main and Website EN/JA direct ZIP links, SHA256, SBOM/Grype/provenance evidence. Do not claim Website completion yet.State: formal wal2json 2.7 stable Release PUBLISHED / VERIFIED by signed Promotion; Catalog/Website NOT YET UPDATED. Leave Build Issue #61 OPEN until first new real Release→Catalog→Website E2E passes.
ShutenOishi commentedon Oct 12, 2026
wal2json 2.7 Catalog sync real E2E — independent Release VERIFIED, proposer GitHub App key INVALID (2026-10-12 JST)
New actual Catalog dispatch:
pgextwin/catalogrun 38233480853,workflow_dispatchonmainSHA71a06ba5e1bffaac3fda28541a524d6e4c2e7eea, operator-authenticated, outcome FAILURE. Inputsextension=wal2json,release_tag=v2.7-windows.1. Failed job114758353610.Substantive independent public Release verification PASSED before failure
Ran 84 tests).scripts/verify_signed_fleet_release.pydownloaded and independently checked the published 16 Release assets, SHA256SUMS and per-major signatures/attestations; emitted:{"status":"VERIFIED","repository":"pgextwin/wal2json","tag":"v2.7-windows.1","promotionRunId":38230537748,"packagingCommit":"1198ff30137ee3fd01a9e168647a7167324bb713","postgresqlMajors":[14,15,16,17,18],"assetCount":16,"recordChanged":true}.validate_landscape.py,validate_catalog.pyandvalidate_catalog.py --verify-remoteall PASS, 14 extension records.verified-catalog-proposalartifact ID11740220407was uploaded successfully with the verifiedextensions/wal2json.jsonproposal and report: https://github.com/pgextwin/catalog/actions/runs/38233480853/artifacts/11740220407 .Exact blocker — GitHub App secret, NOT Release integrity or validator code
actions/create-github-app-tokenfailed before it could create a token:Failed to create token for "pgextwin/catalog" ... Invalid keyData,ERR_OSSL_ASN1_NOT_ENOUGH_DATA,error:0680008E:asn1 encoding routines::not enough data.mainstill71a06ba5e1bffaac3fda28541a524d6e4c2e7eea;extensions/wal2json.jsonremains 2.6. The public wal2json 2.7 Release and its existing immutable assets remain successfully published and unchanged. Website 2.7 not yet verified/published through Catalog.Minimal UI-only repair / next run
PGEXTWIN_CATALOG_PROPOSER_APP_CLIENT_IDmaps to that App and its installation is restricted topgextwin/catalog, Contents write/PR write.PGEXTWIN_CATALOG_PROPOSER_APP_PRIVATE_KEYGitHub Actions secret source (repository vs org) without exposing its value. Generate/download a valid new private PEM key for the same App if original is no longer accessible; replace the effective Actions secret with the full raw PEM including BEGIN/END and preserved line breaks (no truncated value, surrounding quotes, file path or opaque base64 unless decoded as required). Do not paste the key into issue/log/chat.sync-verified-release.ymlonmainonce withextension=wal2json,release_tag=v2.7-windows.1. On continued failure, STOP and report run ID. No security gate relaxation or source code edits.Status: formal wal2json 2.7 Release=SUCCESS, Catalog verified artifact READY, App token creation BLOCKED, Catalog PR/main and Website NOT DONE. Keep Build Issue #61 OPEN pending actual E2E acceptance.
ShutenOishi commentedon Oct 12, 2026
wal2json 2.7 — first real manual-only Release → App-owned Catalog PR → public Website E2E ACCEPTED (2026-10-12 JST)
GitHub App secret recovery and Catalog independent verification
VERIFIEDartifact11740220407is preserved. No failed run was silently marked successful or retried.workflow_dispatchCatalog sync 38242208610 executed on trusted Catalog main71a06ba5e1bffaac3fda28541a524d6e4c2e7eea: SUCCESS.verified-catalog-proposalartifact ID 11744000343.Verified one-record PR & Chat-only merge
catalog: verified wal2json v2.7-windows.1), authorpgextwin-catalog-proposer[bot], branchauto-catalog/wal2json-v2.7-windows.1, exact head002f662f7e1e61e0d4ba2422b0240b2bcfe8c4d7.extensions/wal2json.json, from upstream 2.6 to 2.7, Releasev2.7-windows.1, PG14–18 distinct ZIP downloads, SPDX/Grype SHA256, provenance/SBOM attestations and capability-source commit1198ff30137ee3fd01a9e168647a7167324bb713.expected_head_sha. New Catalog maind0bb16bb8701ce497786a151edc23a44d02cab39. Post-merge mainextensions/wal2json.jsonreads upstream version 2.7, tagv2.7-windows.1, publishedAt 2026-10-12T09:46:28Z.d0bb16bb8701ce497786a151edc23a44d02cab39.downloadUrl== official GitHub Releasebrowser_download_urland Catalog ZIP/SBOM/Grype SHA256 == GitHub Release asset digests; all fivebuildProvenanceAttestation.availableandsbomAttestation.availabletrue. 5/5 x 3 asset types and all attestation availability matches.Public Website acceptance PASSED
d0bb16bb8701ce497786a151edc23a44d02cab39, consuming trusted website reusablepages-smoke.ymlSHA; whole workflow andpublic-smokejob114811499571SUCCESS.https://pgextwin.github.io/website/en/and/ja/HTML/JS/CSS checks PASS. Browser-based Chrome Headless Japanese+English Pages validation PASS, 14 Catalog cards, 20 Landscape cards, all 14 implemented, 0 candidate, 6 not-planned, interactive search/filter and 375px mobile layoutscrollWidth=375(no horizontal overflow).wal2json: v2.7-windows.1, ZIP=5, SBOM=5, Grype=5. Exactly 5 wal2json direct download URLs and all 15 hashes independently matched the official Release API in normal Chat.website/maindid not require modification; it dynamically consumes latestcatalog/main.Scope/security and issue state
410447206, signed Promotion 38230537748 SUCCESS; existing Releases/tags/assets unchanged.PUBLISH→ 16 signed Release assets → independent rehash → narrow App PR → manual exact-head CI gated merge → live Japanese/English Website checks. There is no automatic formal publish and no automatic Catalog PR merge.Current outcome: wal2json 2.7 publication, Catalog v2.7 propagation and public Website live acceptance all PASS/COMPLETE.
ShutenOishi commentedon Oct 12, 2026
2026-10-12 JST — Commander final acceptance audit: E2E COMPLETE, 13/14 main branches lack GitHub-enforced CI protection
User request: Reconcile Issue #61 for closure using the 2026-10-12 reduced Chat-first/manual-PUBLISH scope, not obsolete autonomous Catalog merge or candidate auto-merge designs.
