Repository navigation

(m)TLS to PG - #627

Draft

shortishly wants to merge 564 commits into

623-support-postgresql-mtls-client-authentication-for-backend-connectionsfrom

main

This pull request is big! We're only showing the most recent 250 commits

Commits on Sep 25, 2026
- ci: split into two tiers and add merge_group trigger for a merge queue
  
  solace-aross
  and
  claude
  committed
  f9919c0
- ci: key non-PR concurrency on ref@sha, assert Tier A ran on PRs
  
  solace-aross
  and
  claude
  committed
  c06e840
- ci: keep smoke in the ci-gate
  
  solace-aross
  and
  claude
  committed
  fbf6676
- fix(slatedb): treat update_group without a version as create-only
  
  sgamelin
  and
  claude
  committed
  139af87
- Merge origin/main into 757-slatedb-update-group-create-only
  
  sgamelin
  and
  claude
  committed
  55dd08e
- ci: MERGE_QUEUE rollback switch, named ci-gate failures, pin example-java
  
  solace-aross
  and
  claude
  committed
  b26d8a2
- ci: keep the fork-PR guard on package push and smoke
  
  solace-aross
  and
  claude
  committed
  7fc3cf0
- Merge pull request #756 from nisshi-io/753-single-test-binary-per-crate
  sgamelin
  authored
  f7b8d49
- test: cover restart, stale versions and racing group updates
  
  sgamelin
  and
  claude
  committed
  11fcb82
- Merge remote-tracking branch 'origin/main' into 757-slatedb-update-group-create-only
  sgamelin
  committed
  6d690f6
- test(broker): move group update tests into the it binary
  
  sgamelin
  and
  claude
  committed
  6b45c1f
- Merge pull request #759 from nisshi-io/ci/merge-queue-two-tier
  solace-aross
  authored
  73f2e22
- docs: CLAUDE.md toolchain is 1.98, CI pipeline is two-tier
  
  solace-aross
  and
  claude
  committed
  e724e43
- Merge pull request #763 from nisshi-io/757-slatedb-update-group-create-only
  sgamelin
  authored
  76129a1
- Merge pull request #767 from nisshi-io/docs/claude-md-toolchain-ci
  solace-aross
  authored
  0822346
Commits on Sep 27, 2026
- build(deps): bump taiki-e/install-action from 2.87.13 to 2.87.18
  
  dependabot[bot]
  authored and
  solace-aross
  committed
  c8ec9f0
- build(deps): bump actions-rust-lang/setup-rust-toolchain
  
  dependabot[bot]
  authored and
  solace-aross
  committed
  27717ab
- ci: preserve release job's warning-denial opt-out under setup-rust-toolchain v2.0.0
  
  solace-aross
  and
  claude
  committed
  2cb9391
- Merge pull request #758 from nisshi-io/dependabot/github_actions/main/taiki-e/install-action-2.87.18
  solace-aross
  authored
  09d1d75
Commits on Sep 28, 2026
Commits on Sep 29, 2026
- fix(storage): reject produce batches whose last_offset_delta disagrees with record_count
  
  solace-aross
  and
  claude
  committed
  5bdb5e8
- fix(storage): stop DeleteGroups with an empty group id wiping every group
  
  solace-aross
  and
  claude
  committed
  23b19b5
- docs(governance): make broader-impact approval visible on the PR
  
  solace-aross
  and
  claude
  committed
  5bb9db7
- fix(storage): validate topic names and partition counts in CreateTopics
  
  solace-aross
  and
  claude
  committed
  7c1f5a8
- chore: copy .env into Claude Code worktrees and document worktree builds
  
  sgamelin
  and
  claude
  committed
  ead6cac
- fix(broker): reject out-of-range session_timeout_ms in JoinGroup
  
  solace-aross
  and
  claude
  committed
  2495c72
- fix(proxy): keep offset deltas contiguous when coalescing produce batches
  
  solace-aross
  and
  claude
  committed
  f7d6ed5
- fix(storage): accept "" in DeleteGroups on backends that can store it
  
  solace-aross
  and
  claude
  committed
  bbf8b10
- test(sans-io): pin the header-count preallocation caps
  
  solace-aross
  and
  claude
  committed
  2ac110e
- refactor(storage): simplify the CreateTopics partition-count check
  
