[Integrity review] Bind provenance to downloaded version and index source lookup #47

New Issue

2026-09-08T10:24:52+02:00

zemion commented

2026-09-08 10:24:52 +02:00

I5: browse/request revision and checksum metadata can override downloaded revision evidence. Separate expected/observed source evidence and computed byte checksum. P4: per-import lookup materializes all owner assets; use indexed tenant/owner/source identity, preserving copies and reporting duplicate ambiguity explicitly. Include migration/update/copy/soft-delete tests.

Tracking: GovOPlaN/govoplan-core#298

User authorized implementation on 2026-09-08. Work is local until explicitly published; keep this issue open until verification and publication state are recorded. Preserve tenant isolation, current authorization, immutable history, audit evidence, deterministic ordering, retry safety and existing API compatibility. Add focused regressions and owning EN/DE documentation. No live mail/provider side effects or historical data rewrites.

I5: browse/request revision and checksum metadata can override downloaded revision evidence. Separate expected/observed source evidence and computed byte checksum. P4: per-import lookup materializes all owner assets; use indexed tenant/owner/source identity, preserving copies and reporting duplicate ambiguity explicitly. Include migration/update/copy/soft-delete tests. Tracking: https://git.add-ideas.de/GovOPlaN/govoplan-core/issues/298 User authorized implementation on 2026-09-08. Work is local until explicitly published; keep this issue open until verification and publication state are recorded. Preserve tenant isolation, current authorization, immutable history, audit evidence, deterministic ordering, retry safety and existing API compatibility. Add focused regressions and owning EN/DE documentation. No live mail/provider side effects or historical data rewrites.

zemion added the

labels 2026-09-08 10:24:52 +02:00

zemion referenced this issue from GovOPlaN/govoplan-core

2026-09-08 10:24:53 +02:00

[Integrity review] Implement 2026-09-08 data-integrity and performance findings #298

zemion commented

2026-09-08 11:51:55 +02:00

Local implementation receipt — 2026-09-08

Imported bytes and observed revision are bound by expected-revision checks and provider-specific version/conditional reads. Computed acquired SHA-256 and provider checksum claims are separate; ALL caller metadata stays solely in import_annotations, including when provider keys are absent. Indexed tenant/owner/source identity lookup replaces collection scans; bounded backfill preserves duplicates/copies and lookup reports ambiguity rather than choosing a winner. Full Files suite 267 tests+89 subtests passed before final metadata delta; final delta 34 tests+34 subtests and migration/adapter/index regressions pass. EN/DE docs updated. No live connector reads or database migration performed.

Verification: tools/checks/check-focused.sh completed successfully,72/72 manifest architecture checks passed, and changed-source Ruff F plus git diff --check passed across 16 repositories. Tests use isolated databases/mock providers; no live data/provider mutation, commit, push, tag, deployment or release was performed. Changes remain local and unpublished: keep this issue OPEN until publication/rollout state is recorded. Before rollout, back up and test coordinated Mail/Files/Connectors/Datasources migrations on a database copy. PostgreSQL concurrency, real provider races and representative load testing remain operational verification, not a claimed certification.

## Local implementation receipt — 2026-09-08 Imported bytes and observed revision are bound by expected-revision checks and provider-specific version/conditional reads. Computed acquired SHA-256 and provider checksum claims are separate; ALL caller metadata stays solely in import_annotations, including when provider keys are absent. Indexed tenant/owner/source identity lookup replaces collection scans; bounded backfill preserves duplicates/copies and lookup reports ambiguity rather than choosing a winner. Full Files suite 267 tests+89 subtests passed before final metadata delta; final delta 34 tests+34 subtests and migration/adapter/index regressions pass. EN/DE docs updated. No live connector reads or database migration performed. Verification: tools/checks/check-focused.sh completed successfully,72/72 manifest architecture checks passed, and changed-source Ruff F plus git diff --check passed across 16 repositories. Tests use isolated databases/mock providers; no live data/provider mutation, commit, push, tag, deployment or release was performed. Changes remain local and unpublished: keep this issue OPEN until publication/rollout state is recorded. Before rollout, back up and test coordinated Mail/Files/Connectors/Datasources migrations on a database copy. PostgreSQL concurrency, real provider races and representative load testing remain operational verification, not a claimed certification.