Accepted and reverified
workflow_dispatchon packaging SHA1198ff30137ee3fd01a9e168647a7167324bb713; public Release v2.7-windows.1 contains exactly 16 assets (five ZIP/SPDX/Grype plus checksum file).extensions/wal2json.json. Exact-head protected Catalog PR CI 38242336452 SUCCESS; PR merged manually, Catalog maind0bb16bb8701ce497786a151edc23a44d02cab39.metadata/automation-fleet.json: 14/14BUILD, immutable candidatecandidateEnabled=true, manual-only, scheduled 00:00 UTC; centralrelease-promotion.jsonallowlists exactly 14.config/candidate-build.json: enabled true/manual-only, and all 14config/release-promotion.json: enabled true/manual-dispatch.update-watch.yml: daily0 0 * * *, watcher and candidate reusables present. Latest observed scheduled watcher run SUCCESS for each of 14; UTC cron remains best effort.promote.yml:workflow_dispatch, main ref guard,confirm_release=PUBLISH, central promotion gate, attested build, signed publish. All 14windows.ymlhave PR,mainpush and dispatch CI only, and no active legacyrelease/*publishing trigger or release publisher.mainWindows run SUCCESS for each of 14, at the exact SHA currently reported by each repository's main branch. Build infrastructure CI 38216182717 and fleet status 38213312972 SUCCESS.unattended-publication.jsonremains OBSERVE/DENY; candidate auto-merge, formal auto-Release, Catalog auto-merge all false.catalog/config/verified-release-auto-merge.jsondisabled. The outdated pilotmanual-release-downstream.jsonalso remains disabled and does not gate the real generic Catalog proposer.Newly found blocker: CI green is not equivalent to GitHub-enforced main merge checks
repos/{repo}/branches/mainreturnsprotected:falsefor 13/14 extension repositories, every extension other thanplpgsql_check(protected:true).pgextwin/catalog/mainis protected true. Representative repositoryrulesetsGET returned[]for wal2json, pg_bigm, pg_partman. Branch-protection detail endpoints return HTTP 403 for the standard Chat GitHub connection (cannot administer/read protections), but publicprotected:falseis conclusive that these branches have no effective branch protection.pg_bigm,pg_cron,pg_hint_plan,pgaudit,set_user,pg_repack,pg_ivm,pg_qualstats,hypopg,wal2json,pg_partman,pg_stat_monitor,orafce.Closure decision
Keep #61 OPEN until a narrow Work/GitHub-admin UI task enables appropriate main PR protection and exact-head required Windows CI checks across these 13 (no reviewer count requirement, no bypass/permissions weakening), with care not to require skipped candidate-report checks or static PG14 forever (PG14 EOL 2026-11-12). Ensure local latest matrix CI still works and GitHub branch API reflects protection, then close #61 as completed using the reduced policy. Avoid new dashboards, auto Release, auto merge Apps, irrelevant code changes or fabricated Releases. If maintaining a full moving-PG matrix as required checks needs a stable aggregator job, request a minimal Chat review and PR before enabling an unsafe/incomplete rule, not a broad new automation system.
ShutenOishi commentedon Oct 12, 2026
2026-10-12 JST — #61 read-only recheck during #75 Phase B/C (no admin or Release changes)
Normal Chat performed fresh GitHub REST
GET /repos/pgextwin/{extension}/branches/mainacross all 14 extensions: 13/14 remainprotected=false; onlyplpgsql_checkisprotected=true. This is unchanged from the final acceptance audit #6124548906. Thepgextwin/build/mainshared-infrastructure branch also currently reportsprotected=false. Attempt to readplpgsql_check/branches/main/protectionthrough the standard Chat GitHub connection returned HTTP 403; no effective required-status-check / PR-only / bypass detail can be inferred from the boolean alone.Direct exact-commit GitHub Check Runs inspection confirms per-major contexts such as
windows / PostgreSQL 14 / Windows x64through 18 and awindows / Resolve extension and PostgreSQL matrixcontext. Do not set the resolver alone as required: it does not prove all Windows builds passed. Do not permanently pin a PG14-major check beyond PG14 EOL 2026-11-12. Add/validate a stable summary check depending on the entire maintained-major Windows matrix via normal Chat code PR before setting that as required in UI.A narrow Work/GitHub admin-only operation remains necessary for effective protection configuration; no code/PR/CI task should be dispatched to Work. Keep #61 OPEN pending actual
protected=true, enforced PR + exact-head CI checks, zero mandatory outside reviews, and appropriate push/admin bypass controls. Neither branch protection nor CI has been weakened or changed during this recheck.Phase B is separately accepted in Build #77; Phase C remains a nonpublishing Draft #78. Full detail: #75 audit.
