pdurlej/platform

Fork 0

ops(security): prepare PostgreSQL 16.14 image bump #684

Merged

pdurlej merged 1 commit from codex/668-postgres-16-14 into main

2026-06-02 10:18:17 +02:00

codex commented

2026-06-02 10:16:39 +02:00

Collaborator

Canary status: missing — fire canary 3+3 manually before merge

Summary

Prepares the repository side of the PostgreSQL 16.12 -> 16.14 security update without applying it live.

Canary Context Pack

Product story

M10 upgrade work should turn known security drift into small, reviewable upgrade packets. PostgreSQL is stateful and internal, so the repository can prepare the target image now while live apply remains behind the normal operator/runtime gate.

What changed

Updated the main POSTGRES_IMAGE compose default to postgres:16.14-alpine pinned by digest.
Updated the KAN_POSTGRES_IMAGE compose default to the same pinned 16.14 image.
Updated postgres and kan-postgres module metadata to the 16.14 target.
Updated Memory Control Plane docs that referred to the main Postgres image version.
Added a focused regression test for the two compose defaults.
Added a sanitized repo-bump evidence note with the exact gated follow-up remaining.

Why it changed

Issue #668 identified live postgres:16.12-alpine as security drift relative to PostgreSQL 16.14. This PR prepares the controlled target but does not perform the live database restart/apply/smoke.

Files touched

compose/core/compose.yaml
compose/apps/compose.yaml
modules/postgres/module.yaml
modules/kan-postgres/module.yaml
state/memory/task-run-schema.md
state/memory/procedure-registry-schema.md
control-plane/platformctl/tests/test_postgres_image_bump.py
state/reports/postgres-16-14-repo-bump-2026-06-02.md

Relevant context

#668 PostgreSQL 16.14 security update
honcho-postgres is intentionally excluded because it uses pgvector/pgvector:pg15, not postgres:16.12-alpine.

Runtime evidence

No runtime mutation. The new digest was resolved read-only with docker buildx imagetools inspect postgres:16.14-alpine.

Known constraints

The runtime lane still needs an operator-approved apply and smoke before #668 is complete. Production env overrides, if present, may still pin the old value until the gated runtime change lands.

Explicit out-of-scope

No live platformctl apply.
No Docker restart.
No database restart.
No production env/Infisical edit.
No Honcho pgvector upgrade.
Does not close #668.

Requested decision

Approve this repo-side image target so the runtime apply can proceed as a separate gated step.

Merge blockers

Any accidental live mutation.
Any change to Honcho pgvector scope.
Any validation failure.

Spec sources read

Forgejo issue #668 — task scope and acceptance criteria.
compose/core/compose.yaml — main Postgres service image reference.
compose/apps/compose.yaml — Kan Postgres image reference and Honcho exclusion.
modules/postgres/module.yaml — Postgres module image metadata.
modules/kan-postgres/module.yaml — Kan Postgres module metadata.
state/memory/task-run-schema.md and state/memory/procedure-registry-schema.md — current main Postgres version references.

Validation

uv run pytest platformctl/tests/test_postgres_image_bump.py — passed.
PYTHONPATH=control-plane uv run --project control-plane python -m platformctl.cli validate all --json — passed with exitCode: 0.
git diff --check — passed.

