One-shot authentication helper prepared, direct TCP feasible and TLS correction explicit

Assignment ADR-0053/delivery/007, coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc/local. Root accepted the prior investigation approach and authorized helper preparation plus one unauthenticated five-second direct TCP probe. No role activation or authentication is authorized or performed in this preparation.

The IPv6 TCP probe to db.pfuctqiobbjglpukteei.supabase.co:5432 succeeded in 135 ms at 2026-10-03T08:53:00.895Z. It sent no authentication data. Evidence .tmp/production007/prepared-scoped/direct-tcp-feasibility.json SHA256 27b594ff31cee17e48d8e4424cd659d2e467035555db081052a2b5ed29d6e752. This establishes transport feasibility only.

An offline check of the actual installed pg connection parser found that the local owner URL does not enable TLS. This corrects the prior plan's assumption that it already carried a verified TLS policy. The proposed helper explicitly sets sslmode=verify-full for owner, pooler and direct connections, retaining existing CA/certificate paths and rejecting hostname-verification overrides or disabled certificate checking. No TLS connection was attempted in preparation. Root should review this explicit correction with the helper. If the provider certificate is not trusted under this policy, the initial owner connection stops before role activation; there is no weaker-TLS fallback. Endpoint identity hashes exclude this TLS setting and remain the reviewed exact targets.

The dedicated helper has a permanent exclusive local attempt claim, exact execution flag, one random credential, server-clock five-minute expiry, unchanged role OID 13362275 and pooler target fingerprint. It validates zero preexisting role sessions and the exact revoked-role/PUBLIC/admin baseline inside the activation transaction. It adds no grants or memberships. Stored verifier equality, role flags/LOGIN/expiry, actual parsed endpoint/password and verified TLS checks must pass before restricted login. Only booleans leave credential comparison. Error sanitization copies a validated error code/class only, never provider messages, detail, query, stack, URLs or verifiers.

With the authorized TCP evidence, the future run attempts at most one direct authentication with the unsuffixed role username. A direct rejection or transport/TLS failure stops before pooler attempts, with cause inference limited accordingly. Pooler attempts use the same credential at fixed offsets 0, 20 and 60 seconds, at most three, within 90 seconds. Only 28P01 permits another attempt; success or any other error stops. Each restricted connection has a five-second connection deadline and three-second query timeout. There is no rekey, proof window, signing, audit grant/write, project env change, deployment, acquisition POST or Phase C path.

Unconditional retirement runs even after an uncertain activation response. It first closes helper clients, verifies exact OID, then revokes LOGIN/password. A single bounded owner reconnect is available if the activation connection was lost. Session termination requires this exact role, the unique helper application marker and a backend start no earlier than the server activation clock. The SQL rechecks PID, role, marker and exact backend start before a bounded termination. Unknown or older sessions are never terminated. The final revoked-role snapshot must exactly equal the baseline, including zero sessions/dependencies and unchanged PUBLIC/admin facts. Failure remains explicit rather than being reported as clean. Secrets are held in memory and references cleared at exit; JavaScript string erasure is not a claim of physical memory zeroization.

Review packet is docs/adr0053-workload-proof/orchestration/auth-preflight-manifest.json, containing source/dependency/transport hashes and the exact proposed command. Source SHA256:

All 25 meaningful offline cases pass, including same-credential offsets, direct failure, retries limited to 28P01, every comparison gate, uncertain activation, preexisting/foreign/older sessions, phase deadline, sanitization and actual pg credential parsing. CLI syntax passes. Running without the exact execution flag produced a sanitized stop before creating an attempt claim or connecting. Repository gates pass: 979 tests, 15 skipped, eight audit-lock unit cases, and typecheck. App artifacts, custody runner and stopped directories remain unchanged; no smoke/e2e or production lock audit is required for this isolated orchestration preparation.

This packet awaits root's exact source/TLS review before any production role activation. Even a later successful auth-only preflight does not authorize another acquisition window. Root remains sole canonical publisher of this and the preceding unsigned STOP/scope-fix memos. Existing G2 evidence, runtimes and deadlines remain preserved.