DevOps: Cloud Agent native Postgres bootstrap (#287) #420

Merged

PlasticDigits merged 1 commit from cursor/cloud-agent-postgres-native-b8a5 into main 2026-06-03 14:23:38 +00:00

Conversation 7 Commits 1 Files changed 9 +263 -28

PlasticDigits commented 2026-06-03 13:59:59 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Summary

Closes #287.

Cloud Agents consistently hit Postgres failures when Docker yieldomega-pg is unavailable. This MR adds an idempotent native PostgreSQL 16 bootstrap path on port 5433 with postgresql-client, yieldomega role (CREATEDB), and smoke verification—wired into Cloud bootstrap, AGENTS.md, and invariants.

Rebased onto main (merged guardrails §13 with #289 DeployDev scope + #287 native Postgres).

Changes

• scripts/bootstrap-cloud-postgres-native.sh — install/configure Postgres 16 on :5433, role + databases
• scripts/verify-cloud-postgres.sh — psql, pg_isready, SELECT 1, CREATEDB probe
• bootstrap-cloud-vm-toolchain.sh + .cursor/environment.json — invoke native bootstrap
• verify-cloud-vm-toolchain.sh — Postgres verify row; Docker SKIP when daemon unavailable
• Docs: AGENTS.md, invariants (INV-CLOUD-287-*), guardrails skill, qa-local-full-stack

Acceptance checklist

Criterion	Command / step	Result
psql exists; SELECT 1 on DATABASE_URL after bootstrap (no Docker)	bash scripts/bootstrap-cloud-postgres-native.sh then bash scripts/verify-cloud-postgres.sh	PASS
yieldomega can drop/recreate DB via psql (CREATEDB)	verify-cloud-postgres.sh CREATEDB probe	PASS
Indexer smoke on host Postgres only	bash scripts/verify-podium-live-anvil.sh	PASS
Bootstrap idempotent (second run no error)	bash scripts/bootstrap-cloud-postgres-native.sh ×2	PASS
AGENTS.md + .cursor/environment.json reference automated path	doc review	PASS

Blockers: none

Third-party verification

bash scripts/bootstrap-cloud-postgres-native.sh
bash scripts/verify-cloud-postgres.sh
export PATH="$HOME/.foundry/bin:$PATH"
source /usr/local/cargo/env 2>/dev/null || true
bash scripts/verify-podium-live-anvil.sh

Closes #287 when merged.

## Summary Closes [#287](https://gitlab.com/PlasticDigits/yieldomega/-/issues/287). Cloud Agents consistently hit Postgres failures when Docker `yieldomega-pg` is unavailable. This MR adds an **idempotent** native PostgreSQL 16 bootstrap path on port **5433** with `postgresql-client`, `yieldomega` role (**CREATEDB**), and smoke verification—wired into Cloud bootstrap, `AGENTS.md`, and invariants. Rebased onto `main` (merged guardrails §13 with #289 DeployDev scope + #287 native Postgres). ### Changes - `scripts/bootstrap-cloud-postgres-native.sh` — install/configure Postgres 16 on `:5433`, role + databases - `scripts/verify-cloud-postgres.sh` — `psql`, `pg_isready`, `SELECT 1`, CREATEDB probe - `bootstrap-cloud-vm-toolchain.sh` + `.cursor/environment.json` — invoke native bootstrap - `verify-cloud-vm-toolchain.sh` — Postgres verify row; Docker **SKIP** when daemon unavailable - Docs: `AGENTS.md`, invariants (**`INV-CLOUD-287-*`**), guardrails skill, qa-local-full-stack ## Acceptance checklist | Criterion | Command / step | Result | |-----------|----------------|--------| | `psql` exists; `SELECT 1` on `DATABASE_URL` after bootstrap (no Docker) | `bash scripts/bootstrap-cloud-postgres-native.sh` then `bash scripts/verify-cloud-postgres.sh` | **PASS** | | `yieldomega` can drop/recreate DB via `psql` (CREATEDB) | `verify-cloud-postgres.sh` CREATEDB probe | **PASS** | | Indexer smoke on host Postgres only | `bash scripts/verify-podium-live-anvil.sh` | **PASS** | | Bootstrap idempotent (second run no error) | `bash scripts/bootstrap-cloud-postgres-native.sh` ×2 | **PASS** | | `AGENTS.md` + `.cursor/environment.json` reference automated path | doc review | **PASS** | **Blockers:** none ## Third-party verification ```bash bash scripts/bootstrap-cloud-postgres-native.sh bash scripts/verify-cloud-postgres.sh export PATH="$HOME/.foundry/bin:$PATH" source /usr/local/cargo/env 2>/dev/null || true bash scripts/verify-podium-live-anvil.sh ``` Closes #287 when merged.

ghost1 commented 2026-06-03 14:04:40 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Security review (automated)

Commit reviewed: 4740bda2be9182af6c116f67ebc99a942a571856

Scope: Added/modified Cloud Agent dev tooling only — scripts/bootstrap-cloud-postgres-native.sh, scripts/verify-cloud-postgres.sh, wiring in bootstrap-cloud-vm-toolchain.sh / verify-cloud-vm-toolchain.sh, .cursor/environment.json, and related docs/invariants. No indexer API, frontend, or contract runtime changes.