  solace-aross
  and
  claude
  committed
  86290bb
- build(deps): bump zstd from 0.13.3 to 0.14.0
  dependabot[bot]
  authored
  fc3d6df
- build(deps): bump taiki-e/install-action from 2.87.18 to 2.87.21
  dependabot[bot]
  authored
  ff07a86
- Merge pull request #781 from nisshi-io/opensource-governance
  solace-aross
  authored
  9a487d7
- Merge pull request #793 from nisshi-io/dependabot/cargo/main/zstd-0.14.0
  solace-aross
  authored
  785fda9
- Merge pull request #794 from nisshi-io/dependabot/github_actions/main/taiki-e/install-action-2.87.21
  solace-aross
  authored
  62a2048
- Merge pull request #783 from nisshi-io/fix/validate-produce-last-offset-delta
  solace-aross
  authored
  dbe8370
- build(deps): upgrade cached from 0.56.0 to 2.0.2
  
  solace-aross
  and
  claude
  committed
  86c43e6
- Merge pull request #787 from nisshi-io/docs/worktree-builds
  sgamelin
  authored
  16d19ce
- build: pull MinIO from pgsty/silo instead of building it from source
  
  sgamelin
  and
  claude
  committed
  8707ec2
- Merge pull request #788 from nisshi-io/fix/join-group-session-timeout
  solace-aross
  authored
  24c7cde
- Merge pull request #778 from nisshi-io/ci/codeql-action-4.38.2
  solace-aross
  authored
  69a6170
- Merge pull request #800 from nisshi-io/ci/pgsty-silo
  sgamelin
  authored
  ec407fb
Commits on Sep 30, 2026
Commits on Oct 1, 2026
- build(deps): bump thiserror from 2.0.19 to 2.0.21
  dependabot[bot]
  authored
  1694319
Commits on Oct 2, 2026
- Merge pull request #819 from nisshi-io/dependabot/cargo/main/thiserror-2.0.21
  solace-aross
  authored
  7d89055
- build: add `just seed-target` to reuse dependency builds in new worktrees
  
  sgamelin
  and
  claude
  committed
  1476899
- build: seed only target/debug, and move the seed into place last
  
  sgamelin
  and
  claude
  committed
  36fbee4
- docs: fix the doc comments that rustdoc rejects
  
  sgamelin
  and
  claude
  committed
  edb9be9
- ci: fail on a rustdoc warning, also in the docs of private items
  
  sgamelin
  and
  claude
  committed
  df83ba2
- docs: add comment rules for contributors and agents
  
  sgamelin
  and
  claude
  committed
  4abcf50
- docs: give each feature its own test file
  
  sgamelin
  and
  claude
  committed
  65f31b2
- docs: link the comment rules from CONTRIBUTING.md
  
  sgamelin
  and
  claude
  committed
  1efe0ef
- Merge pull request #825 from nisshi-io/822-comment-rules
  sgamelin
  authored
  13c2966
- Merge pull request #824 from nisshi-io/chore/seed-worktree-target
  sgamelin
  authored
  4f76946
- docs: reconcile CLAUDE.md with post-storage-split crate layout
  
  solace-aross
  and
  claude
  committed
  f204a03
- build(deps): upgrade arrow/parquet to 58 with iceberg 0.10 and deltalake 0.32
  
  solace-aross
  and
  claude
  committed
  05ed898
- fix(schema): address iceberg upgrade review feedback
  
  solace-aross
  and
  claude
  committed
  d6d3ba9
- fix: limit request decoding before authentication and to the frame's own size
  
  solace-aross
  and
  claude
  committed
  9fc544f
- fix: close review findings on the pre-authentication frame size cap and its tests
  
  solace-aross
  and
  claude
  committed
  ba18724
- fix: test the pre-authentication frame size limit end to end and name its rejection
  
  solace-aross
  and
  claude
  committed
  208986b
Commits on Oct 3, 2026
- refactor: move topic name validation into nisshi-sans-io
  
  solace-aross
  and
  claude
  committed
  b57b575
- fix: cap total partitions per CreateTopics request at 10,000
  
  solace-aross
  and
  claude
  committed
  3ba7c6a
- fix: isolate mpsc-mode storage requests so one panic or cancellation can't kill the shared task (SOL-155270)
  
