← back to Tk11438 Postgres Migration
verification/gracie-rollout/independent-preflight.json
308 lines
{
"task": "TK-11438",
"at": "2026-09-11T20:12:25.834608+00:00",
"scope": "Gracie local privacy and startup static review",
"source_sha256": {
"/Users/macstudio3/Projects/gracie-internal/server.js": "b6a0dee64b777d1e3c41f806d93f51e44d803d3f8f300f0cc245cb75edf5406e",
"/Users/macstudio3/Projects/gracie-internal/lib/vendor-requests.js": "ce0099389bf08e01e2a7a08f2a1bf442e146cd0ea17500abd583bb93af840702"
},
"startup_email_path": false,
"startup_ddl": true,
"requests_get_before_apply": false,
"local_configs": [
{
"path": "/opt/homebrew/etc/nginx/fastcgi_params",
"sha256": "f37852d0113de30fa6bfc3d9b180ef99383c06739530dd482a8538503afd5a58",
"gracie_or_port_match": false,
"directives": []
},
{
"path": "/opt/homebrew/etc/nginx/scgi_params",
"sha256": "f27b2027c571ccafcfb0fbb3f54d7aeee11a984e3a0f5a1fdf14629030fc9011",
"gracie_or_port_match": false,
"directives": []
},
{
"path": "/opt/homebrew/etc/nginx/fastcgi.conf",
"sha256": "b2c3d480a58f61f3a7dc61850b461e892e36f236317765a4f2f6d558c928fa57",
"gracie_or_port_match": false,
"directives": []
},
{
"path": "/opt/homebrew/etc/nginx/uwsgi_params",
"sha256": "015cb581c2eb84b1a1ac9b575521d5881f791f632bfa62f34b26ba97d70c0d4f",
"gracie_or_port_match": false,
"directives": []
},
{
"path": "/opt/homebrew/etc/nginx/koi-win",
"sha256": "de518a9eafe86c8bc705e296d0ef26135835b46bdc0de01d1d50a630fa5d341e",
"gracie_or_port_match": false,
"directives": []
},
{
"path": "/opt/homebrew/etc/nginx/mime.types",
"sha256": "6f95d1d7d75e3c072907d845622a69d23110d1266c16ff122b3109b8b21f3ae9",
"gracie_or_port_match": false,
"directives": []
},
{
"path": "/opt/homebrew/etc/nginx/koi-utf",
"sha256": "b5f8a6d411db5e5d11d151d50cd1e962444732593adec0e1ef0a8c6eebec63ee",
"gracie_or_port_match": false,
"directives": []
},
{
"path": "/opt/homebrew/etc/nginx/win-utf",
"sha256": "0f221e54163907249b5397cb7357a4a9c946907ed4839c262dd09d8c9f9ca185",
"gracie_or_port_match": false,
"directives": []
},
{
"path": "/opt/homebrew/etc/nginx/nginx.conf",
"sha256": "fe6ba480238ac9d0f347bee06704b81b75d133a948caf61d083e5e744329e4bf",
"gracie_or_port_match": false,
"directives": [
{
"line": 18,
"text": "include mime.types;"
},
{
"line": 36,
"text": "listen 8080;"
},
{
"line": 114,
"text": "include servers/*;"
}
]
},
{
"path": "/Users/macstudio3/.cloudflared/ig-board.yml",
"sha256": "5a8a0ae5bc45dbde0569ba7d500e5928b8e61b6d6be070dd1c69db9f4f2f8de8",
"gracie_or_port_match": false,
"directives": [
{
"line": 5,
"text": "service: http://100.82.17.107:9810"
}
]
},
{
"path": "/Users/macstudio3/.cloudflared/subfinder.yml",
"sha256": "ce811493cfd35d5277d4c2d2c4eaea0a41c80eff89f537df4cb4929fc1c7ccae",
"gracie_or_port_match": false,
"directives": [
{
"line": 5,
"text": "service: http://127.0.0.1:9948"
}
]
},
{
"path": "/Users/macstudio3/.cloudflared/liveskus.yml",
"sha256": "a30c9d8acfacbbd2ecaf3abe3ab63fa379a4885dab7fc5efe2e4d953cbbc463a",
"gracie_or_port_match": false,
"directives": [
{
"line": 5,
"text": "service: http://127.0.0.1:9797"
}
]
},
{
"path": "/Users/macstudio3/.cloudflared/buildingpermits.yml",
"sha256": "aa47da9b5e71cab0bb1042e1a41be80d8adbc8995d111891e0288f16467805ea",
"gracie_or_port_match": false,
"directives": [
{
"line": 5,
"text": "service: http://127.0.0.1:9873"
}
]
},
{
"path": "/Users/macstudio3/.cloudflared/gated.yml",
"sha256": "f1bc8825dbafc80305c9dc8f9c55f162bbddc2a10f27eef76a2a009e93870078",
"gracie_or_port_match": false,
"directives": [
{
"line": 5,
"text": "service: http://127.0.0.1:9801"
}
]
},
{
"path": "/Users/macstudio3/.cloudflared/tickets.yml",
"sha256": "7fff95a4568cfe8b2abf0a0933ffa318ccc8d8df6ad23a725064dee1ead713f8",
"gracie_or_port_match": false,
