Release v0.1.57 · block/schemabot

Highlights

Durable replay no longer wedges on one wide payload — The durable dispatch claim query selected every column, including the delivery payload, under an ordering no index satisfies, so MySQL filesorted the payload into each sort record. A single delivery larger than sort_buffer_size failed the claim query with Error 1038 (HY001): Out of sort memory on every poll, permanently stalling durable replay behind that one row. FindNext now claims in two steps — a narrow ordered key scan, then a keyed fetch of the payload — so claim latency and memory no longer scale with payload size. (#860)

Aggregate deployments stay off databases they have not registered — On repositories with no directory allowlist, schema-config discovery kept every config it found, so an aggregate leader configured with no databases of its own would try to plan a participant's database and turn a DatabaseNotConfiguredError into failing aggregate checks plus a "Plan Failed" comment on routine fan-out PRs. Discovery now keeps only configs the deployment actually registers. (#865)

Read-tier access for gateway-verified service callers — forward_auth previously had a single lane: an authenticating proxy forwarding a human's identity headers. A service calling the API as itself was rejected as untrusted even when a mesh gateway had already terminated and verified its client certificate, and the only workaround — trusting that gateway as a proxy — would have let anything behind it self-assert user and group headers into the write tier. A second, read-only lane now grants gateway-verified service callers read-tier access without that escalation, configured by forward_auth.trusted_gateway_spiffe, forward_auth.read_service_spiffe, and the optional forward_auth.caller_spiffe_header. The lane fails closed — gateways without callers (or callers without a gateway) refuse to start, it requires SPIFFE-anchored proxy trust, a SPIFFE ID may never be both a trusted proxy and a trusted gateway, service callers are denied the write tier (service_caller_write), and an empty config disables the lane entirely. All three keys are new and optional, so existing configuration is unaffected. (#864)

Untrusted-proxy denials name the identity that arrived — An untrusted_proxy denial logged only the path and the remote address, which behind a sidecar is always loopback, leaving an operator unable to answer what identity the request presented. The denial log now carries xfcc_uris (the SPIFFE URI SVIDs parsed from X-Forwarded-Client-Cert) and xfcc_uri_count, so a missing trust-anchor entry is visible directly in the log line. (#863)

Never-written task readiness fields removed — Per-shard readiness has always been folded into canonical task state before it leaves the engine, so the persisted tasks.ready_to_complete column and the ShardProgress.ready_to_complete proto field were never written or read. Both are gone: the column is dropped from the embedded tasks schema, and proto field 8 is reserved, keeping the wire format compatible with older peers. Two upgrade notes: EnsureSchema refuses the resulting DROP COLUMN unless storage.allow_destructive_schema_changes is set, so the column is simply left in place by default (a warning is logged, startup continues) — do not enable that flag until every process reading the table is on this version or newer; and, as always, upgrade the control plane before any consumer that reads ShardProgress. (#861)
Advisory lockers injected per target — The last package-level namedlock.Locker bindings are replaced by per-target injection, and a target with no locker now fails closed instead of opening a connection. (#859)

Spirit updated to v0.15.2-0.20260727035859-220f8b6cfca1 — Picks up read-side copier autoscaling and the matching connection-pool sizing; no schemabot source changes were required. Spirit / checkpoint compatibility: the checkpoint table format (_<table>_chkpnt) is unchanged across this range — pkg/checkpoint is byte-identical between the old and new pins — so a copy that is in flight when the process restarts resumes from its checkpoint instead of restarting from zero. (#855)

Latest plan-comment lookup uses slices.Backward — Behavior-preserving rewrite of the newest-first scan in the webhook plan-comment path. (#825)

Full Changelog: v0.1.56...v0.1.57