Skip to content

fix(proxy): make schema changes transaction aware (BUG-308) - #460

Open
freshtonic wants to merge 3 commits into
mainfrom
docs/bug-308-design
Open

fix(proxy): make schema changes transaction aware (BUG-308)#460
freshtonic wants to merge 3 commits into
mainfrom
docs/bug-308-design

Conversation

@freshtonic

Copy link
Copy Markdown
Contributor

Summary

  • publish PostgreSQL schema and encryption metadata as one atomic, versioned snapshot
  • add transaction-pinned overlays with successful-execution activation, savepoint semantics, and extended-protocol pipeline deferral
  • fail closed for unmodelled DDL, publication failures, and dependent simple-query batches
  • add state-machine and TLS/database regressions, including direct ciphertext-at-rest verification through an already-open second connection

Issue

BUG-308

Validation

  • mise run test:format
  • mise run test:clippy
  • mise run test:check
  • 382/382 non-multitenant integration tests
  • 6/6 final-image BUG-308 TLS regressions
  • release cross-build and Docker image build
  • unit suite: 371/372 passed; the existing macOS SystemConfiguration test panics in the full suite but passes in isolation

Record the BUG-308 design for connection-local DDL visibility and authoritative schema publication. Define atomic committed snapshots, transaction overlays, savepoint behavior, protocol deferral, fail-closed reload handling, and the boundary of the standalone schema middleware.

Signed-off-by: James Sadler <james@cipherstash.com>
Publish schema and encryption metadata as one versioned snapshot, with connection-local overlays pinned for transactions and savepoint-aware rollback semantics.

Activate DDL only after backend success, defer pipelined statements behind in-flight DDL, and reload authoritative catalog state after the outermost commit using generation-safe coalescing.

Fail closed for unmodelled DDL, dependent simple-query batches, and publication failures. Add unit and TLS-backed regressions proving immediate cross-connection encryption and ciphertext at rest.

Signed-off-by: James Sadler <james@cipherstash.com>
Restrict the dependent post-DDL guard to schema changes that can alter encryption metadata, preserving pgx temporary-table setup batches while continuing to fail closed for encrypted DDL followed by mapped work.

Document every BUG-308 production module, type, and function. Expand the schema middleware module docs with its authority, atomicity, protocol-ordering, transaction, publication, and failure invariants plus current and intrinsic limitations.

Add focused regression coverage and verify the previously failing Go integration path against the rebuilt Proxy image.

Signed-off-by: James Sadler <james@cipherstash.com>
@freshtonic
freshtonic requested a review from tobyhede August 23, 2026 11:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant