@coffre/db 0.14.5 → 0.15.0

package/dist/migrations/postgres/0025_app_change.sql

@@ -0,0 +1,221 @@
+-- 0.15's change path for the app's own rows (docs/design/0.15-plan.md, "As built: PR 4b"; the spec: formal/HotPathOne.tla's change actions, formal/Migration015.tla's AppObject): `app_change` logs the changes the app makes to the objects its rows hold (credentials, keys, environments) in the app's own transaction, beside the rows it writes. The vault sealed each change before the transaction (`prepare`); this function checks it under the fence and numbers it. It also fixes `change_input`'s environment branch for a deleted environment, whose object holds its slug before the tombstone (packages/vault/src/objects.ts). Nothing calls either before 0.15's switch: 0.14's code serves on it as before.
+--
+-- A change of the app's (hot-path-one.md, "A change"), called in its transaction after its rows and its 0.14 entries are written:
+-- - Locks: 0.14's head, which the app's transaction took before any of its rows (`audited()`), so taken again here at no cost; then the fence exclusive (ChangeLocks). Head, row, fence: Migration015.tla's AppHeadFirst. No member's lock: taken after the head, it would wait for a 0.14 decision that holds the member and waits for the head (RowFirst's order is the vault's, which takes the member first).
+-- - A retry finds its entry and answers its number; another change under its request id is refused.
+-- - ChangeChecksSeal: the row's seal is its object's newest change's (one probe, as a use makes), else `stale`.
+-- - ChangeCAS: the row's seal moves only from the one the vault read; else nothing is done (null), and the app reads again.
+-- - The entry, numbered now (ChangeNumberUnderLock); the locks go at the commit (LockToCommit), and the app answers once it is sealed (R51, CommitBeforeAnswer).
+-- The app writes its rows itself, as 0.14 does, and this function only their seals: what the seal covers is the vault's (prepare), and a row written otherwise than sealed is `tampered` to every use.
+--
+-- A row the vault never sealed, before the cutover (plan PR 9), is 0.14's: its call (no request id) logs nothing and only checks that its object has no change either, else `stale`, as `change_input` refuses one.
+CREATE FUNCTION app_change(
+    p_kind text, p_id text, p_request text, p_at bigint, p_actor text, p_payload text, p_seal_from bytea, p_seal bytea, p_mac bytea
+) RETURNS bigint
+    LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog, pg_temp AS $$
+DECLARE
+    op jsonb := p_payload::jsonb;
+    change text := op ->> 'op';
+    target uuid := public.log_object(p_kind, p_id);
+    n bigint;
+    done integer;
+    held bytea;
+BEGIN
+    PERFORM 1 FROM public.audit_chain_head WHERE only_row FOR UPDATE;
+    PERFORM pg_advisory_xact_lock(1668244070, 0);
+    held := CASE p_kind
+        WHEN 'credential' THEN (SELECT c.seal FROM public.credentials c WHERE c.id = p_id::uuid)
+        WHEN 'secret' THEN (SELECT x.seal FROM public.secrets x WHERE x.id = p_id::uuid)
+        WHEN 'environment' THEN (SELECT e.seal FROM public.environments e WHERE e.id = p_id::uuid)
+    END;
+    IF p_request IS NULL THEN
+        IF held IS NOT NULL OR EXISTS (SELECT 1 FROM public.log_changes c WHERE c.object = target) THEN
+            RAISE EXCEPTION 'the % object''s row is not its newest change''s: stale', p_kind USING ERRCODE = 'data_corrupted';
+        END IF;
+        RETURN 0;
+    END IF;
+    SELECT c.number INTO n FROM public.log_changes c WHERE c.request_id = p_request;
+    IF FOUND THEN
+        IF NOT EXISTS (
+            SELECT 1 FROM public.log_changes c
+             WHERE c.request_id = p_request AND c.object = target AND c.payload = p_payload AND c.seal IS NOT DISTINCT FROM p_seal
+        ) THEN
+            RAISE EXCEPTION 'request % names another change', p_request USING ERRCODE = 'unique_violation';
+        END IF;
+        RETURN n;
+    END IF;
+    IF NOT ((p_kind = 'credential' AND change IN ('credential.issue', 'credential.revoke', 'credential.renew', 'credential.scope'))
+        OR (p_kind = 'secret' AND change IN ('secret.write', 'secret.delete'))
+        OR (p_kind = 'environment' AND change IN ('environment.create', 'environment.rename', 'environment.archive', 'environment.delete'))) THEN
+        RAISE EXCEPTION 'the app makes no change % to a %', coalesce(change, 'without an op'), p_kind USING ERRCODE = 'invalid_parameter_value';
+    END IF;
+    IF op -> 'ref' ->> 'kind' IS DISTINCT FROM p_kind OR op -> 'ref' ->> 'id' IS DISTINCT FROM p_id THEN
+        RAISE EXCEPTION 'a change names the object it is to: %, %', p_kind, p_id USING ERRCODE = 'invalid_parameter_value';
+    END IF;
+    -- ChangeChecksSeal.
