Merge branch 'v3.0' into fix/5363-monitor-caching-sha2

Brings the branch up to date with v3.0 (14 commits, including the #5993
credential-scope work that already carried this branch's ca03c8d), and
re-triggers a full CI run after the CI-mysql84-g9 job on 9421d44 wedged for
6 hours in test_ssl_fast_forward-3_libmariadb-t.

That stall was not reproducible: the same commit ran mysql84-g9 locally in 26
minutes and the test passed 5/5 in isolation, four other g9 runs completed
successfully inside the same window, and no GitHub Actions incident overlapped
it. Cause still unknown; investigation paused.

Merge verified: lib/MySQL_Protocol.cpp auto-merged keeping both v3.0's
cred_scope_for_session() call sites and this branch's Session/DS argument fix;
the repro scripts and TAP test keep their restore-exact-state versions.
Builds clean under PROXYSQL31.

Author: renecannao

.github/workflows/CI-lint-groups-json.yml

@@ -10,13 +10,24 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - name: Fetch GH-Actions branch
+        # The reusable half of every workflow pair lives on GH-Actions, so the
+        # coverage lint needs that ref to tell an unwired group from one wired
+        # only over there. actions/checkout fetches a single branch, so without
+        # this the check finds no ref and skips itself silently. --depth=1 is
+        # enough: the lint only reads the tree, never history.
+        run: |
+          git fetch --no-tags --depth=1 origin \
+            +refs/heads/GH-Actions:refs/remotes/origin/GH-Actions \
+            || echo "::warning::could not fetch GH-Actions; the workflow-coverage check will skip"
       - name: Lint groups.json format
         run: python3 test/tap/groups/lint_groups_json.py
       - name: Check every TAP source is registered in groups.json
         run: python3 test/tap/groups/check_groups.py --source
       - name: Check group infra/workflow coverage (warn-only)
-        # Warns when a group references a missing infra (phantom) or has a
-        # real dbdeployer infra but no GitHub Actions workflow. Known gaps
-        # are allowlisted; only NEW infra-backed groups without a workflow
-        # are flagged. Warn-only here (no --strict) so it never reds CI.
+        # Warns when a group references a missing infra (phantom), or when no
+        # workflow on either branch can select the group at all -- meaning
+        # tests registered in it never run in CI. Known gaps are allowlisted;
+        # only NEW ones are flagged. Warn-only here (no --strict) so it never
+        # reds CI.
         run: python3 test/tap/groups/lint_group_coverage.py

deps/sqlite3/sqlite3_pass_exts.patch

@@ -1,6 +1,6 @@
 --- sqlite3.c	2024-03-22 19:22:47.046093173 +0100
 +++ sqlite3-pass-exts.c	2024-03-22 19:24:09.557303716 +0100
-@@ -26275,6 +26275,207 @@
+@@ -26275,6 +26275,228 @@
    sqlite3ResultStrAccum(context, &sRes);
  }
 
@@ -171,14 +171,35 @@
 +			sqlite3_result_text(context, err_msg, -1, SQLITE_TRANSIENT);
 +			return;
 +		} else {
++			/* Map each random byte onto a 64-character alphabet that is safe to embed
++			 * in ProxySQL's credential strings.
++			 *
++			 * The previous scheme (mask with 0x7f, then bump only '\0' and '$') left
++			 * roughly 26% of generated salts containing ';' or ':'. Those are the
++			 * separators used by 'admin-admin_credentials' and
++			 * 'admin-stats_credentials', so such a hash is silently split into a bogus
++			 * credential by ProxySQL_Admin::add_credentials() at
++			 * 'LOAD ADMIN VARIABLES TO RUNTIME' -- the variable still reports all 70
++			 * bytes and nothing errors, but the login then fails with a generic
++			 * 'Access denied'. It also emitted control bytes ~99% of the time, making
++			 * the hashes unreadable and unsafe to paste into a configuration file.
++			 *
++			 * 64 divides 256 evenly, so masking with 0x3f introduces no modulo bias.
++			 * 20 characters over a 64-symbol alphabet still carry 120 bits of salt
++			 * entropy.
++			 *
++			 * This is a generation-side change only. Verification
++			 * (MySQL_Protocol.cpp: PPHR_verify_sha2 / PPHR_sha2full) reads the salt
++			 * back out with substr(7,20) and passes it straight to sha256_crypt_r
++			 * without inspecting its contents, so hashes generated before this change
++			 * keep verifying unchanged and no migration is required.
++			 */
++			static const char SALT_ALPHABET[] =
++				"./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 +			unsigned int i = 0;
 +
-+			for (i = 0; i < sizeof(salt_buf)/sizeof(unsigned char); i++) {
-+				salt_buf[i] = salt_buf[i] & 0x7f;
-+
-+				if (salt_buf[i] == '\0' || salt_buf[i] == '$') {
-+					salt_buf[i] = salt_buf[i] + 1;
-+				}
++			for (i = 0; i < DEF_SALT_SIZE; i++) {
++				salt_buf[i] = (unsigned char)SALT_ALPHABET[salt_buf[i] & 0x3f];
 +			}
 +
 +			memcpy(salt, salt_buf, salt_size);
@@ -208,7 +229,7 @@
  /*
  ** current_time()
  **
-@@ -133230,6 +133431,10 @@
+@@ -133230,6 +133452,10 @@
      FUNCTION(substr,             3, 0, 0, substrFunc       ),
      FUNCTION(substring,          2, 0, 0, substrFunc       ),
      FUNCTION(substring,          3, 0, 0, substrFunc       ),

