Merge branch 'main' into fix/57-export-consistent-snapshot

Author: LeeroyHannigan

.agents/skills/extenddb/references/setup/02-dependency-checks.md

@@ -8,7 +8,7 @@ This file lists the dependency checks the `extenddb-setup` skill runs before pro
 
 | Dependency | Check command | Minimum version | Rationale |
 |---|---|---|---|
-| Rust toolchain | `cargo --version` and `rustc --version` | 1.85 | extenddb is a Rust workspace; older toolchains fail `cargo build --release`. |
+| Rust toolchain | `cargo --version` and `rustc --version` | 1.88 | extenddb is a Rust workspace; older toolchains fail `cargo build --release`. |
 | PostgreSQL client | `psql --version` | 14 | extenddb speaks the Postgres protocol at init and runtime; older clients may lack required features. |
 | PostgreSQL server readiness | `pg_isready` | n/a (server-side check) | Confirms the server is reachable before `extenddb init`. |
 | Python 3 | `python3 --version` | 3.10 | Required by the sample apps and the docs build pipeline. |
@@ -29,7 +29,7 @@ If `which cargo` exits nonzero, Rust is not installed. Install:
 - Linux (Fedora/RHEL): `curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh`
 - macOS: `brew install rustup-init && rustup-init`
 
-If Rust is installed but `rustc --version` reports older than 1.85:
+If Rust is installed but `rustc --version` reports older than 1.88:
 
 ```bash
 rustup update
@@ -84,7 +84,7 @@ If `python3 --version` reports older than 3.10, upgrade via the same package man
 
 ## Version parsing
 
-`rustc --version` prints `rustc 1.85.0 (abcdef0 2025-01-01)`. Extract the version field with `awk`:
+`rustc --version` prints `rustc 1.88.0 (abcdef0 2025-01-01)`. Extract the version field with `awk`:
 
 ```bash
 rustc --version | awk '{print $2}'
@@ -96,11 +96,11 @@ rustc --version | awk '{print $2}'
 psql --version | awk '{print $3}'
 ```
 
-Compare the extracted version against the minimum (1.85 for Rust, 14 for Postgres) by splitting on `.` and comparing numerically. For skill-level checks, a string prefix comparison (`[[ "$PG_VER" < "14" ]]`) is adequate because major versions are single or double digits.
+Compare the extracted version against the minimum (1.88 for Rust, 14 for Postgres) by splitting on `.` and comparing numerically. For skill-level checks, a string prefix comparison (`[[ "$PG_VER" < "14" ]]`) is adequate because major versions are single or double digits.
 
 ## Rust version upgrade path
 
-If Rust is installed via rustup and `rustc --version` reports older than 1.85, the fix is:
+If Rust is installed via rustup and `rustc --version` reports older than 1.88, the fix is:
 