+    IF held IS DISTINCT FROM (SELECT c.seal FROM public.log_changes c WHERE c.object = target ORDER BY c.number DESC LIMIT 1) THEN
+        RAISE EXCEPTION 'the % object''s row is not its newest change''s: stale', p_kind USING ERRCODE = 'data_corrupted';
+    END IF;
+    -- ChangeCAS.
+    CASE p_kind
+        WHEN 'credential' THEN
+            UPDATE public.credentials SET seal = p_seal WHERE id = p_id::uuid AND seal IS NOT DISTINCT FROM p_seal_from;
+        WHEN 'secret' THEN
+            UPDATE public.secrets SET seal = p_seal WHERE id = p_id::uuid AND seal IS NOT DISTINCT FROM p_seal_from;
+        WHEN 'environment' THEN
+            UPDATE public.environments SET seal = p_seal WHERE id = p_id::uuid AND seal IS NOT DISTINCT FROM p_seal_from;
+    END CASE;
+    GET DIAGNOSTICS done = ROW_COUNT;
+    IF done = 0 THEN RETURN NULL; END IF;
+    INSERT INTO public.log_changes (number, at, request_id, object, actor, payload, seal, mac)
+        VALUES (nextval('public.log_number'), p_at, p_request, target, p_actor, p_payload, p_seal, p_mac)
+        RETURNING number INTO n;
+    RETURN n;
+END
+$$;
+--> statement-breakpoint
+REVOKE ALL ON FUNCTION app_change(text, text, text, bigint, text, text, bytea, bytea, bytea) FROM PUBLIC;
+--> statement-breakpoint
+GRANT EXECUTE ON FUNCTION app_change(text, text, text, bigint, text, text, bytea, bytea, bytea) TO coffre_app;
+--> statement-breakpoint
+-- `change_input` as 0023 made it, but for a deleted environment (W218's follow-up on #377): its object's slug is the row's before the tombstone, as every reader takes it, where 0023 required the value's to hold the tombstone, so that the cutover's genesis of a deleted environment, and any change sealing one, would have left a row its object's seal does not cover (`tampered`). A deleted row's slug is never rewritten.
+CREATE OR REPLACE FUNCTION change_input(
+    p_kind text, p_id text, p_request text, p_at bigint, p_actor text, p_payload text, p_value text, p_seal_from bytea, p_seal bytea, p_mac bytea
+) RETURNS bigint
+    LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog, pg_temp AS $$
+DECLARE
+    op jsonb := p_payload::jsonb;
+    v jsonb := p_value::jsonb;
+    change text := op ->> 'op';
+    target uuid := public.log_object(p_kind, p_id);
+    n bigint;
+    done integer;
+    member text;
+    held bytea;
+    newest bytea;
+    config jsonb;
+BEGIN
+    -- Its locks in the order 0.14's writers take theirs, so that none waits on the other in a circle until 0.16 (row,
+    -- head, fence: Migration015.tla's RowFirst, ChangeHeadFirst): the member's queue (MEMBER_QUEUE, 0x636f666d) and row
+    -- first, a principal's own or a credential's (0.14's vault locks them before the head, lockMembers; a change made
+    -- inside a 0.14 decision holds them already), then 0.14's head (its app takes it before its rows), then the fence
+    -- (0.14's appends take it after the head, audit_log_fence). The head held, no 0.14 write lands between this change
+    -- and its entry.