zemion referenced this issue from GovOPlaN/govoplan-core

2026-09-08 12:43:05 +02:00

Verify integrity release against real mail and storage providers #299

zemion commented

2026-09-08 12:57:25 +02:00

Source publication and database verification — 2026-09-08

govoplan-files: v0.1.27 · 61625fb00fed
govoplan-core: v0.1.46 · 6591aaa3fdaf

Remote main branches and annotated tags were verified against the exact coordinated commits. The implementation-specific tests and EN/DE documentation recorded above remain the acceptance evidence. Cross-module focused checks, manifest shapes, 63 WebUI build configurations and 230 browser tests passed. This records source publication, not a package-registry release, runtime image, website deployment or production rollout.

Database correction to the previous local-only note: the already-running development server had automatically applied Files a2b3c4d5e701, Mail b5d6e7f8091a, Connectors d2a4c6e8f0b1 and Datasources e2b8d4a0f6c3 during reloads. Their heads and expected schema/indexes were verified in the local development PostgreSQL database. A current-state backup was captured and restored into a private, isolated PostgreSQL 16 cluster; this was not a pre-upgrade backup. The supported no-op migration preserved all 281 tables and 142,287 rows by per-row SHA-256 comparison, and retained the same migration heads. Files source identity recomputation matched all 7,385 rows (2 non-null identities, zero mismatches). Both Datasources PostgreSQL concurrency tests, previously skipped without a dedicated database, passed against that isolated cluster. The test cluster was stopped. No real mail delivery, POP3 retrieval/deletion, legacy mailbox reconciliation or external connector import was initiated.

Representative production load/deadline testing and real-provider race/compatibility verification remain separate operational rollout checks; this is not security certification. Operational follow-up: GovOPlaN/govoplan-core#299.

Closing this implementation issue: its code, regression, documentation and source-publication criteria are satisfied. Operational checks above are not claimed complete.

## Source publication and database verification — 2026-09-08 - govoplan-files: [v0.1.27](https://git.add-ideas.de/GovOPlaN/govoplan-files/src/tag/v0.1.27) · [61625fb00fed](https://git.add-ideas.de/GovOPlaN/govoplan-files/commit/61625fb00fedbd4474aab1854ba9cedaf5fd18f3) - govoplan-core: [v0.1.46](https://git.add-ideas.de/GovOPlaN/govoplan-core/src/tag/v0.1.46) · [6591aaa3fdaf](https://git.add-ideas.de/GovOPlaN/govoplan-core/commit/6591aaa3fdaf19d1900ccff326c56a0b0969d9fa) Remote main branches and annotated tags were verified against the exact coordinated commits. The implementation-specific tests and EN/DE documentation recorded above remain the acceptance evidence. Cross-module focused checks, manifest shapes, 63 WebUI build configurations and 230 browser tests passed. This records source publication, not a package-registry release, runtime image, website deployment or production rollout. Database correction to the previous local-only note: the already-running development server had automatically applied Files a2b3c4d5e701, Mail b5d6e7f8091a, Connectors d2a4c6e8f0b1 and Datasources e2b8d4a0f6c3 during reloads. Their heads and expected schema/indexes were verified in the local development PostgreSQL database. A current-state backup was captured and restored into a private, isolated PostgreSQL 16 cluster; this was not a pre-upgrade backup. The supported no-op migration preserved all 281 tables and 142,287 rows by per-row SHA-256 comparison, and retained the same migration heads. Files source identity recomputation matched all 7,385 rows (2 non-null identities, zero mismatches). Both Datasources PostgreSQL concurrency tests, previously skipped without a dedicated database, passed against that isolated cluster. The test cluster was stopped. No real mail delivery, POP3 retrieval/deletion, legacy mailbox reconciliation or external connector import was initiated. Representative production load/deadline testing and real-provider race/compatibility verification remain separate operational rollout checks; this is not security certification. Operational follow-up: https://git.add-ideas.de/GovOPlaN/govoplan-core/issues/299. Closing this implementation issue: its code, regression, documentation and source-publication criteria are satisfied. Operational checks above are not claimed complete.

zemion closed this issue

2026-09-08 12:57:25 +02:00

zemion removed the

status

in-progress

label 2026-09-08 12:57:25 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-files#47