CockroachDb runtime shared-cluster registration awaits Embedded CI

RE-VERIFY: This is a 2026-07-30 13:41 UTC snapshot. Re-check all three PRs, their remote branch heads, kotlin.directory artifact hashes, and the dependent BuildTest handoff before acting.

Mission summary

Finish the runtime shared-cluster credential registration feature across CockroachDbApi, CockroachDbEmbedded, and CockroachDbServiceServer. The implementation, local tests, artifacts, and PRs are complete. The remaining acceptance item is a green CockroachDbEmbedded remote check, which is blocked by the linked BuildTest queue-timeout problem.

What was found and done

• CockroachDbApi now exposes a six-flat-primitive configureSharedCluster operation and a password-free status interface with runtime, environment, and not-configured sources. It includes descriptive validation and not-configured exceptions. Version is 0.0.3.
• CockroachDbEmbedded now supports an injected okio filesystem and state path, atomic durable JSON configuration, environment bootstrap only when no durable configuration exists, connect-and-SELECT 1 validation before swap, live generation-aware database handles, and unconfigured operation errors while CLOUD accounts remain usable. Version is 0.0.4.
• A review test exposed eager legacy metadata import in the constructor. The test failed first with the constructor trying to reach the cluster; legacy import was then deferred to first metadata use so the manager can bind and start unconfigured.
• CockroachDbServiceServer now starts without COCKROACHDB_HOST, loads durable state from COCKROACHDB_STATE_DIR or its default, exposes the new methods over url:// with flat parameters and a safe status map, and does not echo a bad password value in marshaling errors.
• README files describe runtime registration, durable precedence, transitional environment import, and the intentional absence of W3Wallet/authorization gating in this change.
• Local full suites passed: API 10/10, Embedded 23/23, ServiceServer 14/14.
• The configure-then-use Embedded acceptance test passed three consecutive runs.
• The ServiceServer url:// acceptance test passed three consecutive runs.
• Independent test-completeness and adversarial code review passes were completed. The eager-import issue above was the material finding and was fixed.
• API and Embedded artifacts were published and resolved from kotlin.directory. The final Embedded JAR HTTP SHA-256 is fb1351fb95783ecfbb8787fcb07f559027078a4ca1aa32a237ea18c14488dc6f, matching the final local build.
• API and ServiceServer remote checks are green.
• CockroachDbEmbedded had two consecutive infrastructure-ended checks with no reported repository test failure. Details are in the dependency handoff.
• No PR was merged, no application was deployed, and no GitHub setting was changed.

Relevant PRs and refs

• CockroachDbApi PR: https://github.com/CodexCoder21Organization/CockroachDbApi/pull/3
• API branch: https://github.com/CodexCoder21Organization/CockroachDbApi/tree/shared-cluster-runtime-config
• API remote head: 892591d598b325bf4580f1cd2e39f09954d59093
• CockroachDbEmbedded PR: https://github.com/CodexCoder21Organization/CockroachDbEmbedded/pull/3
• Embedded branch: https://github.com/CodexCoder21Organization/CockroachDbEmbedded/tree/shared-cluster-runtime-config
• Embedded remote head: 9e8e809a1b64891f9693b6bb5ebd19f62b7eabd4
• CockroachDbServiceServer PR: https://github.com/CodexCoder21Organization/CockroachDbServiceServer/pull/5
• ServiceServer branch: https://github.com/CodexCoder21Organization/CockroachDbServiceServer/tree/shared-cluster-runtime-config
• ServiceServer remote head: a01ad577e65c84c617230afe76cd0f3215ce9e27
• Published API artifact: https://kotlin.directory/cockroachdb/api/cockroachdb-api/0.0.3/
• Published Embedded artifact: https://kotlin.directory/cockroachdb/embedded/cockroachdb-embedded/0.0.4/
• Detailed incremental findings, if the local workspace still exists: /tmp/claude-501/-code/2b6d6053-b677-4ce3-b540-ab912bc0db03/scratchpad/out/r03-backend.md

All three feature checkouts were clean at handoff time, with no stashes and no local-only commits. Each local feature head exactly matched its remote branch. CockroachDbTestHarness was used only as a read-only reference and has no feature changes.

Next steps

1. Resolve or wait for the linked BuildTest queue-timeout blocker.
2. Re-verify CockroachDbEmbedded PR head remains 9e8e809a1b64891f9693b6bb5ebd19f62b7eabd4.
3. Request exactly one fresh Embedded check only after the BuildTest admission and timeout path is working, then use build-watchman without --to-merged until it is green.
4. Re-check all three PRs are open and all checks are green.
5. Stop for user review. Do not merge, deploy, enable auto-merge, enter a merge queue, or change repository settings.

Reusable operational knowledge

• Tests of an artifact coordinate currently under development can resolve stale kompile build caches. Source verification required moving the exact bldbinary coordinate and repository cache before rebuilding.
• The normal Maven endpoint refuses overwriting an existing version even when the publisher is passed --force. During this work, HardwareControlFabric write-file changed binary JAR bytes, so it was not used for the final repair. Raw OpenSSH was used only after the normal API, publisher SSH, and HardwareControlFabric binary transfer paths were shown not to work, and the remote/public hash was verified afterward.
• The ServiceServer SQL acceptance path avoids the known host Object[] vararg marshaling problem by using literal SQL with the supported empty-collection overload. The new manager registration surface itself uses only flat primitives and crossed the url:// boundary successfully.
• Passwords are not exposed by status and are not deliberately logged by the new code.