docs/superpowers/plans/2026-08-08-admin-session-autocommit.md

@@ -0,0 +1,166 @@
+# Admin Session Autocommit Compatibility Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Let Connector/Python's `SET @@session.autocommit = ON|OFF` complete successfully on ProxySQL's classic Admin interface.
+
+**Architecture:** The Admin handler already has a connect-setup compatibility block that replies with an OK packet and no result set for bare `SET AUTOCOMMIT`. Extend that same block with the Connector/Python spelling, preserving the Admin interface's existing no-op semantics. Extend its focused TAP regression test with exact Connector/Python payloads.
+
+**Tech Stack:** C++17, ProxySQL classic Admin protocol, TAP/libmysqlclient regression test, GNU Make.
+
+## Global Constraints
+
+- Keep the scope to connection-setup compatibility; do not add Admin transaction-state support.
+- Match `SET @@session.autocommit` case-insensitively after leading SQL comments are stripped.
+- Return the existing OK/no-result-set response and do not modify `global_variables`.
+- Build from a clean worktree with `make clean` followed by `make` using a bounded parallelism level derived from available CPUs and memory.
+- Preserve normal red/green CI semantics; do not mask the Connector/Python 26.7.0 soak failure.
+
+---
+
+### Task 1: Establish the Admin compatibility regression
+
+**Files:**
+- Modify: `test/tap/tests/mysql-reg_test_5786_admin_strip_leading_sql_comments-t.cpp:39-55`
+- Test: `test/tap/tests/mysql-reg_test_5786_admin_strip_leading_sql_comments-t.cpp`
+
+**Interfaces:**
+- Consumes: the existing `ACCEPT_CASES` array; each entry is sent via `mysql_query()` to the classic Admin interface.
+- Produces: three failing, exact Connector/Python compatibility assertions that become green only when the Admin handler sends an OK packet.
+
+- [ ] **Step 1: Add the precise failing connection-setup cases**
+
+  Add these three entries immediately after the existing bare `SET AUTOCOMMIT=1` cases:
+
+  ```cpp
+  "SET @@session.autocommit = OFF",                    // Connector/Python pure-Python post-connect setup
+  "SET @@session.autocommit = ON",                     // setter's opposite state uses the same syntax
+  "/*connector-python*/ SET @@session.autocommit = OFF", // comment-stripping compatibility path
+  ```
+
+- [ ] **Step 2: Build and run the regression test before the handler change**
+
+  Determine `build_jobs` as the smaller of the available CPU count and 8, then use it consistently:
+
+  ```bash
+  build_jobs=$(nproc)
+  [ "$build_jobs" -gt 8 ] && build_jobs=8
+  make clean
+  make -j"$build_jobs"
+  make -C test/tap/tests -j"$build_jobs" mysql-reg_test_5786_admin_strip_leading_sql_comments-t
+  ```
+
+  Run only the focused test through its normal isolated harness and clean up its
+  uniquely named infrastructure on exit:
+
+  ```bash
+  export INFRA_ID="admin-session-autocommit-red-$(date +%s)"
+  export TAP_GROUP=legacy-g1
+  export TEST_PY_TAP_INCL='mysql-reg_test_5786_admin_strip_leading_sql_comments-t'
+  export SKIP_CLUSTER_START=1
+  trap 'test/infra/control/stop-proxysql-isolated.bash || true; test/infra/control/destroy-infras.bash || true' EXIT
+  test/infra/control/ensure-infras.bash
+  test/infra/control/run-tests-isolated.bash
+  ```
+
+  The new cases must fail with `ERROR: Unknown global variable:
+  '@@session.autocommit'.`; retain the failing TAP output as the red-phase
+  evidence.
+
+- [ ] **Step 3: Commit the regression test**
+
+  ```bash
+  git add test/tap/tests/mysql-reg_test_5786_admin_strip_leading_sql_comments-t.cpp
+  git commit -m "test: cover admin session autocommit setup"
+  ```
+
+### Task 2: Accept the Connector/Python session spelling as an Admin setup no-op
+
+**Files:**
+- Modify: `lib/Admin_Handler.cpp:4065-4088`
+- Test: `test/tap/tests/mysql-reg_test_5786_admin_strip_leading_sql_comments-t.cpp`
+
+**Interfaces:**
+- Consumes: `mb`, the comment-stripped command pointer in `admin_session_handler()`.
+- Produces: an OK packet through `SPA->send_ok_msg_to_client()` for `SET @@session.autocommit`, with no SQLite query or ProxySQL global-variable update.
+
+- [ ] **Step 1: Extend only the existing compatibility predicate**
+
+  Add one branch next to the existing `SET AUTOCOMMIT` condition:
+
+  ```cpp
+  ||
+  (!strncasecmp("SET @@session.autocommit", mb, strlen("SET @@session.autocommit")))
+  ```
+
+  Do not change `admin_handler_command_set()`: the command must be consumed before it reaches the global-variable translator.
+
+- [ ] **Step 2: Rebuild cleanly and verify the focused TAP test is green**
+
+  ```bash
+  build_jobs=$(nproc)
+  [ "$build_jobs" -gt 8 ] && build_jobs=8
+  make clean
+  make -j"$build_jobs"
+  make -C test/tap/tests -j"$build_jobs" mysql-reg_test_5786_admin_strip_leading_sql_comments-t
+  ```
+
+  Run the focused group using the same exact isolated-harness command as the
+  red phase, with a new `INFRA_ID` ending in `-green`. Confirm all old and new
+  accept cases receive an OK packet with no result set, then run:
+
+  ```bash
+  git diff --check
+  ```
+
+- [ ] **Step 3: Commit the minimal handler fix**
+
+  ```bash
+  git add lib/Admin_Handler.cpp test/tap/tests/mysql-reg_test_5786_admin_strip_leading_sql_comments-t.cpp
+  git commit -m "fix(admin): accept session autocommit setup"
+  ```
+
+### Task 3: Verify the real Connector/Python 26.7.0 path and publish
+
+**Files:**
+- Modify: no additional source files
+- Test: `test/scripts/mysqlx/behavioral_validation.py` through the existing `mysqlx-soak-g1` harness
+
+**Interfaces:**
+- Consumes: the image built with `MYSQL_CONNECTOR_PYTHON_VERSION=26.7.0` and the existing behavioral-validation Admin connection.
+- Produces: evidence that the connector reaches its Admin delete/reload actions rather than failing during post-connect setup.
+
+- [ ] **Step 1: Build the test image with the compatibility connector version**
+
+  ```bash
+  docker build --network host \
+    --build-arg MYSQL_CONNECTOR_PYTHON_VERSION=26.7.0 \
+    -t proxysql-ci-base:mysqlx-connector-26.7.0 \
+    -f test/infra/docker-base/Dockerfile test/infra/docker-base
+  ```
+
+- [ ] **Step 2: Run the existing MySQLX soak harness against that image**
+
+  The isolation scripts consume `proxysql-ci-base:latest`, so temporarily
+  point that local compatibility alias at the versioned image, run only the
+  behavioral test, and restore the 9.7.0 alias afterwards:
+
+  ```bash
+  docker tag proxysql-ci-base:mysqlx-connector-26.7.0 proxysql-ci-base:latest
+  export INFRA_ID="admin-session-autocommit-mysqlx-$(date +%s)"
+  export TAP_GROUP=mysqlx-soak-g1
+  export TEST_PY_TAP_INCL='test_mysqlx_soak_behavioral-t'
+  export SKIP_CLUSTER_START=1
+  trap 'test/infra/control/stop-proxysql-isolated.bash || true; test/infra/control/destroy-infras.bash || true; docker tag proxysql-ci-base:mysqlx-connector-9.7.0 proxysql-ci-base:latest' EXIT
+  test/infra/control/ensure-infras.bash
+  test/infra/control/run-tests-isolated.bash
+  ```
+
+  Verify that `mysql.connector.connect()` reaches the Admin delete/reload
+  actions instead of emitting `Unknown global variable:
+  '@@session.autocommit'`; assess any subsequent route-reload result
+  separately.
+
+- [ ] **Step 3: Publish the focused branch as a pull request**
+
+  Rebase or merge the current `origin/v3.0` only if it has advanced, run `git diff --check`, push `fix/admin-session-autocommit`, and open a PR targeting `v3.0`. The PR description must state the pure-Python Connector/Python fallback mechanism, the Admin no-op behavior, focused TAP evidence, and that #5984 must land before CI can exercise the 26.7.0 soak matrix.

