Oracle 19c PR set — coordinated merge order & status board

[wz-gsa]

Canonical merge-order board for the Oracle-19c-related PRs. Single source of truth — the PRs link here rather than each carrying a full (staleable) copy.

All are file-disjoint (verified: no two touch the same file → no cross-PR rebases; mergeable in any order mechanically). This ordering exists to satisfy the team rule: land pre-commit + the local test framework first; defer anything that touches the Concourse pipeline (ci/pipeline.yml) until last. Order was consensus-reviewed (architect / security / scope-steward — unanimous).

Recent status (updated 2026-07-24)

• chore(lint): burn down inherited golangci-lint findings + enable whole-repo gate (precedes #543) #556 (burn down inherited golangci-lint findings + enable whole-repo gate) — MERGED 2026-07-24. Prerequisite for chore(pre-commit): adopt cloud-gov/pre-commit-templates (caulking-aware) #543's Step 2.
• 1️⃣ chore(pre-commit): adopt cloud-gov/pre-commit-templates (caulking-aware) #543 (pre-commit adoption) — ✅ MERGED 2026-07-24 (merge commit d9b5f92). Rebased onto post-chore(lint): burn down inherited golangci-lint findings + enable whole-repo gate (precedes #543) #556 main, interim git-blame lint shim deleted, template's whole-repo golangci-lint hook adopted, .golangci.yml pins the config schema to v2. Safety gate verified: git diff 4bf0da3 d9b5f92 -- ci/pipeline.yml = empty (pipeline byte-identical). ✅
• Next up: 2️⃣ chore(local): add local Oracle dev/test harness #545 (local dev/test harness) — DRAFT, ready to un-draft/merge. Carries the moto-smoke readiness fix and removal of the Oracle 19c EE fidelity image.
• feat(oracle19c): STIG-hardened Oracle Database 19c brokered RDS support - DEV branch #537 / ci: add engine-agnostic smoke-service cleanup task #544 remain DRAFT.

Order	PR	Scope	Edits ci/pipeline.yml?	Notes
1️⃣	#543 pre-commit adoption	.pre-commit-config.yaml, .golangci.yml, docs — dev-local	❌ inert	✅ MERGED 2026-07-24 (d9b5f92). Pipeline diff verified empty.
2️⃣	#545 local dev/test harness	local/** (docker-compose + scripts, 127.0.0.1-bound)	❌ inert	NEXT UP — DRAFT. Zero app/pipeline impact. Also carries the moto-smoke readiness fix and removal of the Oracle 19c EE fidelity image (arm64 can't build local SE2; keeps only gvenzl/oracle-free).
3️⃣	#544 CI smoke-cleanup task	adds ci/cleanup-smoke-service.{sh,yml} but does not wire them into pipeline.yml	❌ inert	DRAFT. Concourse only runs what pipeline.yml references → inert until a future PR wires it. Re-review the .sh for shell-injection at wire-up time.
4️⃣	#537 Oracle 19c feature	app code (gated behind ENABLE_ORACLE) + edits ci/pipeline.yml (adds a smoke job)	✅ yes	DRAFT. ⛔ DO-NOT-MERGE until dev env ready.

Safety gates

• After merging any of 1️⃣–3️⃣: git diff origin/main -- ci/pipeline.yml must be empty — proof the pipeline is byte-identical. Only 4️⃣ should ever change that diff. (1️⃣ chore(pre-commit): adopt cloud-gov/pre-commit-templates (caulking-aware) #543 verified ✅.)
• 4️⃣ feat(oracle19c): STIG-hardened Oracle Database 19c brokered RDS support - DEV branch #537 stays blocked until: platform SG allows TCPS 2484 / denies 1521 (Oracle 19c (platform): security group must allow TCPS 2484 and deny plaintext 1521 (TLS-only) #541, still OPEN), ENABLE_ORACLE set in the dev broker env, meta.aws_broker.oracle_security_group in dev secrets, dev account Oracle-licensed, and ISSO acceptance of the SE2 deviations.
• Recommend enforcing DO-NOT-MERGE on feat(oracle19c): STIG-hardened Oracle Database 19c brokered RDS support - DEV branch #537 via a required label / branch rule, not just convention.