  solace-aross
  and
  claude
  committed
  588a9d8
- test: add coverage for the supervisor loop's channel-close exit path
  solace-aross
  committed
  306c93f
Commits on Oct 4, 2026
- fix(sans-io): bound tagged deserialize_str allocation to message_max_size
  
  solace-aross
  and
  claude
  committed
  af8ebfa
Commits on Oct 5, 2026
- Merge pull request #801 from nisshi-io/deps/arrow-parquet-58
  solace-aross
  authored
  eaf7fe9
- Merge pull request #823 from nisshi-io/fix/sol-155083-pre-auth-decode-limits
  solace-aross
  authored
  6872a12
- Merge pull request #828 from nisshi-io/fix/sol-155175-topic-name-validation-to-sans-io
  solace-aross
  authored
  754d083
- build(deps): bump tracing-opentelemetry from 0.33.0 to 0.34.0
  dependabot[bot]
  authored
  dd6d9bd
- build(deps): bump cached from 2.0.2 to 4.0.1
  dependabot[bot]
  authored
  322292f
- build(deps): bump rhai-rand from 0.1.7 to 0.2.0
  dependabot[bot]
  authored
  bf25ce0
- build(deps): bump taiki-e/install-action from 2.87.21 to 2.87.22
  dependabot[bot]
  authored
  1c52f25
- fix: cap the decompressed size of a produced batch
  
  solace-aross
  and
  claude
  committed
  5bdf53f
- test: prove the decompression limit is wired into gzip/lz4/zstd
  
  solace-aross
  and
  claude
  committed
  a122f2f
- fix: bound record_count by decoded struct size, not minimum wire size
  
  solace-aross
  and
  claude
  committed
  a5d1180
- docs: note the capped-allocator test's nextest dependency explicitly
  
  solace-aross
  and
  claude
  committed
  c50bd09
- fix: bound decoded batch memory with one budget and report it as MESSAGE_TOO_LARGE
  
  solace-aross
  and
  claude
  committed
  ed4b44a
- docs: drop the intra-doc link to a crate-private constant
  
  solace-aross
  and
  claude
  committed
  166fed3
- docs: state the decoded-batch bound as a budget, not an exact peak
  
  solace-aross
  and
  claude
  committed
  7c509fd
- test: pin LimitedRead in the record decode, replace the slow limit tests
  
  solace-aross
  and
  claude
  committed
  d460282
- fix: log a libSQL produce over the decode limit once, at warn
  
  solace-aross
  and
  claude
  committed
  470c707
- test: cover the by-reference decode path in the header-bomb tests
  
  solace-aross
  and
  claude
  committed
  e0690f4
- docs: tidy comments to match .claude/rules/comments.md
  
  solace-aross
  and
  claude
  committed
  7974705
- docs: tidy comments to match .claude/rules/comments.md
  
  solace-aross
  and
  claude
  committed
  a0c67d8
- chore: ignore sha2 >0.10.9 in dependabot
  
  solace-aross
  and
  claude
  committed
  0e109ca
- fix: migrate TtlSortedCache calls to cached 4.0's CachedExt/set_with API
  
  solace-aross
  and
  claude
  committed
  ea234d2
- Merge pull request #821 from nisshi-io/fix/sol-155080-cap-decompressed-batch-size
  solace-aross
  authored
  b1cfe10
Commits on Oct 6, 2026
Commits on Oct 7, 2026
- ci: name the exact action versions in two SHA pin comments
  
  solace-aross
  and
  claude
  committed
  cbed866
- Merge pull request #874 from nisshi-io/ci/fix-ref-version-mismatch-comments
  solace-aross
  authored
  29bd826
- ci: write the full version in every action pin comment
  
  sgamelin
  and
  claude
  committed
  9a7dcd4
- fix: ListOffsets by timestamp returns -1, not 0, when no record matches
  
  solace-aross
  and
  claude
  committed
  90f9d1e
- fix: avoid same-millisecond race in list_offsets single_record test
  
  solace-aross
  and
  claude
  committed
  7f6ce57
- docs: drop a remote comment pointing at another backend's internals
  
  solace-aross
  and
  claude
  committed
  00d7261
- docs(storage): state the ListOffsetResponse no-offset rule once
  
