Add Postgres/Bun persistence for continuity and secure sessions

- Add internal/infra/db (pool, open, timeouts) and bun-backed continuity + securesession stores with baselines and contract tests.

- Extend config/runtime wiring, stdhttp server, testkit postgres helpers, CI qa workflow, and arch import guards.

- Document operator persistence; refresh steering, AGENTS, README, sample config; archive bun-database-abstraction Kiro spec.

Made-with: Cursor

Author: Mateusz

.github/workflows/qa.yml

@@ -25,7 +25,7 @@ jobs:
 
       # Conformance/parity suites live under ./internal/testkit/conformance/... and run here (no duplicate step).
       - name: Unit tests
-        run: go test -parallel=8 -tags=precommit ./...
+        run: go test -parallel=8 -tags=precommit,integration ./...
 
       - name: Release gates (fuzz smoke)
         env:

.kiro/settings/templates/specs/design.md

@@ -81,6 +81,23 @@ When modifying existing systems:
 - New components rationale: [why each is needed]
 - Steering compliance: [principles maintained]
 
+**Optional Hexagonal Lens** *(use when it clarifies ownership; delete for trivial changes)*:
+- Domain policy: [pure invariants or business rules, if any]
+- App/use-case orchestration: [workflow order, transaction intent, idempotency, side-effect sequencing]
+- Driving adapters: [HTTP/CLI/test harness decode and error mapping]
+- Driven adapters: [provider, storage, diagnostics, queue, or file-system translation]
+- Composition root: [where concrete dependencies are constructed and wired]
+- Ports/query seams: [consumer-owned interfaces or read DTOs, only where there is real substitution/read-model value]
+
+**Project Boundary Questions (Go LIP)**:
+- Core-owned or plugin-owned? [answer and rationale]
+- New canonical concept, or provider/adapter-specific behavior? [answer and rationale]
+- Streaming-first path preserved? [how non-streaming collects from stream, if applicable]
+- Provider SDK leakage avoided? [which package owns SDK/wire types]
+- No retry/failover after first client-visible output preserved? [yes/no and proof point]
+- Secure-session, diagnostics, or startup-security posture affected? [yes/no and required revalidation]
+- Extension platform seam used or extended? [stage/facade, or why no seam applies]
+
 ### Technology Stack
 
 | Layer | Choice / Version | Role in Feature | Notes |

.kiro/settings/templates/specs/requirements.md

@@ -8,6 +8,9 @@
 - **In scope**: {{IN_SCOPE_BEHAVIORS}}
 - **Out of scope**: {{OUT_OF_SCOPE_BEHAVIORS}}
 - **Adjacent expectations**: {{ADJACENT_SYSTEM_OR_SPEC_EXPECTATIONS}}
+- **Boundary ownership**: Core / frontend plugin / backend plugin / feature plugin / SDK / docs-only: {{BOUNDARY_OWNER}}
+- **Optional hexagonal lens**: Domain policy / app orchestration / driving adapter / driven adapter / composition root: {{OPTIONAL_HEXAGONAL_OWNERSHIP}}
+- **Revalidation triggers**: Routing / streaming / capability negotiation / secure session / diagnostics / startup security: {{REVALIDATION_TRIGGERS}}
 
 ## Requirements
 

.kiro/settings/templates/specs/tasks.md

@@ -16,9 +16,13 @@ Use whichever pattern fits the work breakdown:
   - {{DETAIL_ITEM_2}}
   - {{OBSERVABLE_COMPLETION_ITEM}} *(At least one detail item should state the observable completion condition for this task.)*
   - _Requirements: {{REQUIREMENT_IDS}}_ *(IDs only; do not add descriptions or parentheses.)*
-  - _Boundary: {{COMPONENT_NAMES}}_ *(Only for (P) tasks. Omit when scope is obvious.)*
-  - _Depends: {{TASK_IDS}}_ *(Only for non-obvious cross-boundary dependencies. Most tasks omit this.)*
+  - _Boundary: {{CORE_OR_PLUGIN_OR_SDK_OR_DOCS}}_
+  - _Depends: {{TASK_OR_SPEC_DEPENDENCIES}}_
+  - _Validation: {{TEST_OR_CHECK_COMMANDS}}_
 
 > **Parallel marker**: Append ` (P)` only to tasks that can be executed in parallel. Omit the marker when running in `--sequential` mode.
 >
 > **Optional test coverage**: When a sub-task is deferrable test work tied to acceptance criteria, mark the checkbox as `- [ ]*` and explain the referenced requirements in the detail bullets.
+>
+> **Boundary annotations**: For this Go LIP repo, use `_Boundary:_` for core/runtime, frontend plugin, backend plugin, feature plugin, SDK/public contract, config/wiring, docs, or tests. Use `_Validation:_` to name the focused command that proves the task.
+> If the task uses a hexagonal split, name the owner precisely (`domain policy`, `app orchestration`, `driving adapter`, `driven adapter`, `composition root`, `query seam`) instead of adding generic layer work.