 ```bash
 rustup update

.agents/skills/extenddb/references/setup/03-build-stage.md

@@ -59,4 +59,4 @@ This should print the extenddb version string. If it does not, the build failed
 cargo build --release --verbose
 ```
 
-Common causes of silent build failure are a missing system library (for example, `libpq-dev` or `openssl-dev` on Linux), a Rust toolchain older than 1.85, or a disk full condition under `target/`. The verbose output names the failing crate and the missing dependency.
+Common causes of silent build failure are a missing system library (for example, `libpq-dev` or `openssl-dev` on Linux), a Rust toolchain older than 1.88, or a disk full condition under `target/`. The verbose output names the failing crate and the missing dependency.

.github/CODEOWNERS

@@ -0,0 +1,32 @@
+# CODEOWNERS — auto-requests reviewers and (with branch protection enabled)
+# requires their approval to merge.
+#
+# Order matters: the LAST matching pattern wins.
+# Syntax: <path-glob>   <owner1> <owner2> ...
+#
+# To enforce: in repo Settings → Branches → branch protection rule for `main`,
+# enable "Require review from Code Owners".
+
+# Default — any file not matched below.
+*                              @amrith @c33howard @jcshepherd @pdf-amzn @LeeroyHannigan @yesyayen
+
+# Wire protocol & DynamoDB-compatible API surface.
+crates/server/                 @amrith @c33howard @jcshepherd @pdf-amzn @LeeroyHannigan @yesyayen
+crates/core/                   @amrith @c33howard @jcshepherd @pdf-amzn @LeeroyHannigan @yesyayen
+
+# Storage abstraction — breaking changes ripple to every backend.
+crates/storage/                @amrith @c33howard @jcshepherd @pdf-amzn @LeeroyHannigan @yesyayen
+crates/storage-postgres/       @amrith @c33howard @jcshepherd @pdf-amzn @LeeroyHannigan @yesyayen
+crates/engine/                 @amrith @c33howard @jcshepherd @pdf-amzn @LeeroyHannigan @yesyayen
+
+# Auth & SigV4 — security-sensitive.
+crates/auth/                   @amrith @c33howard @jcshepherd @pdf-amzn @LeeroyHannigan @yesyayen
+
+# Public CLI surface.
+crates/bin/                    @amrith @c33howard @jcshepherd @pdf-amzn @LeeroyHannigan @yesyayen
+
+# Process & governance documents.
+docs/adr/                      @amrith @c33howard @jcshepherd @pdf-amzn @LeeroyHannigan @yesyayen
+docs/rfcs/                     @amrith @c33howard @jcshepherd @pdf-amzn @LeeroyHannigan @yesyayen
+CONTRIBUTING.md                @amrith @c33howard @jcshepherd @pdf-amzn @LeeroyHannigan @yesyayen
+.github/                       @amrith @c33howard @jcshepherd @pdf-amzn @LeeroyHannigan @yesyayen

.github/pull_request_template.md

@@ -21,6 +21,11 @@ Closes #
 - [ ] I have added or updated tests for new functionality
 - [ ] I have updated documentation if behavior changed
 - [ ] Breaking changes are noted below (if any)
+- [ ] If this changes the wire protocol, `Storage` trait, auth model, on-disk
+      format, or public CLI surface, an RFC has been accepted or is linked
+      below. Otherwise, an ADR captures the decision (link below).
+
+ADR / RFC: <!-- link or "n/a" -->
 
 ## Breaking changes
 

.github/workflows/clippy.yml

@@ -0,0 +1,17 @@
+name: Clippy
+on:
+  pull_request:
+  merge_group:
+  push:
+    branches: [main]
+
+jobs:
+  clippy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo clippy --all-targets -- -D warnings

.github/workflows/fmt.yml

@@ -0,0 +1,16 @@
+name: Format
+on:
+  pull_request:
+  merge_group:
+  push:
+    branches: [main]
+
+jobs:
+  fmt:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt
+      - run: cargo fmt --all -- --check

.github/workflows/test.yml

@@ -0,0 +1,33 @@
+name: Test
+on:
+  pull_request:
+  merge_group:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  run-tests:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        toolchain: [stable, "1.88.0"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ matrix.toolchain }}
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo test --workspace
+
+  test:
+    runs-on: ubuntu-latest
+    needs: run-tests
+    if: always()
+    steps:
+      - run: |
+          if [ "${{ needs.run-tests.result }}" != "success" ]; then
+            exit 1
+          fi

AGENTS.md

@@ -9,7 +9,7 @@ License. ExtendDB is a clean-room implementation of the DynamoDB wire protocol,
 by AWS engineers. It is not a fork of DynamoDB and contains no DynamoDB source code. ExtendDB speaks the DynamoDB wire
 protocol: any AWS SDK, CLI, or tool that works with DynamoDB works with ExtendDB, unchanged.
 
-- **Language:** Rust (edition 2024, MSRV 1.85+)
+- **Language:** Rust (edition 2024, MSRV 1.88+)
 - **Storage backend:** PostgreSQL 14+
 - **Architecture:** Async (tokio), trait-based storage abstraction
 - **Authentication:** Mandatory SigV4 with built-in IAM (users, groups, roles, policies)
@@ -81,7 +81,7 @@ extenddb (bin)
 
 ### Prerequisites
 
-- Rust 1.85+ (`rustup update`)
+- Rust 1.88+ (`rustup update`)
 - PostgreSQL 14+ running locally (see `docs/local-postgres-setup.md`)
 - Python 3.10+ for tests (`python3 -m venv ~/venvs/extenddb-venv && source ~/venvs/extenddb-venv/bin/activate && pip install -r requirements.txt`)
 
@@ -288,7 +288,7 @@ Or use the web console at `https://127.0.0.1:8000/console/`.
 # Health check
 curl --cacert ~/.extenddb/tls/cert.pem https://127.0.0.1:8000/health
 
-# Prometheus metrics
+# JSON metrics (DynamoDB CloudWatch-style)
 curl --cacert ~/.extenddb/tls/cert.pem https://127.0.0.1:8000/metrics
 
 # Syslog (Linux)
@@ -369,14 +369,14 @@ python3 docs/build-docs.py
 ## Code Style and Conventions
 
 - **Rust edition:** 2024
-- **MSRV:** 1.85
+- **MSRV:** 1.88
 - **Async:** tokio, no `#[async_trait]` (use RPITIT)
 - **Error handling:** `thiserror` for library errors, `anyhow` for application errors
 - **Serialization:** `serde` + `serde_json`
 - **Database:** `sqlx` with compile-time query checking (PostgreSQL)
 - **HTTP:** `axum` + `tower` + `hyper`
 - **Logging:** `tracing` + `tracing-subscriber`
-- **Metrics:** `metrics` + `metrics-exporter-prometheus`
+- **Metrics:** in-memory `MetricsCollector` (`crates/core/src/metrics/`), exposed as JSON via `/metrics` with DynamoDB CloudWatch-style metric names and dimensions
 - **TLS:** `rustls` + `axum-server`
 
 ### Naming Conventions

CONTRIBUTING.md

@@ -1,15 +1,39 @@
 # Contributing to ExtendDB
 
-Thank you for your interest in contributing to ExtendDB.
+Thank you for your interest in contributing to ExtendDB!
 
 ## Getting Started
 
 ### Prerequisites
 
-- Rust 1.85+ (stable)
+- Rust 1.88+ (stable)
 - PostgreSQL 14+
 - Python 3.10+ (for integration tests)
 
+### Prepare
+
+Familiarize yourself with ExtendDB's design and developer expectations by reviewing:
+- [Architecture Guide](/docs/manuals/01-architecture-guide.md)
+- [Design Guide](/docs/manuals/02-design-guide.md)
+- [Developer Guide](/docs/manuals/06-developer-test-guide.md)
+
+### Recommended Workflow
+
+We suggest following the workflow below for proposing and contributing improvements to ExtendDB:
+1. Find or create an issue in [ExtendDB's Open Issues](https://github.com/ExtendDB/extenddb/issues) that
+ describes the fix, improvement or feature that you plan to work on.
+1. For large changes, refactorings, new features, or changes to API specifications, wire protocol, backend
+ storage traits, authentication or authorization, schema or CLI commands, please submit an
+ [RFC](docs/rfcs/README.md) as a pull request and link it to the GitHub issue. Allow time for the RFC to
+ be reviewed, discussed and voted on.
+1. Create a fork of the [ExtendDB 'main' branch](https://github.com/ExtendDB/extenddb/tree/main).
+1. Clone your fork into your development environment.
+1. Make, build, test and self-review your changes on a feature branch on your fork.
+1. Make your changes with clear, focused commits.
+1. Ensure all tests pass and code is properly formatted.
+1. Submit your changes as a pull request, linked to the issue and (if applicable) RFC that your
+ work addresses.
+
 ### Build
 