  solace-aross
  and
  claude
  committed
  418cf12
- test: pin ListOffsets no-match on a non-empty partition and the null backend
  
  solace-aross
  and
  claude
  committed
  aba4286
- fix: bind the broker dual-stack and resolve loopback by IP (SOL-155095)
  
  solace-aross
  and
  claude
  committed
  58bb5f7
- test: cover the IPv4-literal bind path in configure_listener (SOL-155095)
  
  solace-aross
  and
  claude
  committed
  9897910
- docs: tidy a comment to match .claude/rules/comments.md
  
  solace-aross
  and
  claude
  committed
  cbcf544
- fix: fall back to IPv4 when the host has no IPv6, and tighten listener tests
  
  solace-aross
  and
  claude
  committed
  8494ff8
- Fail clearly on bad storage config, lake-without-registry, and unauthenticated clients
  
  solace-aross
  and
  claude
  committed
  cafdfab
- Address round-2 review: remove second dead error variant, add clear CLI messages
  
  solace-aross
  and
  claude
  committed
  103b240
- fix: resolve typos CI failure in doc comment
  
  solace-aross
  and
  claude
  committed
  82215ee
- fix: keep interval options in the broker, and log pre-auth rejections with the peer
  
  solace-aross
  and
  claude
  committed
  7d37ca0
- fix: satisfy the typos check in storage option tests
  
  solace-aross
  and
  claude
  committed
  dc5bb6d
- ci: close the CI/CD supply-chain gaps from the security review (SOL-155138)
  
  solace-aross
  and
  claude
  committed
  5d28848
- fix: add --no-verify to release.yml's cargo publish (SOL-155138 review)
  
  solace-aross
  and
  claude
  committed
  b378ff3
- docs: tidy a dependabot.yml comment to match .claude/rules/comments.md
  
  solace-aross
  and
  claude
  committed
  e9fc682
- ci: let cargo-deny float and state CI comments as end state
  
  solace-aross
  and
  claude
  committed
  f79fd64
- docs: say tags are pushed by hand and not enforced by a ruleset
  
  solace-aross
  and
  claude
  committed
  f23a888
- ci: gate zizmor's artipacked audit at every threshold
  
  solace-aross
  and
  claude
  committed
  f72fcc6
- Merge pull request #838 from nisshi-io/fix/sol-155073-list-offsets-no-match
  solace-aross
  authored
  0e1e4bb
- Merge pull request #843 from nisshi-io/fix/sol-155095-macos-ipv6-localhost
  solace-aross
  authored
  3428323
- Merge pull request #850 from nisshi-io/fix/sol-155256-fail-clearly
  solace-aross
  authored
  786eb0d
- Merge pull request #848 from nisshi-io/fix/sol-155138-cicd-supply-chain
  solace-aross
  authored
  6111d03
- build: reduce debug info in dev builds
  
  sgamelin
  and
  claude
  committed
  9214019
- build(deps): bump tokio from 1.53.1 to 1.53.2
  dependabot[bot]
  authored
  f054fcf
- fix(service): fork the listener's extensions for each accepted connection
  
  sgamelin
  and
  claude
  committed
  7e890f0
- build(deps): bump jsonschema from 0.45.1 to 0.58.3
  dependabot[bot]
  authored
  08a9b38
- fix(storage): fail broker startup when S3/GCS storage isn't usable
  
  solace-aross
  and
  claude
  committed
  563ffd5
- docs(storage): fix inaccurate AWS credential comments, add deterministic test
  
  solace-aross
  and
  claude
  committed
  1d54f18
- docs: tidy comments to match .claude/rules/comments.md
  
  solace-aross
  and
  claude
  committed
  c6b8904
- fix: answer UNKNOWN_TOPIC_OR_PARTITION for a fetch of an unknown topic name
  
  solace-aross
  and
  claude
  committed
  4eb4597
- fix: assert topic_id on the unknown-topic-name response, fix CHANGELOG wording
  solace-aross
  committed
  bcd7a88
- docs: tidy comments to match .claude/rules/comments.md
  
  solace-aross
  and
  claude
  committed
  1757b7b
- fix(storage): refuse dynostore delete_topic for an invalid topic name
  