docs/superpowers/specs/2026-08-08-admin-session-autocommit-design.md

@@ -0,0 +1,48 @@
+# Admin session-autocommit Connector/Python compatibility
+
+## Goal
+
+Allow MySQL Connector/Python 26.7.0 to connect to ProxySQL's classic Admin
+interface without treating its session-scoped autocommit setup statement as a
+ProxySQL global-variable update.
+
+## Root cause
+
+The 26.7.0 C extension cannot load in the CI base image because it requires
+`OPENSSL_3.2.0`. Connector/Python therefore uses its pure-Python connection,
+whose post-connect setup issues:
+
+```sql
+SET @@session.autocommit = OFF
+```
+
+`admin_session_handler()` already consumes `SET AUTOCOMMIT` as an accepted
+connect-setup no-op. Its matcher does not recognize the canonical
+`@@session.autocommit` spelling, so the command instead reaches
+`admin_handler_command_set()`, where it is rejected as an unknown ProxySQL
+global variable.
+
+## Design
+
+Extend the existing Admin connect-setup acceptance block to recognize the
+case-insensitive `SET @@session.autocommit` form. It will return the same OK
+packet and make no configuration or transaction-state change, exactly matching
+the current Admin treatment of bare `SET AUTOCOMMIT`.
+
+No attempt will be made to implement stateful MySQL transaction semantics on
+the SQLite-backed Admin interface. `SELECT @@session.autocommit` is also out of
+scope: the observed connector connection path requires only the `SET` command.
+
+## Regression coverage
+
+Extend the existing Admin connect-setup TAP regression test with the exact
+Connector/Python syntax for both `OFF` and `ON`, including a leading SQL-comment
+variant. The test will verify an OK packet and no result set, and will continue
+to cover the existing bare spelling and unrelated setup statements.
+
+## Verification
+
+Run the focused TAP test after a clean build, then run the MySQLX soak scenario
+with Connector/Python 26.7.0 once PR #5984's portable pin-check fix is merged.
+The resulting matrix leg must reach the actual soak test without failure
+masking.

include/MySQL_Authentication.hpp

@@ -74,6 +74,17 @@ class MySQL_Authentication {
 	std::unique_ptr<SQLite3_result> mysql_users_resultset { nullptr };
 	creds_group_t creds_backends;
 	creds_group_t creds_frontends;
+	/**
+	 * @brief Scope holding 'admin-admin_credentials' and 'admin-stats_credentials'.
+	 * @details Separate from 'creds_frontends' so an Admin credential and a
+	 *   'mysql_users' row of the same name cannot overwrite each other. Only
+	 *   populated when PROXYSQL31 is defined (see ADMIN_CRED_SCOPE); on the stable
+	 *   tier it stays empty and admin credentials remain in 'creds_frontends'.
+	 *   Never included in 'dump_all_users()', so 'runtime_mysql_users' and the
+	 *   cluster checksum are unaffected.
+	 */
+	creds_group_t creds_admins;
+	creds_group_t& creds_for(enum cred_username_type usertype);
 	bool _reset(enum cred_username_type usertype);
 	uint64_t _get_runtime_checksum(enum cred_username_type usertype);
 	public:

include/PgSQL_Authentication.h

@@ -69,6 +69,16 @@ class PgSQL_Authentication {
 	std::unique_ptr<SQLite3_result> pgsql_users_resultset { nullptr };
 	creds_group_t creds_backends;
 	creds_group_t creds_frontends;
+	/**
+	 * @brief Scope holding 'admin-admin_credentials' / 'admin-stats_credentials'.
+	 * @details Mirrors MySQL_Authentication::creds_admins. Only populated when
+	 *   PROXYSQL31 is defined (see ADMIN_CRED_SCOPE in MySQL_Authentication.hpp);
+	 *   on the stable tier admin credentials stay in 'creds_frontends' alongside
+	 *   'pgsql_users' and behaviour is unchanged. Never walked by
+	 *   dump_all_users(), so 'runtime_pgsql_users' and the checksum are unaffected.
+	 */
+	creds_group_t creds_admins;
+	creds_group_t& creds_for(enum cred_username_type usertype);
 	bool _reset(enum cred_username_type usertype);
 	uint64_t _get_runtime_checksum(enum cred_username_type usertype);
 	public:

include/proxysql_structs.h

@@ -47,7 +47,11 @@ enum log_event_type {
 	PROXYSQL_METADATA
 };
 
-enum cred_username_type { USERNAME_BACKEND, USERNAME_FRONTEND, USERNAME_NONE };
+// USERNAME_ADMIN is a scope for 'admin-admin_credentials' / 'admin-stats_credentials'.
+// It is compiled unconditionally, but only *used* when PROXYSQL31 is defined --
+// see ADMIN_CRED_SCOPE in MySQL_Authentication.hpp. On the stable tier those
+// credentials continue to live in USERNAME_FRONTEND alongside mysql_users.
+enum cred_username_type { USERNAME_BACKEND, USERNAME_FRONTEND, USERNAME_NONE, USERNAME_ADMIN };
 
 #define PROXYSQL_USE_RESULT
 
@@ -771,6 +775,42 @@ enum proxysql_session_type {
 	PROXYSQL_SESSION_NONE
 };
 
+/**
+ * @brief The credential scope holding 'admin-admin_credentials' and
+ *   'admin-stats_credentials'.
+ *
+ * @details Historically these shared USERNAME_FRONTEND with mysql_users /
+ *   pgsql_users -- one flat map keyed by username -- so an Admin credential and
+ *   a row of the same name overwrote each other. That is the only reason the
+ *   documentation states those users cannot also appear in mysql_users.
+ *
+ *   From the Innovative tier onward they get their own scope, removing the
+ *   collision rather than policing it. This is an INCOMPATIBLE change (a
+ *   colliding name currently resolves to one entry; afterwards the two are
+ *   independent), so it is gated to PROXYSQL31. On the stable tier this is
+ *   USERNAME_FRONTEND, every call site passes what it always passed, and
+ *   behaviour is unchanged. See issue #5987.
+ */
+#ifdef PROXYSQL31
+#define ADMIN_CRED_SCOPE USERNAME_ADMIN
+#else
+#define ADMIN_CRED_SCOPE USERNAME_FRONTEND
+#endif /* PROXYSQL31 */
+
+/**
+ * @brief Credential scope to resolve a username in, for a given session type.
+ * @details ADMIN and STATS sessions use ADMIN_CRED_SCOPE; every other session
+ *   type (MySQL/PgSQL frontend, SQLite server, ClickHouse) uses
+ *   USERNAME_FRONTEND. Shared by both protocol implementations so the policy
+ *   exists once.
+ */
+static inline enum cred_username_type cred_scope_for_session(enum proxysql_session_type session_type) {
+	if (session_type == PROXYSQL_SESSION_ADMIN || session_type == PROXYSQL_SESSION_STATS) {
+		return ADMIN_CRED_SCOPE;
+	}
+	return USERNAME_FRONTEND;
+}
+
 #endif /* PROXYSQL_ENUMS */