Method: MR diff review; traced env/config inputs to sinks (shell sed, psql, role/database DDL); compared to existing local Docker Postgres path (yieldomega-pg with --network host, same yieldomega / password on port 5433).

Outcome: FINDINGS: 0 (no medium, high, or critical issues on this diff).

Notes (below reporting threshold):

• Hardcoded dev credentials and CREATEDB match pre-existing local QA conventions; DATABASE_URL targets 127.0.0.1 and bootstrap does not widen listen_addresses / pg_hba.conf beyond distro defaults (native path is not broader than the existing Docker host-network setup).
• PG_HOST_PORT / cluster env vars are operator-controlled bootstrap inputs on ephemeral Cloud VMs; no attacker-controlled path from production surfaces.

Inline threads: none (no findings to anchor).

---

Cursor automation — MR security review

## Security review (automated) **Commit reviewed:** `4740bda2be9182af6c116f67ebc99a942a571856` **Scope:** Added/modified Cloud Agent dev tooling only — `scripts/bootstrap-cloud-postgres-native.sh`, `scripts/verify-cloud-postgres.sh`, wiring in `bootstrap-cloud-vm-toolchain.sh` / `verify-cloud-vm-toolchain.sh`, `.cursor/environment.json`, and related docs/invariants. No indexer API, frontend, or contract runtime changes. **Method:** MR diff review; traced env/config inputs to sinks (shell `sed`, `psql`, role/database DDL); compared to existing local Docker Postgres path (`yieldomega-pg` with `--network host`, same `yieldomega` / `password` on port 5433). **Outcome:** **FINDINGS: 0** (no medium, high, or critical issues on this diff). **Notes (below reporting threshold):** - Hardcoded dev credentials and `CREATEDB` match pre-existing local QA conventions; `DATABASE_URL` targets `127.0.0.1` and bootstrap does not widen `listen_addresses` / `pg_hba.conf` beyond distro defaults (native path is not broader than the existing Docker host-network setup). - `PG_HOST_PORT` / cluster env vars are operator-controlled bootstrap inputs on ephemeral Cloud VMs; no attacker-controlled path from production surfaces. **Inline threads:** none (no findings to anchor). --- *Cursor automation — MR security review*

PlasticDigits commented 2026-06-03 14:15:02 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

ghost1 commented 2026-06-03 14:15:06 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

added 7 commits

• 4740bda2...0b2cbc02 - 6 commits from branch main
• 34408980 - feat(devops): native Postgres bootstrap for Cloud Agents (#287)

Compare with previous version

added 7 commits <ul><li>4740bda2...0b2cbc02 - 6 commits from branch <code>main</code></li><li>34408980 - feat(devops): native Postgres bootstrap for Cloud Agents (#287)</li></ul> [Compare with previous version](/PlasticDigits/yieldomega/-/merge_requests/50/diffs?diff_id=1832577714&start_sha=4740bda2be9182af6c116f67ebc99a942a571856)

ghost1 commented 2026-06-03 14:19:24 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Security review (automated)

Commit reviewed: 34408980eee16d64527c303880d65d73c7c7ab16

Scope: Re-review after rebase onto main. Added/modified Cloud Agent dev tooling only — scripts/bootstrap-cloud-postgres-native.sh, scripts/verify-cloud-postgres.sh, wiring in bootstrap-cloud-vm-toolchain.sh / verify-cloud-vm-toolchain.sh, .cursor/environment.json, and related docs/invariants. No indexer HTTP API, frontend, or contract runtime changes.

Method: MR diff review (vs 0b2cbc0220a156d8d62bdf4e1eb2d9f198bef329); traced env/config inputs (PG_HOST_PORT, PG_HOST, DATABASE_URL, YIELDOMEGA_PG_VERSION) to sinks (sed, psql, role/database DDL); compared to existing Docker yieldomega-pg path (--network host, same yieldomega / password on port 5433).

Outcome: FINDINGS: 0 (no medium, high, or critical issues on this diff).

Prior review: Commit 4740bda2 had the same outcome; rebase did not introduce new attacker-controlled surfaces or widen network/auth boundaries beyond that review.