.kiro/settings/templates/steering-custom/testing.md

@@ -23,15 +23,17 @@ Naming:
 - E2E: full flows, minimal mocks, only for critical journeys
 
 ## Structure (AAA)
-```typescript
-it('does X when Y', () => {
-  // Arrange
-  const input = setup();
-  // Act
-  const result = act(input);
-  // Assert
-  expect(result).toEqual(expected);
-});
+```go
+func TestFeature_Behavior(t *testing.T) {
+	// Arrange
+	input := setup(t)
+	// Act
+	got := run(input)
+	// Assert
+	if got != want {
+		t.Fatalf("got %v, want %v", got, want)
+	}
+}
 ```
 
 ## Mocking & Data
@@ -43,5 +45,9 @@ it('does X when Y', () => {
 - Target: [% overall]; higher for critical domains
 - Enforce thresholds in CI; exceptions require review rationale
 
+## Critical Behavior Contracts
+- [List behavior that must always have regression coverage: streaming order, security denial, routing/failover, persistence, etc.]
+- [List validation commands or CI gates that prove the contract.]
+
 ---
 _Focus on patterns and decisions. Tool-specific config lives elsewhere._

.kiro/settings/templates/steering/structure.md

@@ -37,5 +37,13 @@ import { Local } from './local'     // Relative
 
 [Key architectural patterns and dependency rules]
 
+## Boundary Ownership
+
+[Record which packages own core policy, protocol adapters, plugin SDK contracts, feature extension seams, composition roots, test harnesses, and operational/security guardrails. Do not list every file.]
+
+## Optional Hexagonal Guidance
+
+[If useful for the project, record how domain policy, app/use-case orchestration, driving adapters, driven adapters, query seams, and composition roots map onto the existing package layout. Do not imply a repo-wide rename is required.]
+
 ---
 _Document patterns, not file trees. New files following patterns shouldn't require updates_

.kiro/settings/templates/steering/tech.md

@@ -41,5 +41,13 @@
 
 [Important architectural choices and rationale]
 
+## Boundary and Security Posture
+
+[For Go LIP-style proxy projects: capture where protocol adapters, provider SDKs, runtime security checks, diagnostics, and extension seams belong. Keep this pattern-level, not a config catalog.]
+
+## Optional Ports and Adapters Rules
+
+[If the project benefits from hexagonal architecture, capture consumer-owned ports, adapter translation boundaries, transaction/side-effect ownership, and read/query seams. Keep it pragmatic and avoid interfaces or layers created only for symmetry.]
+
 ---
 _Document standards and patterns, not every dependency_

…specs/bun-database-abstraction/design.md …chive/bun-database-abstraction/design.md.kiro/specs/bun-database-abstraction/design.md renamed to .kiro/specs/archive/bun-database-abstraction/design.md .kiro/specs/bun-database-abstraction/design.md renamed to .kiro/specs/archive/bun-database-abstraction/design.md

@@ -120,19 +120,19 @@ internal/
 │   │   ├── store.go            # Add postgres store branch
 │   │   └── bunstore/
 │   │       ├── store.go        # Bun-backed b2bua.Store implementation
-│   │       ├── schema.go       # Dialect-aware continuity DDL
+│   │       ├── 20250426000000_continuity_baseline.go # Bun migrate baseline DDL (caller filename → migration id)
 │   │       └── store_test.go   # Contract and parity tests
 │   └── securesession/
 │       ├── adapters/
 │       │   └── bunstore/
 │       │       ├── store.go    # Bun-backed app.Store implementation
-│       │       ├── schema.go   # Dialect-aware secure-session DDL
+│       │       ├── 20250426000000_securesession_baseline.go # Bun migrate baseline DDL (caller filename → migration id)
 │       │       ├── models.go   # Bun row models and scan/convert helpers
 │       │       └── store_test.go
 │       └── storecontract/
 │           └── bun_contract_test.go # Contract entry for Bun-backed store
 └── archtest/
-    └── db_abstraction_boundaries_test.go # Optional import guardrail
+    └── database_abstraction_imports_test.go # Optional import guardrail
 ```
 
 ### Modified Files