Add attested PostgreSQL notification broker lifecycle - #1820
Draft
Zetazzz wants to merge 4 commits into
Draft
Conversation
This was referenced Sep 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A dedicated, attested PostgreSQL listener now serves exact-topic notification leases. The broker pins one connection per complete listener identity, reference-counts channel ownership, bounds subscriber queues, latches fatal failures, and awaits UNLISTEN/client return/pool lease release. Role attestation runs on the same pinned client before LISTEN and checks the target, login posture, memberships, cross-database access, and application privileges.
This is the notification broker split from #1754. It depends on #1754's exact connection identities/leases and preserves #1752 checkout sanitation. Runtime credential selection/wiring remains in the following PR; enabling the generation subscription path is a separate F24 consumer.
Validation: 108 unit tests passed. Both dedicated PostgreSQL integration suites ran with their role gate enabled: 4 tests passed, covering role rejection, real delivery, shared listener ownership, and clean teardown/reacquisition. CJS/ESM build passed. CI now provisions the isolated listener fixture and executes these two suites after the
pg-postgresbatch; they are no longer verified only by a skipped unit run. The fixture must run only in a disposable PostgreSQL cluster because it revokes PUBLIC cross-database CONNECT.Landing order: #1744 → #1752 → #1754 → this PR → runtime wiring. Runtime wiring additionally requires #1747.
Refs constructive-io/constructive-planning#1693 (F12).
Full CI passed all 17 jobs on
c95de1e013a3e1b47e25c3a2747ce931326f3e65, including the dedicated notification integration step.Runtime wiring is now split into #1821, stacked on #1820, with an explicit #1747 release prerequisite.