ShutenOishi commentedon Oct 12, 2026
2026-10-13 JST — fixed-name Windows matrix required check rollout (operator Chat)
Work UI audit returned: 13 named extension
mainbranches have neither Classic protection nor Rulesets;plpgsql_check/mainalready protected but uses PG-major-specific checks;build/mainalso unprotected and was read-only scope. Work changed no settings. #61 stays OPEN until each repo gets CI-required PR protection and Chat verifies effective settings.Pilot independently ACCEPTED: plpgsql_check PR #26, exact head
199eefdbad4db7333b61b1210915070866b20944, PR Windows CI 38265233560 SUCCESS. The check-run API on exact head reportedWindows required summarysuccess and all PostgreSQL 14,15,16,17,18 Windows jobs success, plus resolver and release-gate regression. Shared reusable build pinned for pilot/other repos resolves maintained majors viaresolve-matrix.ps1, which throws for$supported.Count -eq 0; the summary job runsalways()and ONLY accepts literalneeds.windows.result=success, denying fail/cancel/skip/missing. PR #26 was marked ready and squash-merged using expected head; merge commit5df0d0e7e90719390c0c864d50dd6d56a51ec561. Main push run 38271236680 started; independent main run verification tracked separately.13/13 rollout PRs CREATED (three-file scoped changes:
.github/workflows/windows.yml,scripts/required_windows_summary.py,tests/test_required_windows_summary.py; existingpromote.ymland candidate audit untouched; no Release or dispatch):b5ad51d1cfc1b7488dc8d9a30e4e476cac87f2237fb4379f775192588bfe8ce7e5d25dcc4e5d956686b269f1abf22db8940655a9929d242c2063df5a293c0d9d1d2c3c093510f9f7bf75234ed6da0829b64b3ff316ea29ac68e12a30159085895b0417d50af6f01a230427e35ae38162edfd61665a3c45ea93d0672bff2754395b451f2129f9992cbe4c8053e77e1a835cb9f6a6fb11f3fe687a088ef4dbcf2565c2cef0deae948621dd9df2beb7f687ff845e4791ed205efb453334f7678f8845897fd20534dea587d0bd859afef2fac41615989231dbf74af10bb7cfc9358c89d39bfd5a1ab700b9a09c8c972feeb2435250d1bd878d288744846d00cdc8c0eba2bf5aStatus at PR creation: 13 PR workflows started; latest-head Windows matrix and fixed summary not yet all complete. DO NOT APPLY branch protection until each exact-head PR, merged main and check context independently succeed. No admin settings changed. Preserve existing plpgsql_check rules unchanged; #75 push publication must stay DISABLED.
ShutenOishi commentedon Oct 12, 2026
2026-10-13 JST — 13 rollout PRs exact-head scope accepted, CI NOT finished: settings remain BLOCKED
Independent PR audit: All 13 PRs listed in the rollout record retain the exact expected head SHA and are mergeable. Every PR touches exactly:
.github/workflows/windows.ymlscripts/required_windows_summary.pytests/test_required_windows_summary.pyAll 13 check runs started, but as of this report NONE of the 13 had completed a SUCCESS Windows matrix and stable summary check. Do not merge any yet or present any of these repos as branch-protection-configurable. The plpgsql_check pilot PR is merged and its PR CI succeeded, but its main push CI is still in_progress.
