SuperBased Files

Fixed

• fix(retention): the daemon no longer runs unbounded full-database VACUUMs — the retention size-cap's automatic, looping bare VACUUM (which could write tens of GiB of SQLite temp files on large databases and fill the host disk) is removed from every automatic path. Size-cap reclamation is now a single bounded pass (aged-actions shed + WAL checkpoint + incremental vacuum where enabled); full compaction is operator-triggered via observer prune --vacuum, which now also requires the daemon to be down and ~2× free disk headroom.
• fix(db): connection-scoped pragmas apply to every pooled connection — synchronous, temp_store, and a new hard_heap_limit memory backstop moved into the SQLite DSN (previously they were applied post-open to one arbitrary pooled connection, letting other connections spill temp files to disk with default settings). The pool is now bounded (SetMaxOpenConns/SetConnMaxIdleTime), and a regression test pins the pragma set on N concurrent connections. Applied to the node DB, the org server DB, and the edge WAL store.
• fix(db): startup integrity check is size-gated — PRAGMA quick_check (which reads every page and could run for over an hour on multi-GiB databases) is skipped above a configurable size threshold (integrity_check_max_gb, default 8) with a 10-minute deadline; observer doctor db remains the explicit, authoritative integrity path.
• fix(observer): cross-process maintenance lease — retention, maintenance, and codeintel-on-start acquire a flock-based lease so concurrent observer processes cannot duplicate expensive maintenance work; codeintel index-on-start gained an aggregate deadline.
• perf(store): org-push snapshot queries no longer sort or scan far more than they ship — three per-tick reads fixed, each verified with EXPLAIN QUERY PLAN and selection-equivalence tests: session network events (per-session cap pushed into SQL via ROW_NUMBER() so the body join fires only on surviving rows, migration 089), session process rows (same cap pushdown, plus the per-run event count now seeks a new process_run_id index instead of aggregating the whole process_events table per tick, migration 090), and the codeintel dev + teams-tier aggregates (Cartesian-product joins rewritten to pre-aggregate per file). On the profiled node these were ~55% of steady-state daemon CPU.
• fix(arena): Windows build — unix-only process-group syscalls in internal/arena are build-tagged, restoring GOOS=windows builds (and the win32 npm/VSIX artifacts).

Added

• feat(observer): env-gated pprof endpoint — OBSERVER_PPROF_ADDR (loopback-only, default off, fail-soft) serves net/http/pprof for the daemon's lifetime, so steady-state CPU consumers can be named empirically.
• feat(observer): temp-file watchdog + startup guidance — a background check WARNs when deleted-but-open SQLite temp files exceed a threshold (the failure mode that silently consumed ~80 GiB inside WSL), a stale-binary check WARNs when the running executable no longer matches the on-disk build, and daemon startup states that full integrity checks and compaction are operator-triggered.

Docs

• Root-cause audit + remediation plan for the disk/compute exhaustion incident, and a steady-state CPU audit (pprof-named findings, a full background-loop cadence inventory, and prevention guidance) with its remediation plan — see docs/audits/ and docs/plans/ (*2026-08-26*).

Downloads

Pre-built binaries for each supported platform are attached below. Linux variants bundle antigravity-bridge.exe next to the observer binary for WSL2 users of the Antigravity adapter.

Verify with sha256sum -c SHA256SUMS (or shasum -a 256 -c SHA256SUMS on macOS) from the directory containing the downloads.

Also available via npm: npm install -g @superbased/observer@1.32.0

Org server (Docker)

The self-hosted org server ships as a Docker image and as per-platform observer-org-v1.32.0-* archives (attached below).

:::bash
docker pull ghcr.io/superbasedapp/observer-org:v1.32.0

The image is keyless-signed with cosign. Verify it:

:::bash
cosign verify ghcr.io/superbasedapp/observer-org:v1.32.0 \
  --certificate-identity-regexp 'https://github.com/marmutapp/superbased-observer-private/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Supply chain

CycloneDX SBOMs are attached: observer.cdx.json and observer-org.cdx.json.

SLSA Level 3 build provenance for the binaries is attached below as a *.intoto.jsonl attestation. The build runs on the private origin repo, so pass that as the source when verifying an extracted binary with slsa-verifier v2.7.0 or newer (older versions fail with unexpected tlog entry type: expected intoto:0.0.2, got dsse:0.0.1):

:::bash
slsa-verifier verify-artifact ./observer \
  --provenance-path *.intoto.jsonl \
  --source-uri github.com/marmutapp/superbased-observer-private