 ```bash
@@ -23,7 +47,7 @@ cargo build --workspace
 cargo test --workspace
 
 # Integration tests (requires a running extenddb server)
-pytest tests/
+devtools/run-tests --extenddb --pytest
 ```
 
 ### Code Style
@@ -39,13 +63,26 @@ cargo clippy -- -W clippy::pedantic -W clippy::unwrap_used -W clippy::expect_use
 - Address all clippy warnings or add `#[allow(...)]` with a justification comment.
 - Avoid `.unwrap()` and `.expect()` in library crates — use `?` or explicit error handling.
 
-### Submitting Changes
+## When you need an ADR or an RFC
+
+ExtendDB uses two lightweight processes to keep core decisions reviewable:
+
+- **ADR** ([`docs/adr/`](docs/adr/)) — records a decision *after* it has been
+  made, in four sections: Context, Options Considered, Decision, Consequences.
+  Use for narrower, internal calls (for example, "we chose `ring` over
+  `openssl`" or "ADRs live in `docs/adr/`").
+- **RFC** ([`docs/rfcs/`](docs/rfcs/)) — proposes a change *before* it is made and
+  invites a comment period. Use for changes to the wire protocol, the
+  `Storage` trait, the auth model, on-disk format, or the public CLI surface.
+  See [`docs/rfcs/README.md`](docs/rfcs/README.md) for the lifecycle.
+
+If you are not sure which to write, open an issue describing the change. A
+maintainer will tell you which path fits.
 
-1. Fork the repository and create a branch from `main`.
-2. Make your changes with clear, focused commits.
-3. Ensure all tests pass and code is formatted.
-4. Open a pull request with a description of what changed and why.
+Some areas are protected by [`.github/CODEOWNERS`](.github/CODEOWNERS) — PRs
+touching them require approval from the listed owners.
 
 ## License
 
-By contributing, you agree that your contributions will be licensed under the [Apache License 2.0](LICENSE).
+By contributing, you agree that your contributions will be licensed under the
+[Apache License 2.0](LICENSE).