Refs #668

Canary status: missing — fire canary 3+3 manually before merge ## Summary Prepares the repository side of the PostgreSQL 16.12 -> 16.14 security update without applying it live. ## Canary Context Pack ### Product story M10 upgrade work should turn known security drift into small, reviewable upgrade packets. PostgreSQL is stateful and internal, so the repository can prepare the target image now while live apply remains behind the normal operator/runtime gate. ### What changed - Updated the main `POSTGRES_IMAGE` compose default to `postgres:16.14-alpine` pinned by digest. - Updated the `KAN_POSTGRES_IMAGE` compose default to the same pinned 16.14 image. - Updated `postgres` and `kan-postgres` module metadata to the 16.14 target. - Updated Memory Control Plane docs that referred to the main Postgres image version. - Added a focused regression test for the two compose defaults. - Added a sanitized repo-bump evidence note with the exact gated follow-up remaining. ### Why it changed Issue #668 identified live `postgres:16.12-alpine` as security drift relative to PostgreSQL 16.14. This PR prepares the controlled target but does not perform the live database restart/apply/smoke. ### Files touched - `compose/core/compose.yaml` - `compose/apps/compose.yaml` - `modules/postgres/module.yaml` - `modules/kan-postgres/module.yaml` - `state/memory/task-run-schema.md` - `state/memory/procedure-registry-schema.md` - `control-plane/platformctl/tests/test_postgres_image_bump.py` - `state/reports/postgres-16-14-repo-bump-2026-06-02.md` ### Relevant context - #668 PostgreSQL 16.14 security update - `honcho-postgres` is intentionally excluded because it uses `pgvector/pgvector:pg15`, not `postgres:16.12-alpine`. ### Runtime evidence No runtime mutation. The new digest was resolved read-only with `docker buildx imagetools inspect postgres:16.14-alpine`. ### Known constraints The runtime lane still needs an operator-approved apply and smoke before #668 is complete. Production env overrides, if present, may still pin the old value until the gated runtime change lands. ### Explicit out-of-scope - No live `platformctl apply`. - No Docker restart. - No database restart. - No production env/Infisical edit. - No Honcho pgvector upgrade. - Does not close #668. ### Requested decision Approve this repo-side image target so the runtime apply can proceed as a separate gated step. ### Merge blockers - Any accidental live mutation. - Any change to Honcho pgvector scope. - Any validation failure. ## Spec sources read - Forgejo issue #668 — task scope and acceptance criteria. - `compose/core/compose.yaml` — main Postgres service image reference. - `compose/apps/compose.yaml` — Kan Postgres image reference and Honcho exclusion. - `modules/postgres/module.yaml` — Postgres module image metadata. - `modules/kan-postgres/module.yaml` — Kan Postgres module metadata. - `state/memory/task-run-schema.md` and `state/memory/procedure-registry-schema.md` — current main Postgres version references. ## Validation - `uv run pytest platformctl/tests/test_postgres_image_bump.py` — passed. - `PYTHONPATH=control-plane uv run --project control-plane python -m platformctl.cli validate all --json` — passed with `exitCode: 0`. - `git diff --check` — passed. Refs #668

codex added 1 commit

2026-06-02 10:16:39 +02:00

ops(security): prepare PostgreSQL 16.14 image bump

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 3s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 16s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / collect-diff (pull_request) Successful in 4s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 3s

Details

python-ci / Python 3.13 (pull_request) Successful in 39s

Details

canary-required / canary (pull_request) Successful in 11s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 15s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 4m0s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 15s

Details

python-ci / Python 3.11 (pull_request) Successful in 38s

Details

python-ci / Python 3.12 (pull_request) Successful in 40s

Details

183acb8e76

codex added this to the 10 - Improvements milestone

2026-06-02 10:16:52 +02:00

codex added the

safety:no-prod-mutation

labels

2026-06-02 10:16:52 +02:00

pdurlej merged commit c7c179732b into main

2026-06-02 10:18:17 +02:00

pdurlej deleted branch codex/668-postgres-16-14

2026-06-02 10:18:17 +02:00

pdurlej referenced this pull request from a commit

2026-06-02 10:18:19 +02:00

Merge pull request 'ops(security): prepare PostgreSQL 16.14 image bump' (#684) from codex/668-postgres-16-14 into main

codex commented

2026-06-02 10:23:49 +02:00

Author

Collaborator

Patchwarden PR sanity

Status: eligible_sanity_clean
PR: 684
Commit: 183acb8e761c40d2c1d54b3e53b1598763727a7a
Security-sensitive label: missing
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

No deterministic findings.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: OK
medium Behavioral change: POSTGRES_IMAGE now has a default fallback
- Evidence: compose/core/compose.yaml line 124 changed from image: ${POSTGRES_IMAGE}toimage: ${POSTGRES_IMAGE:-postgres:16.14-alpine@sha256:16bc17c64a573ef34162af9298258d1aec548232985b33ed7b1eac33ba35c229} — previously no default existed, so unse
- Next: Verify production deployments explicitly set POSTGRES_IMAGE env var, or confirm that defaulting to 16.14 on missing var is intended. Document this behavioral change in operator runbook.

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
Findings: none

`redteam` / `kimi-k2.6:cloud`

Status: ok
Verdict: OK
Findings: none

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `eligible_sanity_clean` - PR: `684` - Commit: `183acb8e761c40d2c1d54b3e53b1598763727a7a` - Security-sensitive label: `missing` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings No deterministic findings. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `OK` - **`medium`** Behavioral change: POSTGRES_IMAGE now has a default fallback - Evidence: `compose/core/compose.yaml line 124 changed from `image: ${POSTGRES_IMAGE}` to `image: ${POSTGRES_IMAGE:-postgres:16.14-alpine@sha256:16bc17c64a573ef34162af9298258d1aec548232985b33ed7b1eac33ba35c229}` — previously no default existed, so unse` - Next: Verify production deployments explicitly set POSTGRES_IMAGE env var, or confirm that defaulting to 16.14 on missing var is intended. Document this behavioral change in operator runbook. ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `redteam` / `kimi-k2.6:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.