+    member := CASE p_kind
+        WHEN 'principal' THEN p_id
+        WHEN 'credential' THEN coalesce(
+            (SELECT c.principal FROM public.credentials c WHERE c.id = p_id::uuid),
+            (SELECT b.principal FROM public.service_bindings b WHERE b.id = p_id::uuid))
+    END;
+    IF member IS NOT NULL THEN
+        PERFORM pg_advisory_xact_lock(1668245101, hashtext(m.principal)) FROM public.vault_members m WHERE m.principal = member FOR NO KEY UPDATE;
+    END IF;
+    PERFORM 1 FROM public.audit_chain_head WHERE only_row FOR UPDATE;
+    -- ChangeLocks: exclusive, so that it waits for every use in flight, and every use after it waits for its commit.
+    PERFORM pg_advisory_xact_lock(1668244070, 0);
+    SELECT c.number INTO n FROM public.log_changes c WHERE c.request_id = p_request;
+    IF FOUND THEN
+        IF NOT EXISTS (
+            SELECT 1 FROM public.log_changes c
+             WHERE c.request_id = p_request AND c.object = target AND c.payload = p_payload AND c.seal IS NOT DISTINCT FROM p_seal
+        ) THEN
+            RAISE EXCEPTION 'request % names another change', p_request USING ERRCODE = 'unique_violation';
+        END IF;
+        RETURN n;
+    END IF;
+    IF NOT (change = 'genesis'
+        OR (p_kind = 'principal' AND change IN ('member.add', 'member.role', 'member.remove', 'member.restore', 'access.grant', 'access.revoke'))
+        OR (p_kind = 'environment' AND change IN ('environment.protect', 'environment.rename', 'environment.archive'))
+        OR (p_kind = 'roles' AND change = 'role.define')
+        OR (p_kind = 'policy' AND change = 'bulk.limit')) THEN
+        RAISE EXCEPTION 'this schema knows no change % to a %', coalesce(change, 'without an op'), p_kind USING ERRCODE = 'invalid_parameter_value';
+    END IF;
+    -- The payload names its object (`ref`), so that a replay knows what each change is to: the column holds only its
+    -- key. The cutover's genesis may leave it out, its value naming it.
+    IF (change <> 'genesis' OR op ? 'ref') AND (op -> 'ref' ->> 'kind' IS DISTINCT FROM p_kind OR op -> 'ref' ->> 'id' IS DISTINCT FROM p_id) THEN
+        RAISE EXCEPTION 'a change names the object it is to: %, %', p_kind, p_id USING ERRCODE = 'invalid_parameter_value';
+    END IF;
+    -- A value is the object as this function writes it: an environment's, which a genesis may leave out to seal the
+    -- row as it is; the roles' and the policy's, but at their genesis, whose payload holds it. The others' rows are
+    -- written by whoever keeps them, and carry none.
+    IF (CASE
+        WHEN p_kind = 'environment' THEN change <> 'genesis' AND v IS NULL
+        WHEN p_kind IN ('roles', 'policy') THEN (change = 'genesis') = (v IS NOT NULL)
+        ELSE v IS NOT NULL
+    END) THEN
+        RAISE EXCEPTION 'a % change % carries the object it leaves exactly when this function writes it', p_kind, change USING ERRCODE = 'invalid_parameter_value';
+    END IF;
+    -- ChangeChecksSeal: the row's seal is its object's newest change's, or the object has neither yet (one probe, as
+    -- a use makes). A row deleted outright, or a seal no change wrote, is stale too.
