[intel352]

Summary

• Expose pkg/runner.New for context-aware, in-process ordered migrations using the existing registered drivers.
• Delegate ordinary CLI up/down/goto/status operations to the public runner without changing explicit force/repair commands.
• Bind native PostgreSQL execution and advisory-lock waits to caller cancellation; preserve dirty state and original error causes.

Design And Plan

Accepted recovery design
Locked Gate 0A plan

Scope Manifest: 21 tasks / 10 PRs, locked 2026-10-03T01:51:30Z.
PR grouping row 7: Expose reusable ordered migration runner, Task 15,
branch feat/reusable-migration-runner-20261002.
This is one prerequisite slice, not completion of recovery or compute slimming.

Verification

Fresh lead verification against a real disposable PostgreSQL 16 Alpine instance,
using the repository CI's WORKFLOW_MIGRATE_TEST_DSN path:

go test ./... -race -count=1: exit 0; 9 packages, 155 cases, zero failures
go build ./...: exit 0
go vet ./...: exit 0
go mod tidy -diff: exit 0
golangci-lint run --timeout 5m: exit 0; 0 issues
git diff --check: exit 0

The independently compiled public-API consumer used the real runner/native driver:

applied=[1] repeat=[] current=1 cancelled=true late=false elapsed=204.265417ms

The initial unconfigured embedded-PostgreSQL run failed because parallel package
processes shared the existing extraction directory. No runtime fix or baseline
test-helper change was made; rerunning with CI's supported database path passed.

Runtime Launch

Released native wfctl v0.86.0 launched the actual candidate plugin binary
(release-equivalent build flags, temporary candidate manifest only):

wfctl plugin verify-capabilities --binary <built-plugin> <candidate-manifest-dir>
OK    workflow-plugin-migrations 0.4.0 (plugin.json: 0.4.0)

The actual standalone CLI used an isolated schema in that disposable database:

workflow-migrate goto 1: exit 0; Migrated to 1 (1 steps): [1]
workflow-migrate up --timeout 200ms: exit 1; context deadline exceeded
workflow-migrate status: exit 0; Current: 2; Dirty: true
database catalog readback: first_applied=true; late_mutation=false

These are local candidate/real-database proofs, not a published release, STG
migration, or live provider workload. No cloud or retained-agent mutation.

Compatibility And Review

Workflow dependency is the released v0.86.0 module; no local replacement.
Existing host/tooling pins remain older intentionally: this slice introduces a
public Go consumer package and changes native driver execution, not a new plugin
RPC. Released v0.86.0 host launch passed; configured CI retains its existing
older-host contract/packaging checks as an additional compatibility gate.

One independent initial adversarial code/security pass and one targeted
correction check are complete. No new broad design round or Minor/Nit loop.

That initial pass found two concrete timeout gaps. RED reproduced 3-second
Atlas initialization despite a 100ms operation timeout and timeout flags on
four ancillary commands that bypass the runner. Minimal corrections thread
context through existing Atlas initialization and restrict the flag to the
four runner-backed commands. GREEN showed 100-110ms Atlas cancellation and
absence of the misleading flags. Targeted review closed both findings with
SHIP-IT, no remaining substantive defect. No speculative feature was added.

Doc-reconciliation: clean; changelog names match the implemented public API.

Rollback

Consumers remain on the prior migrations release until immutable new release
source/assets/checksums are verified. Revert this slice if needed; never repair
dirty migration metadata automatically.