Assignment ADR-0053/delivery/007, coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc/local. Root inspected source 99efbbafb0ed599a5785e723af6614fefd27034f and manifest f83f219c7a21e8dcd48f303049dc1b94c816973cd8b24df00c112563108e0dca, approved explicit verify-full, and authorized exactly one auth-only execution. The reviewed command was executed once. Its permanent attempt claim at 2026-10-03T08:56:21.409Z is retained under .tmp/production007/auth-preflight-once/ and will not be removed or reused.

The initial owner TLS connection failed with safe code SELF_SIGNED_CERT_IN_CHAIN, before the CLI called runPreflight, generated a restricted credential, issued SQL, activated the role or attempted restricted authentication. There was no role mutation to retire, signing key, proof window, audit grant/write, project env/deployment change, proof POST or Phase C call. The source entry boundary explains this preactivation stop; the immutable generic entry-stop record conservatively directs readers to retained evidence and catalog rather than claiming an ambiguous operation succeeded. No fresh authenticated role catalog readback occurred after this TLS stop. The most recent verified role state remains the earlier exact OID 13362275, NOLOGIN/password NULL/no direct grants/dependencies/sessions snapshot, SHA256 94ed1c15969907d53a78c4c63bcc8e225ef3540edbe2d3ed95ca14155f7b80da.

Stop evidence:

The executed CLI is retained in commit 99efbbafb0ed599a5785e723af6614fefd27034f, SHA256 9412caaa8954b0656fc31ae54344075850e2ef4aa6d35b3932e54c5a29d8670a. Earlier d6 and other unsigned STOP evidence remains unchanged. The original d6 28P01 cause remains unresolved.

Supported TLS cause and public trust provenance

An unauthenticated PostgreSQL SSLRequest/OpenSSL handshake found the pooler chain rooted in Supabase Root 2021 CA, rejected by the default trust store with verification error 19. Supabase's official documentation says verified database connections require its root certificate and an explicit driver CA setting with full hostname verification. Supabase connection guidance, SSL enforcement guidance.

The official dashboard source, pinned commit b2cf3693dd74216ecc27506390931d35dc929c9c, supplies the public certificate download template. Its custom-content.json SHA256 is 7bb9234330e88882521a221863c70bd9498d0383e29f689d1f904f6cc899a232. Pinned official dashboard source. The downloaded production CA came through verified HTTPS at the official dashboard's download URL, rather than being trusted solely because the unverified database peer sent it.

Public PEM SHA256 is 700723581420dd1ac98fd7e9ac529f0ef210eadcaf87fc868a3ad7d114c2f3b7, DER certificate fingerprint 80:70:25:AD:50:D4:ED:21:9D:2C:9C:7D:29:9C:00:4F:82:4E:B0:0C:F7:F6:5A:FE:F6:07:D0:7B:72:E6:CA:FA. It is the self-signed CA Supabase Root 2021 CA, valid April 28, 2021 through April 26, 2031. No machine/global trust store was changed. The public CA and pinned provenance are staged in Delivery's docs/adr0053-workload-proof/review/.

Credential-free Windows Node TLS probes using this explicit CA and rejectUnauthorized: true passed both exact pooler and direct hostnames in TLS 1.3, 169 ms and 164 ms respectively. They sent only PostgreSQL SSLRequest/TLS negotiation and no startup or authentication payload. Evidence .tmp/production007/auth-preflight-once/windows-node-verified-tls.json SHA256 is e6950c8584377ed09c6de24c663d859491671ff3df1a28db709a9975e5c466dd. The WSL pooler OpenSSL full-verification probe also passed; WSL's direct IPv6 probe returned network unreachable. The Windows Node probe is the relevant runtime evidence for this helper and does not infer WSL direct availability.

Together, the default-store failure and same-host CA-pinned verification success support missing provider CA trust as the cause of this TLS STOP. They establish neither restricted login nor a cause of the earlier 28P01.

Corrected packet awaiting execution review

Root authorized preparation of the CA-pinned wrapper with a new immutable claim. The CLI now reads the exact checked-in public CA, verifies its hash/type/validity, supplies its absolute path as sslrootcert, requires sslmode=verify-full, and verifies the actual installed pg parser carries that CA without disabled certificate or hostname checks. Both exact endpoint identities remain unchanged. No weak TLS fallback exists.

New future claim is .tmp/production007/auth-preflight-ca-once/, which has not been created. The old claim and STOP files remain immutable. Auth-only core auth-preflight.mjs is unchanged, SHA256 5a3000f0168b32315e62f6bcb40b07c2476ea8d16085b11cd5b779a190413d22. Exact OID, no-preexisting-sessions precondition, one credential, server-clock five-minute expiry, boolean comparisons, direct attempt maximum one, pooler attempts maximum three at 0/20/60 seconds within 90 seconds, retry only 28P01, unconditional exact-role retirement and narrowly qualified helper-session termination remain unchanged. There are no new grants, proof audit rows, signing, env/deployment operations or acquisition calls.

Review source pins:

docs/adr0053-workload-proof/orchestration/auth-preflight-ca-manifest.json pins all eleven source/dependency/CA/transport/STOP entries and the future command. All 27 focused cases pass, including actual pg CA parsing for both hostnames and permanent separate claim construction; syntax and diff checks pass. The prior 979-pass/15-skip plus eight audit-lock cases and typecheck are reused because business code and the auth-only core are unchanged. No repeated app suite or production lock audit occurred for the CA/output-path wrapper correction.

No new owner or restricted authentication was attempted during this source preparation. Root must review the corrected exact source and manifest before execution. A successful future auth-only run still does not authorize a proof acquisition window. Root is sole canonical publisher. Previously published investigation b2da9770 and scope fix 4717 are acknowledged and are not requeued. G2, old runtimes and both deadlines remain preserved.