+    held := CASE p_kind
+        WHEN 'principal' THEN (SELECT m.seal FROM public.vault_members m WHERE m.principal = p_id)
+        WHEN 'credential' THEN coalesce(
+            (SELECT c.seal FROM public.credentials c WHERE c.id = p_id::uuid),
+            (SELECT b.seal FROM public.service_bindings b WHERE b.id = p_id::uuid))
+        WHEN 'environment' THEN (SELECT e.seal FROM public.environments e WHERE e.id = p_id::uuid)
+        WHEN 'secret' THEN (SELECT x.seal FROM public.secrets x WHERE x.id = p_id::uuid)
+        WHEN 'policy' THEN (SELECT g.seal FROM public.log_config g WHERE g.name = 'policy')
+        WHEN 'roles' THEN (SELECT g.seal FROM public.log_config g WHERE g.name = 'roles')
+    END;
+    newest := (SELECT c.seal FROM public.log_changes c WHERE c.object = target ORDER BY c.number DESC LIMIT 1);
+    IF held IS DISTINCT FROM newest THEN
+        RAISE EXCEPTION 'the % object''s row is not its newest change''s: stale', p_kind USING ERRCODE = 'data_corrupted';
+    END IF;
+    -- ChangeCAS: each write moves the row only from the seal the vault read.
+    CASE p_kind
+        WHEN 'principal' THEN
+            UPDATE public.vault_members SET seal = p_seal WHERE principal = p_id AND seal IS NOT DISTINCT FROM p_seal_from;
+        WHEN 'credential' THEN
+            -- A token's row, or a trust binding's: one kind of object, ids that never meet.
+            UPDATE public.credentials SET seal = p_seal WHERE id = p_id::uuid AND seal IS NOT DISTINCT FROM p_seal_from;
+            GET DIAGNOSTICS done = ROW_COUNT;
+            IF done = 0 THEN
+                UPDATE public.service_bindings SET seal = p_seal WHERE id = p_id::uuid AND seal IS NOT DISTINCT FROM p_seal_from;
+            END IF;
+        WHEN 'environment' THEN
+            IF v IS NULL THEN
+                UPDATE public.environments SET seal = p_seal WHERE id = p_id::uuid AND seal IS NOT DISTINCT FROM p_seal_from;
+            ELSE
+                -- A deleted environment's row keeps its tombstone, `dev~deleted-…` (@coffre/core/schemas's isTombstone),
+                -- and its object the slug before it (objects.ts, environmentObject): an environment deleted stays so,
+                -- its slug is never written again, and none is deleted here; an object's slug holds no tombstone.
+                UPDATE public.environments e
+                   SET slug = CASE WHEN strpos(e.slug, '~') > 0 THEN e.slug ELSE v ->> 'slug' END,
+                       protected = (v ->> 'protected')::boolean,
+                       archived_at = CASE WHEN (v ->> 'archived')::boolean THEN coalesce(e.archived_at, to_timestamp(p_at / 1000.0)) END,
+                       seal = p_seal
+                 WHERE e.id = p_id::uuid AND e.seal IS NOT DISTINCT FROM p_seal_from
+                   AND v ->> 'kind' = 'environment' AND v ->> 'id' = p_id
+                   AND e.project_id = (v ->> 'projectId')::uuid
+                   AND e.parent_id IS NOT DISTINCT FROM (v ->> 'parentId')::uuid
+                   AND e.owner IS NOT DISTINCT FROM v ->> 'owner'
+                   AND (strpos(e.slug, '~') > 0) = (v ->> 'deleted')::boolean
+                   AND strpos(v ->> 'slug', '~') = 0
+                   AND (NOT (v ->> 'deleted')::boolean OR split_part(e.slug, '~', 1) = v ->> 'slug');
+            END IF;
+        WHEN 'secret' THEN
+            UPDATE public.secrets SET seal = p_seal WHERE id = p_id::uuid AND seal IS NOT DISTINCT FROM p_seal_from;
+        WHEN 'policy', 'roles' THEN
+            config := CASE change WHEN 'genesis' THEN op -> 'value' ELSE v END;
+            IF p_id <> 'instance' OR config IS NULL OR jsonb_typeof(config) <> 'object' OR (change = 'genesis' AND p_seal_from IS NOT NULL) THEN
+                RAISE EXCEPTION 'the % object is one, made once from its value and changed from its seal', p_kind USING ERRCODE = 'invalid_parameter_value';
+            END IF;
+            -- Made by its first change (genesis, or the first role defined, the first cap set); moved after from its seal.