PR run IDs to resume from (all blocked pending completion)
Pilot plpgsql_check merged main SHA
5df0d0e7e90719390c0c864d50dd6d56a51ec561; push run 38271236680 remains in_progress at this inspection.Acceptance continuation without Work
For each listed extension: retrieve latest PR head and Windows run, demand check-run
Windows required summarySUCCESS on that exact head plus all dynamically maintained-PG matrix jobs SUCCESS and resolver SUCCESS; verify complete three-file diff and no other failed check; merge withexpected_head_shaonly then verify new main SHA/push run has fixed summary SUCCESS and all maintained-major successes. Repeat until 13/13 or record per-repo BLOCKED.Work UI acceptance gate
READY: none of the 13 until above per-repo merge+main-push proofs exist. Work must NOT set branch rules prematurely. When READY, set classic/ruleset main PR-only protection + exactly named required context
Windows required summaryfrom GitHub Actions (plus stable existing checks as appropriate), required checks latest head, approvals=0, no admin/direct push/force push/bypass, no deletion; independent normal-Chat readback before closing #61.Existing
plpgsql_check/mainclassic protection must not be relaxed; adding/changing its fixed-name context is a separate explicit scope after main CI succeeds.build/mainwas read-only in Work's audit and must not be silently included; new change requires separate scope.No formal Release, workflow_dispatch, live #75 publication trigger, or admin rules changed. #61 OPEN.
ShutenOishi commentedon Oct 12, 2026
2026-10-13 JST — fixed-name Windows CI: 13/13 PRs merged, main push verification outstanding
Following the prior 13 PR CI runs (all
completed/success), independent exact PR SHA check-runs for every extension verified:Windows required summary=success,windows / Resolve extension and PostgreSQL matrix=success, all five PG14–18 Windows jobs success, no failed check, and exactly three-file scoped PR diff. The identical strict fail-closed scripts/checks were accepted in merged plpgsql_check #26. All 13 PRs have now been squash-merged using exact expected PR head SHA (where applicable); no Release/promote/dispatch or admin setting changed.4cb780c1331befe72e2aa6a5a614075382bbfd177ca5b89379c373baaf6d5f92de89af9cea3390ad252dbd6a3f23b1f53d1abd0efdf63d69dc937be4b80b383176d89150a344c16b233636f82409909104515cbf35a5b0ff8d291d5a14f5725f828fe2fa2af574185502083e86446d8b580138cac39e34229daf034e302c965958b326a8c3cf321b8c23c4aa3c5402e77ea7c3a15edec7c5b9753d29c4e7b76de3ceeb454c704b17a2ec712c59746135de325f09ae9ea6aaff26d36fd88f7160861f4d232e763178379f27fb2005a84e2a3909a10f7e53a225d51fc30c3335b5878f61a1f9af59b4627ddc72013d32bf3e66c672ffa43f581a88bd9f94bbf1367f139f98Pilot plpgsql_check: merged PR #26 main SHA
5df0d0e7e90719390c0c864d50dd6d56a51ec561; main push run 38271236680 SUCCESS. Existing Classic protection is NOT changed; its fixed-name context must be added only under separate explicit admin UI scope, preserving its other required checks.NEXT: Independently verify
mainexact commit SHA,pushrun = SUCCESS,Windows required summarySUCCESS, resolver and maintained-PG Windows jobs all SUCCESS for each 13 repository. Only after these proofs is a repository marked READY for Work admin UI to configure PR-only required-CI main branch protection using fixed contextWindows required summary. Until then each is BLOCKED / awaiting post-merge CI. The Work UI audit had found all 13 unprotected; no settings are changed yet.Scope exclusions:
build/mainis independently unprotected; must be a separate permission scope, not silently added. Issue #75 publication trigger remains disabled. No formal Release, Workflow Dispatch, token, or admin settings changed. Keep #61 OPEN until Work settings and independent readback accepted.ShutenOishi commentedon Oct 12, 2026
2026-10-13 JST — Independent post-merge main Windows matrix acceptance: 13/13 READY for Work protection UI
Re-audited all 13 repositories via authenticated normal-Chat GitHub REST read-only APIs after all fixed-name-summary PRs were merged. Checked for each repository current
refs/heads/maincommit SHA == expected squash merge SHA == workflow runhead_sha, workflow eventpush, workflow runcompleted / success, and latest-commit GitHub Check Runs showing:Windows required summary: completed/successwindows / Resolve extension and PostgreSQL matrix: successwindows / PostgreSQL N / Windows x64for N=14,15,16,17,18: each successprotected:false; READY means eligible for subsequent Work configuration, NOT protected.pgextwin/pg_bigm4cb780c1331befe72e2aa6a5a614075382bbfd17pgextwin/pg_cron7ca5b89379c373baaf6d5f92de89af9cea3390adpgextwin/pg_hint_plan252dbd6a3f23b1f53d1abd0efdf63d69dc937be4pgextwin/pgauditb80b383176d89150a344c16b233636f824099091pgextwin/set_user04515cbf35a5b0ff8d291d5a14f5725f828fe2fapgextwin/pg_repack2af574185502083e86446d8b580138cac39e3422pgextwin/pg_ivm9daf034e302c965958b326a8c3cf321b8c23c4aapgextwin/pg_qualstats3c5402e77ea7c3a15edec7c5b9753d29c4e7b76dpgextwin/hypopge3ceeb454c704b17a2ec712c59746135de325f09pgextwin/wal2jsonae9ea6aaff26d36fd88f7160861f4d232e763178pgextwin/pg_partman379f27fb2005a84e2a3909a10f7e53a225d51fc3pgextwin/pg_stat_monitor0c3335b5878f61a1f9af59b4627ddc72013d32bfpgextwin/orafce3e66c672ffa43f581a88bd9f94bbf1367f139f98Aggregate: 13/13 READY; 0/13 BLOCKED for Windows CI; 0/13 protected as of this independent API read. This satisfies the prerequisite to hand each listed repo to Work for Web admin UI settings. Do not mistake code acceptance for branch-rule completion.
Exact Work UI action scope (only 13 above)
For each repository, reconfirm the current main SHA, successful listed run, and that the exact GitHub Actions required check context is
Windows required summary. Then create/update effective main protection with required PR; required successful fixed-name check with strict latest base/head synchronization; 0 required approving reviews (no second reviewer); enforcement on administrators, no bypass actor, no direct push/force push/deletion. Preserve other valid existing protections if any; never remove legitimate checks merely to pass. Do not select PG14–18 dynamic check names as sole future-proof requirement. If any setting cannot be enforced or the main SHA has changed without equivalent fresh successful runs, mark that repository BLOCKED and do not claim acceptance. Return per-repo exact effective settings/UI evidence for normal Chat to independently read back.Explicit exclusions:
plpgsql_check/mainis already protected (existing Classic settings, separately scoped). Its fixed-nameWindows required summarymay be added only in a separate explicit setting change, without weakening previous protections; pilot main SHA5df0d0e7e90719390c0c864d50dd6d56a51ec561, push CI 38271236680 SUCCESS.build/mainis currently unprotected, not authorized for a settings change in this 13-repo Work dispatch. Issue #75 remains separate; no publication trigger authorization.Issue #61 remains OPEN until Work admin UI changes plus independent normal Chat effective protection readback on all 13. No Release, workflow_dispatch, publisher promotion, tag changes, or protection edits were executed in this audit.