"directives": [
{
"line": 5,
"text": "service: http://127.0.0.1:9794"
}
]
},
{
"path": "/Users/macstudio3/.cloudflared/exo.yml",
"sha256": "87dbb352dcb4336b6b3a22393d58cc87e2d1aa1636c7d975bbb69addced52adf",
"gracie_or_port_match": false,
"directives": [
{
"line": 5,
"text": "service: http://127.0.0.1:52415"
}
]
},
{
"path": "/Users/macstudio3/.cloudflared/followup2.yml",
"sha256": "2b66d81e9476648bd96436e7ac26b93413952ca3b34fd6e72aa2c02386a73705",
"gracie_or_port_match": false,
"directives": [
{
"line": 5,
"text": "service: http://127.0.0.1:3737"
},
{
"line": 7,
"text": "service: http://127.0.0.1:9820"
},
{
"line": 9,
"text": "service: http://127.0.0.1:9791"
},
{
"line": 11,
"text": "service: http://127.0.0.1:9768"
},
{
"line": 13,
"text": "service: http://127.0.0.1:9768"
},
{
"line": 15,
"text": "service: http://127.0.0.1:4901"
},
{
"line": 17,
"text": "service: http://127.0.0.1:4902"
},
{
"line": 19,
"text": "service: http://127.0.0.1:4903"
},
{
"line": 21,
"text": "service: http://127.0.0.1:4904"
},
{
"line": 23,
"text": "service: http://127.0.0.1:4905"
},
{
"line": 25,
"text": "service: http://127.0.0.1:4906"
},
{
"line": 27,
"text": "service: http://127.0.0.1:9758"
},
{
"line": 29,
"text": "service: http://127.0.0.1:9792"
},
{
"line": 31,
"text": "service: http://127.0.0.1:9795"
},
{
"line": 33,
"text": "service: http://127.0.0.1:9794"
},
{
"line": 35,
"text": "service: http://127.0.0.1:9821"
},
{
"line": 37,
"text": "service: http://127.0.0.1:9915"
},
{
"line": 39,
"text": "service: http://127.0.0.1:9790"
},
{
"line": 41,
"text": "service: http://127.0.0.1:9926"
},
{
"line": 43,
"text": "service: http://127.0.0.1:9772"
}
]
}
],
"running_proxy_tunnel_processes": [
{
"pid": 1144,
"command": "nginx:",
"gracie_or_port_match": false,
"config_paths": [],
"ssh_forwarding": false,
"raw_args_omitted": true
},
{
"pid": 1458,
"command": "nginx:",
"gracie_or_port_match": false,
"config_paths": [],
"ssh_forwarding": false,
"raw_args_omitted": true
},
{
"pid": 3602,
"command": "ssh",
"gracie_or_port_match": false,
"config_paths": [],
"ssh_forwarding": false,
"raw_args_omitted": true
},
{
"pid": 59435,
"command": "ssh",
"gracie_or_port_match": false,
"config_paths": [],
"ssh_forwarding": false,
"raw_args_omitted": true
}
],
"gracie_config_matches": [],
"gracie_process_matches": [],
"verdict": "PASS_BOUNDED_REVIEW",
"limits": [
"Cloud-managed ingress configurations and remote machine routes not queried",
"Loopback bind still requires post-apply listener and non-loopback rejection proof",
"No application imports, HTTP requests, jobs, sends, or config changes performed"
],
"mandatory_checks": [
"Loopback-only10073 listener with noIPv6/wildcard listener",
"Non-loopback LAN and Tailscale addresses reject connection",
"Post-startup schema success before requestsGET",
"Auth missing/invalid401 and valid200",
"Catalog count/hash unchanged",
"Both configured PostgreSQL identities preserved and Unix-socket backend observed",
"Gracie effective/saved env fields agree; no explicit PGHOST defeats socket"
],
"helper_review": {
"at": "2026-09-11T20:13:27.454671+00:00",
"sha256": "52bb37fe9e35758f74afe0af8b6c181e8dee6fe436ae5b3bf4150f92eee17dd1",
"verdict": "ACCEPT",
"scope": "server socket fallback and loopback bind, vendor pool host selection, exactly Gracie PG top/nested effective+saved fields",
"rollback": "Private source before/after/recovery copies; recovery retains127.0.0.1; before/after/recovery hashes accepted, other hashes rejected; repeated recovery and4partial states rehearsed",
"conditions": [
"Post-apply test all nonloopback local IPv4 interfaces including Tailscale if present",
"Confirm startup schema success before GET requests route; route retries DDL if schemaReady rejected"
]
}
}