+            IF p_seal_from IS NULL THEN
+                INSERT INTO public.log_config (name, value, seal) VALUES (p_kind, config::text, p_seal) ON CONFLICT (name) DO NOTHING;
+            ELSE
+                UPDATE public.log_config SET value = config::text, seal = p_seal WHERE log_config.name = p_kind AND seal = p_seal_from;
+            END IF;
+        ELSE
+            RAISE EXCEPTION 'no object kind %', p_kind USING ERRCODE = 'invalid_parameter_value';
+    END CASE;
+    -- A row gone, a row whose seal is no longer the one read, an environment that is not what the value says it
+    -- stays, or an object made already: nothing was done.
+    GET DIAGNOSTICS done = ROW_COUNT;
+    IF done = 0 THEN RETURN NULL; END IF;
+    INSERT INTO public.log_changes (number, at, request_id, object, actor, payload, seal, mac)
+        VALUES (nextval('public.log_number'), p_at, p_request, target, p_actor, p_payload, p_seal, p_mac)
+        RETURNING number INTO n;
+    RETURN n;
+END
+$$;

package/dist/migrations/postgres/0026_issue_lock.sql

@@ -0,0 +1,106 @@
+-- Sign-ins never hold up a use (T123, R58; docs/design/0.15-plan.md, "Uses never wait on sign-ins"; the spec: formal/HotPathOne.tla's issues, HotPathOneIssue, and formal/Migration015.tla's, Migration015Issue). A sign-in issues a credential: one change of the log, `credential.issue`, which 0025's `app_change` made under the fence exclusive, as every change, while 0022's trigger fenced 0.14's `token.exchange` too. Each sign-in then held every use up for its last round trips, and a burst of them, serialized on 0.14's head, held them up over and over (measured: a fifth of the uses waited, 1,000 a second beside 10 sign-ins at once). Nobody can name a credential before its issue commits (its token is handed out after), and an issue changes no input any other use reads: no use can overlap it, so it needs no fence. It needs only that the checkpointer's barrier wait for it, every number handed out before the barrier being final when it closes. So an issue takes a lock of its own, the issue lock (1668244070, 1), shared, and its number under it; the barrier takes that lock exclusive, then the fence: it waits for the issues in flight without holding the fence, so no use queues behind it meanwhile (Postgres queues a shared request behind a waiting exclusive one). The order, everywhere: a member's row, 0.14's head, the issue lock, the fence. Whatever takes the fence in a transaction that may also issue takes the issue lock shared first (`app_change`, 0.14's trigger): a sign-in that revokes its account's earlier sessions fences first, then issues, and would otherwise hold the fence while it waits for the issue lock, which the barrier holds while it waits for the fence (TLC finds the cycle without). The vault's `change_input` never issues, and takes no issue lock. 0.14's code calls none of the functions; its `token.exchange`, which writes the new credential, the spent token and its binding's last use and no decision input, no longer takes the fence.
+--
+-- `app_change`, as 0025 made it, but for its locks: the issue lock shared, then, but for an issue of a credential its transaction wrote, the fence. The app issues only a row it inserts (`prepare` makes an issue only of no row before); an issue of a row its transaction did not write (one committed before, which a use may name; or a savepoint's) takes the fence too, as before.
+CREATE OR REPLACE FUNCTION app_change(
+    p_kind text, p_id text, p_request text, p_at bigint, p_actor text, p_payload text, p_seal_from bytea, p_seal bytea, p_mac bytea
+) RETURNS bigint
+    LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog, pg_temp AS $$
+DECLARE
+    op jsonb := p_payload::jsonb;
+    change text := op ->> 'op';
+    target uuid := public.log_object(p_kind, p_id);
+    n bigint;
+    done integer;
+    held bytea;
+    -- An issue of a credential this very transaction wrote (its row's xmin is ours: not a savepoint's, nor a row another committed).