ShutenOishi commentedon Oct 12, 2026
2026-10-13 JST — Work Classic protection applied; normal-Chat independent readback (PARTIALLY VERIFIED, close gate HOLD)
Work reported applying and reopening Classic protection UI for all 13 target repos: main-only PR required; GitHub Actions
Windows required summaryrequired; strict=true; approvals=0; admin/no actor bypass; force push/deletion forbidden. This is Work's reported evidence, not a fully independent API verification of those hidden fields.Independently VERIFIED for all 13 via connected GitHub REST:
GET /repos/pgextwin/{repo}/branches/main: current main HEAD exactly matches previous accepted squash-merge SHA;protected:true;protection.enabled:true;protection.required_status_checks.contexts=["Windows required summary"]; checks[{"context":"Windows required summary","app_id":15368}];enforcement_level:"everyone".GET /repos/pgextwin/{repo}/rulesetsreturned[]in each repo, consistent with reported Classic rules.GET /repos/pgextwin/{repo}/actions/runs/{id}: prescribed run ispush, same HEAD,completed/success.GET /repos/pgextwin/{repo}/commits/{sha}/check-runs:Windows required summarycompleted SUCCESS, Resolver SUCCESS, each PG14/15/16/17/18 Windows x64 SUCCESS; no failed/cancelled/timed-out check.protectedpg_bigm4cb780c1331befe72e2aa6a5a614075382bbfd17trueWindows required summarypg_cron7ca5b89379c373baaf6d5f92de89af9cea3390adtrueWindows required summarypg_hint_plan252dbd6a3f23b1f53d1abd0efdf63d69dc937be4trueWindows required summarypgauditb80b383176d89150a344c16b233636f824099091trueWindows required summaryset_user04515cbf35a5b0ff8d291d5a14f5725f828fe2fatrueWindows required summarypg_repack2af574185502083e86446d8b580138cac39e3422trueWindows required summarypg_ivm9daf034e302c965958b326a8c3cf321b8c23c4aatrueWindows required summarypg_qualstats3c5402e77ea7c3a15edec7c5b9753d29c4e7b76dtrueWindows required summaryhypopge3ceeb454c704b17a2ec712c59746135de325f09trueWindows required summarywal2jsonae9ea6aaff26d36fd88f7160861f4d232e763178trueWindows required summarypg_partman379f27fb2005a84e2a3909a10f7e53a225d51fc3trueWindows required summarypg_stat_monitor0c3335b5878f61a1f9af59b4627ddc72013d32bftrueWindows required summaryorafce3e66c672ffa43f581a88bd9f94bbf1367f139f98trueWindows required summaryImportant independent-verification limitation — all 13:
GET /repos/pgextwin/{repo}/branches/main/protectionreturns HTTP 403 (Resource not accessible by integration) through the current GitHub connection on every repository. The narrowrequired_status_checks,required_pull_request_reviews, andenforce_adminsprotection endpoints are similarly denied on a sample repo. As a result, independent Chat cannot verifyrequired_status_checks.strict=true, PR requirement, approval count 0, admin/no actor bypass, force push/delete toggles, or all detail settings from the current connector alone.enforcement_level:everyonein the branch summary gives useful evidence for required status checks but is not sufficient proof of all the above.Decision: Work UI reported READY 13/13; independent visible-rule/CI verification PASS 13/13; full independent detailed-branch-protection verification remains BLOCKED 13/13 by GitHub connector administration-read permission (not by CI or evidence of misconfiguration). Consequently, under the user's requirement
close only after all effective conditions independently verified, KEEP Issue #61 OPEN, and DO NOT treat this note as authorization to enable Issue #75 publication.Narrow next step: obtain authenticated read-only administration evidence for the 13 Classic protection objects (fields above) through a legitimately authorized connection/API or verifiable GitHub admin UI evidence; cross-check detail fields and re-read
mainSHA/required context, then decide whether to close. Do not create broad-scope automation tokens or relax any setting merely to make the API readable.Separate/out of scope:
plpgsql_check/mainis still protected, main SHA5df0d0e7e90719390c0c864d50dd6d56a51ec561, and its existing required-check list (currently per-major checks) has not been changed;build/mainremainsprotected:false, unchanged and separately scoped. No Release, Dispatch, new publishing trigger, workflow changes, or branch protection mutations were performed in this audit.ShutenOishi commentedon Oct 12, 2026