Notes (below reporting threshold):

• Hardcoded dev credentials and CREATEDB match pre-existing local QA conventions; DATABASE_URL defaults to 127.0.0.1 and bootstrap does not modify listen_addresses / pg_hba.conf (native path is not broader than the documented Docker host-network setup).
• PG_HOST_PORT / cluster env vars are operator-controlled bootstrap inputs on ephemeral Cloud VMs; no path from production user input to these sinks.
• Bootstrap logs DATABASE_URL (includes dev password) to stdout — acceptable for local-only credentials already documented in AGENTS.md.

Inline threads: none (no findings to anchor).

---

Cursor automation — MR security review

## Security review (automated) **Commit reviewed:** `34408980eee16d64527c303880d65d73c7c7ab16` **Scope:** Re-review after rebase onto `main`. Added/modified Cloud Agent dev tooling only — `scripts/bootstrap-cloud-postgres-native.sh`, `scripts/verify-cloud-postgres.sh`, wiring in `bootstrap-cloud-vm-toolchain.sh` / `verify-cloud-vm-toolchain.sh`, `.cursor/environment.json`, and related docs/invariants. No indexer HTTP API, frontend, or contract runtime changes. **Method:** MR diff review (vs `0b2cbc0220a156d8d62bdf4e1eb2d9f198bef329`); traced env/config inputs (`PG_HOST_PORT`, `PG_HOST`, `DATABASE_URL`, `YIELDOMEGA_PG_VERSION`) to sinks (`sed`, `psql`, role/database DDL); compared to existing Docker `yieldomega-pg` path (`--network host`, same `yieldomega` / `password` on port 5433). **Outcome:** **FINDINGS: 0** (no medium, high, or critical issues on this diff). **Prior review:** Commit `4740bda2` had the same outcome; rebase did not introduce new attacker-controlled surfaces or widen network/auth boundaries beyond that review. **Notes (below reporting threshold):** - Hardcoded dev credentials and `CREATEDB` match pre-existing local QA conventions; `DATABASE_URL` defaults to `127.0.0.1` and bootstrap does not modify `listen_addresses` / `pg_hba.conf` (native path is not broader than the documented Docker host-network setup). - `PG_HOST_PORT` / cluster env vars are operator-controlled bootstrap inputs on ephemeral Cloud VMs; no path from production user input to these sinks. - Bootstrap logs `DATABASE_URL` (includes dev password) to stdout — acceptable for local-only credentials already documented in `AGENTS.md`. **Inline threads:** none (no findings to anchor). --- *Cursor automation — MR security review*

PlasticDigits (Migrated from gitlab.com) merged commit c6820b64aa into main 2026-06-03 14:23:38 +00:00

PlasticDigits commented 2026-06-03 14:23:40 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

mentioned in commit c6820b64aa

mentioned in commit c6820b64aa6aa8c047492c1f79de37edfa46bad4

PlasticDigits commented 2026-06-03 14:24:38 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

mentioned in merge request !421

mentioned in merge request !421

PlasticDigits commented 2026-06-08 08:45:13 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

mentioned in commit 4cb4750028

mentioned in commit 4cb475002803e72c6b5f4c2e8020f75257642ca2

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

agent:fix_bugfix

  

agent:fix_conflicts

  

agent:fix_security

  

agent:gap_analysis

  

agent:implement

  

agent:open_issues

  

agents

  

agent:security_audit

  

agent:verify

  

area

timecurve

  

arena

  

arena-v2

  

audit

  

block:feature_review

  

block:security

  

bug

  

contracts

  

design

  

devops

  

docs

Documentation

  

documentation

  

enhancement

  

epic

Epic / umbrella issue

  

feature

  

frontend

  

indexer

  

low priority

Low priority, investigate other issues first

  

megaeth

  

operations

  

ops

Deploy and operations

  

performance

  

QA

  

qa checklist

  

referrals

  

removal

Legacy removal

  

security

  

smart-contracts

  

tech-debt

  

testing

  

time-arena

TimeArena v2 revamp

  

timecurve

  

visual-qa

No labels

agent:fix_bugfix

agent:fix_conflicts

agent:fix_security

agent:gap_analysis

agent:implement

agent:open_issues

agents

agent:security_audit

agent:verify

area

timecurve

arena

arena-v2

audit

block:feature_review

block:security

bug

contracts

design

devops

docs

documentation

enhancement

epic

feature

frontend

indexer

low priority

megaeth

operations

ops

performance

QA

qa checklist

referrals

removal

security

smart-contracts

tech-debt

testing

time-arena

timecurve

visual-qa

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

code/yieldomega!420

No description provided.