+    -- Never null, whatever is missing (a 0.14 row's call carries no payload, so no op): else the fence.
+    fresh boolean := coalesce(change = 'credential.issue' AND p_kind = 'credential'
+        AND EXISTS (SELECT 1 FROM public.credentials c WHERE c.id = p_id::uuid AND c.xmin = pg_current_xact_id()::xid), false);
+BEGIN
+    PERFORM 1 FROM public.audit_chain_head WHERE only_row FOR UPDATE;
+    -- The issue lock shared (IssueOwnLock); and, but for a fresh issue, the fence exclusive after it (IssueBeforeFence).
+    PERFORM pg_advisory_xact_lock_shared(1668244070, 1);
+    IF NOT fresh THEN PERFORM pg_advisory_xact_lock(1668244070, 0); END IF;
+    held := CASE p_kind
+        WHEN 'credential' THEN (SELECT c.seal FROM public.credentials c WHERE c.id = p_id::uuid)
+        WHEN 'secret' THEN (SELECT x.seal FROM public.secrets x WHERE x.id = p_id::uuid)
+        WHEN 'environment' THEN (SELECT e.seal FROM public.environments e WHERE e.id = p_id::uuid)
+    END;
+    IF p_request IS NULL THEN
+        IF held IS NOT NULL OR EXISTS (SELECT 1 FROM public.log_changes c WHERE c.object = target) THEN
+            RAISE EXCEPTION 'the % object''s row is not its newest change''s: stale', p_kind USING ERRCODE = 'data_corrupted';
+        END IF;
+        RETURN 0;
+    END IF;
+    SELECT c.number INTO n FROM public.log_changes c WHERE c.request_id = p_request;
+    IF FOUND THEN
+        IF NOT EXISTS (
+            SELECT 1 FROM public.log_changes c
+             WHERE c.request_id = p_request AND c.object = target AND c.payload = p_payload AND c.seal IS NOT DISTINCT FROM p_seal
+        ) THEN
+            RAISE EXCEPTION 'request % names another change', p_request USING ERRCODE = 'unique_violation';
+        END IF;
+        RETURN n;
+    END IF;
+    IF NOT ((p_kind = 'credential' AND change IN ('credential.issue', 'credential.revoke', 'credential.renew', 'credential.scope'))
+        OR (p_kind = 'secret' AND change IN ('secret.write', 'secret.delete'))
+        OR (p_kind = 'environment' AND change IN ('environment.create', 'environment.rename', 'environment.archive', 'environment.delete'))) THEN
+        RAISE EXCEPTION 'the app makes no change % to a %', coalesce(change, 'without an op'), p_kind USING ERRCODE = 'invalid_parameter_value';
+    END IF;
+    IF op -> 'ref' ->> 'kind' IS DISTINCT FROM p_kind OR op -> 'ref' ->> 'id' IS DISTINCT FROM p_id THEN
+        RAISE EXCEPTION 'a change names the object it is to: %, %', p_kind, p_id USING ERRCODE = 'invalid_parameter_value';
+    END IF;
+    -- ChangeChecksSeal.
+    IF held IS DISTINCT FROM (SELECT c.seal FROM public.log_changes c WHERE c.object = target ORDER BY c.number DESC LIMIT 1) THEN
+        RAISE EXCEPTION 'the % object''s row is not its newest change''s: stale', p_kind USING ERRCODE = 'data_corrupted';
+    END IF;
+    -- ChangeCAS.
+    CASE p_kind
+        WHEN 'credential' THEN
+            UPDATE public.credentials SET seal = p_seal WHERE id = p_id::uuid AND seal IS NOT DISTINCT FROM p_seal_from;
+        WHEN 'secret' THEN
+            UPDATE public.secrets SET seal = p_seal WHERE id = p_id::uuid AND seal IS NOT DISTINCT FROM p_seal_from;
+        WHEN 'environment' THEN
+            UPDATE public.environments SET seal = p_seal WHERE id = p_id::uuid AND seal IS NOT DISTINCT FROM p_seal_from;
+    END CASE;
+    GET DIAGNOSTICS done = ROW_COUNT;
+    IF done = 0 THEN RETURN NULL; END IF;
+    INSERT INTO public.log_changes (number, at, request_id, object, actor, payload, seal, mac)
+        VALUES (nextval('public.log_number'), p_at, p_request, target, p_actor, p_payload, p_seal, p_mac)
+        RETURNING number INTO n;
+    RETURN n;
+END
+$$;
+--> statement-breakpoint
+-- 0.14's trigger (0022, OldWritesFence): the issue lock shared, then the fence, as `app_change` takes them; and `token.exchange`, a sign-in, among the entries it lets by.