Issue #61 FINAL ACCEPTANCE — 2026-10-13 JST (13/13 verified; recommend CLOSED)
Decision basis: use the authenticated GitHub Cloud Browser's saved Classic protection UI snapshots as valid primary evidence for fields that the installed GitHub App cannot read, combined with fresh independent connected-GitHub
branches/mainreads and already independently verified exact-SHA Windows CI. This is an expressly delimited multi-source acceptance, not a claim that the detailed protection REST API returned success.Independent review of the supplied Work evidence archive
Archive:
pgextwin-issue61-classic-final-audit-20261013.zip(retained in user Project Library; not published as a GitHub release).SHA256:
70771ea70fd7aebdbd4505e84d6d9e48cd4d0188821269a983f8e8cb6e6c2839.Contents:
README.md,ui-audit.json,api-evidence.json, 13 distinct JPEG screenshots and 13 full saved-rule UI DOM captures.Normal Chat materialized and independently inspected the actual archive bytes:
SAVED RULE REOPENEDDOMs, not merely the Work summary, independently parsed; all link to correct repo-specific saved rule URL and showBranch name pattern: mainandApplies to 1 branch.Require a pull request before merging,Require status checks to pass before merging,Require branches to be up to date before merging(strict), andDo not allow bypassing the above settings(also administrators).Require approvals(effective approval count 0; no API numeric field inferred), no Code Owners/most recent push approval, no specified actor PR bypass, noAllow force pushes, noAllow deletions.Windows required summary, issuerGitHub Actions; JPEGs are present and independently inspected sample screenshots show matching checked/unchecked states.ui-audit.jsonrecords corroborate the DOM; each hasmissing=[],violations=[],status=VERIFIED; Work reports no Save changes click in read-only audit.Fresh live authenticated normal-Chat API recheck
For all 13
GET /repos/pgextwin/{repo}/branches/main:commit.shamatches accepted merge/main CI head,protected=true,protection.enabled=true,required_status_checks.contexts=["Windows required summary"],checks=[{"context":"Windows required summary","app_id":15368}],enforcement_level="everyone". Prior complete run-level audit #61 acceptance established mainpush, exact head,completed/success,Windows required summary, Resolver, and PG14–18 all success.pg_bigm4cb780c1331befe72e2aa6a5a614075382bbfd17pg_cron7ca5b89379c373baaf6d5f92de89af9cea3390adpg_hint_plan252dbd6a3f23b1f53d1abd0efdf63d69dc937be4pgauditb80b383176d89150a344c16b233636f824099091set_user04515cbf35a5b0ff8d291d5a14f5725f828fe2fapg_repack2af574185502083e86446d8b580138cac39e3422pg_ivm9daf034e302c965958b326a8c3cf321b8c23c4aapg_qualstats3c5402e77ea7c3a15edec7c5b9753d29c4e7b76dhypopge3ceeb454c704b17a2ec712c59746135de325f09wal2jsonae9ea6aaff26d36fd88f7160861f4d232e763178pg_partman379f27fb2005a84e2a3909a10f7e53a225d51fc3pg_stat_monitor0c3335b5878f61a1f9af59b4627ddc72013d32bforafce3e66c672ffa43f581a88bd9f94bbf1367f139f98Verification boundaries and close decision
GET /branches/main/protectionis 403Resource not accessible by integrationfor all 13. Thusstrict, PR requirement, 0 approvals, admin/actor bypass, force push and delete deny are UI/DOM snapshot verified, not independently detailed-API-verified. We accept saved-rule authenticated UI evidence for these specific settings; fresh independent API establishes those rules are currently active, applied to the expected main heads and require the specified GitHub Actions check. No direct-push/bypass attack was performed, by design.VERIFIED (UI + independent summary API/CI) 13,FAILED 0,HOLD 0for issue Fleet-wide 14-extension manual-only formal publication: migration parity and acceptance #61.plpgsql_check/mainunchanged with preexisting Classic protection; it was not part of the 13-remediation UI task and updating its dynamic PG-major required checks remains separately scoped.build/mainis still unprotected and requires separate administrative planning before any Eliminate Work-only Dispatch: Chat-authorized Release trigger and automatic Catalog proposal #75 production push publisher rollout. Neither is silently accepted or changed here.Final acceptance: PASS for Issue #61, close as completed.