  solace-aross
  and
  claude
  committed
  664174b
- fix(storage): use a bad name that actually hits the prefix hazard in the delete_topic test
  
  solace-aross
  and
  claude
  committed
  80967fe
- docs: tidy comments to match .claude/rules/comments.md
  
  solace-aross
  and
  claude
  committed
  96f5467
- fix: reject CreateTopics replication_factor below 1 (SOL-155173)
  
  solace-aross
  and
  claude
  committed
  c97479f
- fix(storage): check CreateTopics replication factor before partition count
  
  solace-aross
  and
  claude
  committed
  0ebb6cd
- Merge pull request #877 from nisshi-io/chore/reduce-dev-debug-info
  sgamelin
  authored
  494556c
- Merge pull request #829 from nisshi-io/fix/sol-155173-replication-factor-validation
  solace-aross
  authored
  cfbbb8a
- Merge pull request #884 from nisshi-io/880-listener-per-connection-extensions
  sgamelin
  authored
  f9a3fd5
- Merge pull request #868 from nisshi-io/dependabot/cargo/main/tokio-1.53.2
  solace-aross
  authored
  ed7df37
- Merge pull request #872 from nisshi-io/dependabot/cargo/main/opentelemetry-semantic-conventions-0.33.0
  solace-aross
  authored
  9f27287
- Merge pull request #881 from nisshi-io/dependabot/cargo/main/jsonschema-0.58.3
  solace-aross
  authored
  d96889b
- fix(storage): honour AWS_SKIP_SIGNATURE, ping the cluster prefix, name the startup check
  
  solace-aross
  and
  claude
  committed
  fd94b01
- Merge remote-tracking branch 'origin/main' into 875-full-version-pin-comments
  sgamelin
  committed
  d9ebe2d
- fix: wait beside an unknown topic name and log metadata errors in fetch
  
  solace-aross
  and
  claude
  committed
  458ec72
- fix(dynostore): delete an unsafe-named topic's metadata only
  
  solace-aross
  and
  claude
  committed
  e228ac3
- Merge pull request #876 from nisshi-io/875-full-version-pin-comments
  sgamelin
  authored
  688cd64
- Merge pull request #844 from nisshi-io/fix/sol-155184-s3-credential-check
  solace-aross
  authored
  16c19e5
- Merge pull request #834 from nisshi-io/fix/sol-155319-fetch-unknown-topic-name
  solace-aross
  authored
  433c376
- Merge pull request #833 from nisshi-io/fix/sol-155178-dynostore-delete-topic-validation
  solace-aross
  authored
  148800c
Commits on Oct 8, 2026
- fix(dynostore): encode consumer group ids as a single opaque path segment
  
  solace-aross
  and
  claude
  committed
  e5da75b
- fix(dynostore): correct EMPTY_GROUP_SENTINEL rationale, add list_groups regression test
  
  solace-aross
  and
  claude
  committed
  1efa379
- docs: tidy comments to match .claude/rules/comments.md
  
  solace-aross
  and
  claude
  committed
  bcace9e
- fix(dynostore): pin group key layout and cover group state per id
  
  solace-aross
  and
  claude
  committed
  c5c878a
- test: move the broker wire helpers out of tls.rs into common
  
  solace-aross
  and
  claude
  committed
  dee198b
- fix: answer OFFSET_OUT_OF_RANGE for a fetch offset outside the partition
  
  solace-aross
  and
  claude
  committed
  83953ee
- fix: drop the leader hint from the unknown topic Fetch answer
  
  solace-aross
  and
  claude
  committed
  39cb5ab
- docs: tidy comments to match .claude/rules/comments.md
  
  solace-aross
  and
  claude
  committed
  957f099
- fix: answer NONE above the high watermark and wait beside an unknown topic
  
  solace-aross
  and
  claude
  committed
  d04c721
- fix: keep the log start through slatedb compaction and count out-of-bounds fetches
  
  solace-aross
  and
  claude
  committed
  b91c6a3
- fix: document the slatedb upgrade reset and keep the stage for empty fetches
  
  solace-aross
  and
  claude
  committed
  952fb62
- docs: recommend auto.offset.reset=earliest across the slatedb upgrade
  