+CREATE OR REPLACE FUNCTION log_fence_old_write() RETURNS trigger
+    LANGUAGE plpgsql AS $$
+BEGIN
+    PERFORM pg_catalog.pg_advisory_xact_lock_shared(1668244070, 1);
+    PERFORM pg_catalog.pg_advisory_xact_lock(1668244070, 0);
+    RETURN NULL;
+END
+$$;
+--> statement-breakpoint
+CREATE OR REPLACE TRIGGER audit_log_fence AFTER INSERT ON audit_log FOR EACH ROW
+    WHEN (NEW.decision = 'allow' AND NEW.action NOT IN (
+        'credential.use', 'token.use', 'secret.read', 'secret.use', 'secret.list', 'secret.history', 'secret.version', 'missing.list', 'personal.list',
+        'roles.list', 'roles.preview', 'mcp.read', 'mcp.view', 'audit.read',
+        'sign_in', 'token.exchange', 'device.approve', 'device.deny',
+        'audit.heartbeat', 'audit.checkpoint', 'audit.finding', 'audit.finding_cleared', 'key.check', 'key.intent', 'workload.alert', 'vault.tampered'
+    ))
+    EXECUTE FUNCTION log_fence_old_write();
+--> statement-breakpoint
+-- The barrier (0022): the issue lock exclusive, which waits for every issue in flight and holds no use up, then the fence.
+CREATE OR REPLACE FUNCTION close_one() RETURNS TABLE (upto bigint, at_floor bigint, floor_found bigint)
+    LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog, pg_temp AS $$
+DECLARE
+    found_floor bigint;
+BEGIN
+    PERFORM pg_advisory_xact_lock(1668244070, 1);
+    PERFORM pg_advisory_xact_lock(1668244070, 0);
+    SELECT f.at_floor INTO found_floor FROM public.log_fence f WHERE f.only_row;
+    UPDATE public.log_fence f SET at_floor = greatest(f.at_floor, (extract(epoch FROM clock_timestamp()) * 1000)::bigint - public.deadline_max()) WHERE f.only_row;
+    RETURN QUERY SELECT pg_sequence_last_value('public.log_number'), f.at_floor, found_floor FROM public.log_fence f WHERE f.only_row;
+END
+$$;

package/dist/migrations/postgres/0027_retention.sql

@@ -0,0 +1,118 @@
+-- 0.15's retention (docs/design/0.15-plan.md, PR 7; the spec: formal/Seal.tla's retention, SealRetention.cfg): the checkpointer drops a day of uses once a sealed retention change cuts the uses tree above it, and the uses tree's tiles below the cut, keeping the tile that holds it at each level. Changes are kept for good. It only adds functions, and nothing calls them until 0.15's log is switched on (plan PR 10): 0.14's code serves on it as before.
+--
+-- Each function checks, from the database alone, what it can of the vault's reasons, so that the vault's login, which owns nothing, drops only what a retention change it can see has cut. The signer's checks (the change sealed in its pair, the pair fresh past the cut) are the vault's: the database cannot verify a signature.
+--
+-- The retention change (Seal.tla's RetAppend): an entry of the changes tree, its object log_object('log', 'retention'), naming the cut, the pair at or above the day's last use, by its upto, time and uses tree: {"op":"retention","day":"YYYY-MM-DD","cut":{"upto":"<n>","at":<ms>,"uses":<size>,"root":"<hex>"}}. Numbered under the fence shared, as a use is: it changes no decision input, so no use waits on it. A request ID names one: the same one again answers the number it has.
