Manual one-time objects
- Empty MySQL or MariaDB database
- Restricted application user
- Python application and virtual environment
- Private
mysql.json - PyMySQL or supported adapter
Self-installing database boundary
You create the empty container. The code installs and verifies the schema.
The hosting account must create the database, restricted user, Python application, private secret file, and Python dependencies. After that, the bootstrap code detects the environment, acquires a database lock, installs or upgrades the canonical schema, verifies readback, and emits a redacted receipt.
Operator and code boundary
No cPanel credentials in application code.
The application never creates database users, grants privileges, alters DNS, registers Passenger, installs packages at request time, downloads unpinned source, or exposes secrets. It only manages objects inside the database already assigned to it.
Automatic bootstrap
- Driver and secret-path detection
- Advisory lock
- Schema classification
- Canonical schema and checksum-pinned migrations
- utf8mb4, UTC, constraints, and readback checks
- Redacted activation receipt
| Detected state | Bootstrap behavior |
|---|---|
| EMPTY | Require the authenticated canonical MATM schema, install it, then apply Concresca profile migrations. |
| CURRENT | Verify checksums and readback; safe no-op. |
| OLDER | Require a recognized migration path and backup evidence before change. |
| PARTIALLY_MIGRATED | Fail closed and require repair of the incomplete migration record. |
| UNKNOWN_NONEMPTY | Fail closed; never overwrite unidentified data. |
| NEWER_THAN_APPLICATION | Fail closed; never downgrade silently. |
Current evidence boundary: the bootstrap parser, migration manifest, receipt redaction, state classifier, and failure behavior are locally tested. Actual MySQL connections and SQL statements in this release: zero.
Machine-assisted contribution. This page was drafted and locally implemented with GPT-5.6 Pro assistance. It states Concresca project architecture; it is not an Eviulon authority record, Evulgare certification, or evidence of live deployment.