  solace-aross
  and
  claude
  committed
  3a8b66e
- Merge pull request #842 from nisshi-io/fix/sol-155078-dynostore-group-keys
  solace-aross
  authored
  da6d116
- Merge pull request #826 from nisshi-io/fix/sol-155090-fetch-offset-bounds
  solace-aross
  authored
  c670865
- ci: stop building the Intel macOS release binary (#892)
  
  solace-aross
  and
  claude
  authored
  5640e35
- ci: skip Tier B on fork pull requests (#896)
  
  solace-aross
  and
  claude
  authored
  7b5e98c
- ci: build each lake format once and add a turso storage leg (#895)
  
  solace-aross
  and
  claude
  authored
  315394a
- fix: refuse DeleteGroups for a non-empty group (#837)
  
  solace-aross
  and
  claude
  authored
  931dbb7
- chore: refresh Understand-Anything graph at da6d1160 (#893)
  solace-aross
  authored
  ae36fbf
- ci: add optional nightly Tier C workflow (#901)
  
  solace-aross
  and
  claude
  authored
  2db01a4
- docs: add naming rules for contributors and agents (#903)
  
  solace-wkourlas
  and
  claude
  authored
  6c59149
- Keep secrets and record data out of logs (#889)
  
  sgamelin
  and
  claude
  authored
  8b4726a
- ci: check the feature matrix instead of building it (#899)
  
  reubenjds
  and
  claude
  authored
  a40c794
- Produce with acks=0 no longer gets an unsolicited response; failure closes the connection (#845)
  
  solace-aross
  and
  claude
  authored
  8543d06
Commits on Oct 9, 2026
- Add descriptions to nisshi-storage-* crates (#910)
  
  shortishly
  and
  claude
  authored
  5703d45
- ci: squash-merge PRs with Conventional Commits titles, stop editing CHANGELOG.md (#898)
  
  sgamelin
  and
  claude
  authored
  c32355a
- chore: bump version to 0.7.0-pre.3 (#912)
  
  sgamelin
  and
  claude
  authored
  c0b50cd
- Handle InitProducerId v0-2 and the KIP-360 epoch bump on every engine (#887)
  
  sgamelin
  and
  claude
  authored
  c4b48e4
- client: discard dead pooled connections and bound pool waits and responses (#885)
  
  sgamelin
  and
  claude
  authored
  34c6924
- Fix address-family-unsupported detection on Windows (#894)
  
  solace-wkourlas
  and
  claude
  authored
  5e56b98
- build(deps): bump nanoid from 0.4.0 to 0.5.0 (#916)
  dependabot[bot]
  authored
  f4a7679
- ci: hide the dco2 override button (#913)
  
  reubenjds
  and
  claude
  authored
  fabc42a
- build: embed the crate list in release binaries with cargo-auditable (#891)
  
  reubenjds
  and
  claude
  authored
  622f42a
- fix: build on Windows by making SIGINT/SIGTERM handling conditional (#863)
  
  solace-wkourlas
  and
  claude
  authored
  54e96c8
- test: add a Kafka CLI smoke suite and run it in CI (#862)
  
  solace-wkourlas
  and
  claude
  authored
  feeba78
- test: add Kafka CLI smoke tests for the broker, topics, configs, produce, consume, offsets and restarts (#902)
  
  solace-wkourlas
  and
  claude
  authored
  bf4611b
- build(deps): bump opentelemetry crates to 0.33 (#924)
  
  solace-aross
  and
  claude
  authored
  1952ed9
- ci: skip Rust jobs on PRs that only change CI config or docs (#925)
  
  reubenjds
  and
  claude
  authored
  1f3b44e
- build(deps): bump slatedb from 0.14.1 to 0.17.0 (#870)
  dependabot[bot]
  authored
  a81b990
- test: add Kafka CLI smoke tests for retention, compaction, kafka-delete-records and SCRAM (#923)
  
  solace-wkourlas
  and
  claude
  authored
  21f6502

Commits

Commits on Sep 25, 2026

Commits on Sep 27, 2026

Commits on Sep 28, 2026

Commits on Sep 29, 2026

Commits on Sep 30, 2026

Commits on Oct 1, 2026

Commits on Oct 2, 2026

Commits on Oct 3, 2026

Commits on Oct 4, 2026

Commits on Oct 5, 2026

Commits on Oct 6, 2026