arch: VeriSimDB replaces PostgreSQL — dogfooding decision

All Stapeln data will use VeriSimDB (port 8093) instead of PostgreSQL.
The Ecto/DbStore/migrations layer was verified working but is superseded
by this architectural decision to dogfood VeriSimDB.

- PostgreSQL container stopped and will be removed
- VeriSimDB instance to be created: port 8093, volume stapeln-verisimdb-data
- Existing Stapeln.VeriSimDB.Client to be extended for stack/user/settings CRUD
- NativeBridge to route through VeriSimDB instead of DbStore
- STATUS.md and STATE.a2ml updated with decision and next-actions

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.machine_readable/6a2/STATE.a2ml

@@ -19,8 +19,9 @@ frontend-views = 9
 frontend-errors = 0
 frontend-warnings = 0
 backend-api-verified = true
-database-running = true
-database-engine = "postgresql-17-alpine-podman"
+database-running = false
+database-engine = "verisimdb (port 8093, to be migrated from postgresql)"
+database-decision = "Full VeriSimDB, no PostgreSQL — dogfooding decision 2026-03-23"
 end-to-end-verified = true
 
 [recent-changes]
@@ -41,11 +42,13 @@ key-additions = [
 ]
 
 [blockers]
+verisimdb-migration = "Replace Ecto/PostgreSQL with VeriSimDB for all data — dogfooding"
 auth-ui = "JWT backend exists but no login screen"
 attack-surface-analyzer = "Documented in ROADMAP, 0% built"
 websocket = "Socket.res scaffolded, no live channel events"
 
 [next-actions]
+priority-0 = "Migrate persistence from PostgreSQL to VeriSimDB (port 8093)"
 priority-1 = "Build AttackSurfaceAnalyzer.res (MUST-2)"
 priority-2 = "Auth login screen (MUST-9)"
 priority-3 = "Browser visual testing (BoJ browser cartridge needed)"

STATUS.md

@@ -39,8 +39,17 @@ A reasonably IT-capable 12-year-old can help their parents build a secure contai
 - **DOM‑mounter track:** Extracted to `/var/mnt/eclipse/repos/stapeln-dom-mounter`.
 - This work is not on the critical path for the container‑hater MVP.
 
+## Architectural Decision: VeriSimDB (2026-03-23)
+
+**All Stapeln data will use VeriSimDB, not PostgreSQL.** Dogfooding decision.
+- Dedicated instance: port 8093, volume `stapeln-verisimdb-data`
+- Existing `Stapeln.VeriSimDB.Client` module to be extended for stack CRUD
+- Ecto/DbStore/PostgreSQL layer to be removed (was a conventional shortcut)
+- The PostgreSQL container has been stopped; migrations were verified working but are superseded
+
 ## What Is Not Implemented Yet
 
+- **VeriSimDB as primary store:** Client exists for audit logging; needs extending for stack/user/settings CRUD
 - **Backend runtime orchestration API:** Not implemented in `stapeln/backend` by design; runtime operations belong to Svalinn/Vordr.
 - **Validation Engine Depth:** 12 check categories returning real findings; not yet parity with full security roadmap.
 - **Formal Verification Layers:** Idris2 types are now present for ABI contracts, but full proof pipeline is not wired.