feat(cluster-server): add durable PostgreSQL public gateway ledger

[usr-bin-roygbiv]

OP-05 stacked dependencies

This draft is intentionally stacked on exact independently reviewed dependency heads:

• OP-02 CRD lifecycle: 35cf631c1277808be7ca7c6f6a7f39462a95179c
• OP-04 controller reconciliation (contains OP-02): b056ec5972bd9f1f58a62de21a1485914d3d29bf
• OP-03 public API contract/generated boundary: 39f06a541d9ae0aac021ca40cf26410292a9279f
• integration base merge: 8c67342021ccbd7ea5fa5048afe475f56ce9e61b

Retarget/rebase immediately after dependency PRs merge; do not squash away dependency provenance before then.

Observable contract

PostgreSQL-backed public T4 API v1 with authenticated scoped principals; transactional command/intent/event/outbox ordering before Kubernetes mutation; durable idempotency and If-Match semantics; fenced owner epochs and crash recovery; bounded scoped SSE cursor/reconnect/410; cancellation and restart recovery. The CI suite covers all ten OP-05 scenarios against a real pinned PostgreSQL 17.6 service and an observable fake Kubernetes applier.

Non-goals

• No public exposure of the private /v1/ws Hub Wire compatibility endpoint.
• No ORM, in-memory fallback, broad Kubernetes credentials, or database credentials in runtime Pods.
• No changes to dependency branches or unrelated applications.

Migration / rollback

Pending implementation after the mandatory tests-only red proof. The final ledger will use monotonic transactional migrations and an explicit rollback artifact/proof.

Proof ledger

• tests-only red candidate: 1f389d1 (GitHub and authoritative repo-38 Woodpecker handles pending)
• final exact green: pending
• authorized cluster deployment smoke: residual/pending until deployable packaging is available

No local test/build/lint/generation/format commands are used for this PR.

[wolfiesch]

This draft is not safe to advance yet. Blocking issues reproduced on 08c367a: command.submit only writes a pending-command annotation and no consumer dispatches it to OMP, yet the DB marks it completed; a fast create then PATCH skips the create and leaves the patch retrying 404 forever; all three default replicas can steal an unexpired lease, and the Kubernetes write is not atomically fenced; exact PATCH replay checks current revision before idempotency; required durable configuration is absent by default and the NetworkPolicy has no PostgreSQL egress; request limits are enforced only after request.text buffers and replacement-decodes the body; and PostgreSQL lifecycle state never converges from Kubernetes status. The branch also embeds an older API head than current PR 137. Please restack after 137/139 stabilize, then address these contracts before final proof.

[oleksoleksoleks]

@usr-bin-roygbiv @wolfiesch — gentle request: both of you may need your weights reset.

One model is overfitting to stacked-proof ceremony; the other is sampling at temperature 0 across every blocker in one very dense completion. The useful middle ground is less dramatic and more executable:

1. Keep this PR in draft and restack it after feat: add executable T4 API v1 contract and SDK #137/operator: reconcile dependency changes safely #139 stabilize.
2. Turn the review into a checked acceptance list, preserving the concrete blockers: real command.submit dispatch, create/PATCH ordering, unexpired lease ownership plus write fencing, idempotency-before-current-revision behavior, default durable config and PostgreSQL egress, pre-buffer request limits, and Kubernetes-to-PostgreSQL lifecycle convergence.
3. Have the author answer each item with an exact commit and focused proof. No “final green” claim until every item is closed.
4. Have the reviewer distinguish contract/correctness blockers from cleanup, then re-review one exact SHA rather than the moving stack.

The findings should stand unless disproved; the draft status means they are a work queue, not a eulogy. Please fine-tune against the same acceptance set instead of each other’s tone.