How to work this

• Draft ≠ un-reviewable: reviewers can review chore(local): add local Oracle dev/test harness #545 now so it's approved-and-ready to un-draft in order (parallelizes the human work).
• Un-draft + merge strictly 1️⃣→2️⃣→3️⃣→4️⃣. (1️⃣ done.)

This board is maintained here; PRs point to it.

[wz-gsa]

Merge order updated — #556 inserted first

Per @markdboyd's request to simplify #543's linting to a whole-repo gate, the inherited lint-debt burndown must land before #543. Updated order:

Order	PR	Notes
0️⃣	#556 lint-debt burndown	NEW — merge first. Clears ~55 inherited golangci-lint findings so golangci-lint run ./... is green. Fixes 2 real gosec findings; defers ownership calls to #554/#555.
1️⃣	#543 pre-commit	After #556: rebase, delete scripts/lint-oracle-go.sh, switch to the template's whole-repo golangci-lint hook (the simplification Mark asked for).
2️⃣	#545 local harness	@pburkholder removing the 19c EE image path first.
3️⃣	#544 CI smoke-cleanup	adds ci/ files, doesn't touch pipeline.yml.
4️⃣	#537 Oracle feature	LAST — only PR editing ci/pipeline.yml; DO-NOT-MERGE until dev env + #541 + ISSO.

Follow-up issues from the burndown: #552 (plaintext SecretKey), #553 (graceful shutdown), #554 (CFB→AEAD), #555 (production error-handling semantics).

[pburkholder]

Status update — 2026-07-24

Board refreshed to reflect the latest work:

• chore(lint): burn down inherited golangci-lint findings + enable whole-repo gate (precedes #543) #556 (inherited golangci-lint burndown + whole-repo gate) — MERGED. This was the prerequisite for chore(pre-commit): adopt cloud-gov/pre-commit-templates (caulking-aware) #543's Step 2.
• 1️⃣ chore(pre-commit): adopt cloud-gov/pre-commit-templates (caulking-aware) #543 (pre-commit adoption) — ✅ MERGED (merge commit d9b5f92). Rebased onto post-chore(lint): burn down inherited golangci-lint findings + enable whole-repo gate (precedes #543) #556 main; the interim git-blame lint shim (scripts/lint-oracle-go.sh) deleted; adopted the template's whole-repo golangci-lint hook; added .golangci.yml pinning the config schema to v2. Verified golangci-lint run ./... = 0 issues under v2.12.2.
  • Safety gate PASS: git diff 4bf0da3 d9b5f92 -- ci/pipeline.yml = empty — the Concourse pipeline is byte-identical, as required for a 1️⃣–3️⃣ merge.
• Next up → 2️⃣ chore(local): add local Oracle dev/test harness #545 (local dev/test harness): still DRAFT, ready to un-draft/merge in order. Now also carries the moto-smoke readiness fix and the removal of the Oracle 19c EE fidelity image (arm64 can't build a local SE2 image; the harness keeps only gvenzl/oracle-free).
• ci: add engine-agnostic smoke-service cleanup task #544 (3️⃣) and feat(oracle19c): STIG-hardened Oracle Database 19c brokered RDS support - DEV branch #537 (4️⃣, ⛔ DO-NOT-MERGE, blocked on Oracle 19c (platform): security group must allow TCPS 2484 and deny plaintext 1521 (TLS-only) #541 et al.) unchanged.

Merge order remains 1️⃣→2️⃣→3️⃣→4️⃣; 1️⃣ is done. The board body above has the full detail.

[wz-gsa]

Superseded. The coordinated merge-order/status board is stale now that the incremental PRs have landed (#564, #567) and the remaining atomic work is tracked in #568. #537 (the original big-PR line) was closed as superseded. Closing this coordination board; use #568 as the forward tracker.