+CREATE FUNCTION log_retention(p_request text, p_at bigint, p_payload text, p_mac bytea) RETURNS bigint
+    LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog, pg_temp AS $$
+DECLARE
+    op jsonb := p_payload::jsonb;
+    n bigint;
+BEGIN
+    IF op ->> 'op' IS DISTINCT FROM 'retention' OR (op ->> 'day') IS NULL OR (op #>> '{cut,upto}') IS NULL OR (op #>> '{cut,uses}') IS NULL
+       OR (op #>> '{cut,at}') IS NULL OR (op #>> '{cut,root}') IS NULL THEN
+        RAISE EXCEPTION 'not a retention change: %', p_payload USING ERRCODE = 'invalid_parameter_value';
+    END IF;
+    -- Its cut is the first checkpoint at or past the end of its day by its floor of at (every use of the day took its number at or below it), its time and uses head the change's.
+    IF (op #>> '{cut,root}') !~ '^[0-9a-f]{64}$' OR NOT EXISTS (
+        SELECT 1 FROM (
+            SELECT k.upto, k.at, k.uses_size, k.uses_root FROM public.log_checkpoints k
+             WHERE k.at_floor >= ((op ->> 'day')::date + 1 - date '1970-01-01')::bigint * 86400000 ORDER BY k.at_floor, k.upto LIMIT 1
+        ) k
+         WHERE k.upto = (op #>> '{cut,upto}')::bigint AND k.at = (op #>> '{cut,at}')::bigint
+           AND k.uses_size = (op #>> '{cut,uses}')::bigint AND k.uses_root = decode(op #>> '{cut,root}', 'hex')
+    ) THEN
+        RAISE EXCEPTION 'the cut of % is not the first checkpoint past its end', op ->> 'day' USING ERRCODE = 'invalid_parameter_value';
+    END IF;
+    PERFORM pg_advisory_xact_lock_shared(1668244070, 0);
+    SELECT c.number INTO n FROM public.log_changes c WHERE c.request_id = p_request;
+    IF n IS NOT NULL THEN RETURN n; END IF;
+    INSERT INTO public.log_changes (number, at, request_id, object, actor, payload, seal, mac)
+    VALUES (nextval('public.log_number'), p_at, p_request, public.log_object('log', 'retention'), 'system:retention', p_payload, NULL, p_mac)
+    RETURNING number INTO n;
+    RETURN n;
+END
+$$;
+--> statement-breakpoint
+-- The newest cut the database holds as sealed: the newest retention change at or below the newest checkpoint, its uses tree's size and upto. The signer holds it to its own pair before it asks for anything below.
+CREATE FUNCTION log_cut() RETURNS TABLE (upto bigint, uses bigint)
+    LANGUAGE sql STABLE SECURITY DEFINER SET search_path = pg_catalog, pg_temp AS $$
+    SELECT (c.payload::jsonb #>> '{cut,upto}')::bigint, (c.payload::jsonb #>> '{cut,uses}')::bigint
+      FROM public.log_changes c
+     WHERE c.object = public.log_object('log', 'retention') AND c.number <= (SELECT max(k.upto) FROM public.log_checkpoints k)
+     ORDER BY c.number DESC LIMIT 1
+$$;
+--> statement-breakpoint
+-- A day of uses dropped, a step a call, each its own short transaction: 'detached', then 'dropped', then 'gone'. Only a day before yesterday, and only below the newest cut: the first checkpoint whose floor of at is past the day's end, which every use of the day took its number at or below (the floor holds a use's at to it), must be at or below log_cut()'s.
+--
+-- DETACH takes log_uses ACCESS EXCLUSIVE for its own few milliseconds: uses queue behind it meanwhile, and lock_timeout bounds how long it waits for a reader before it gives up and tries again later. (DETACH … CONCURRENTLY cannot run in a function, and the vault's login owns no table; measured, it buys nothing here: docs/design/0.15-plan.md, "As built: PR 7".) The DROP of the detached table locks nothing a use reads; the vault asks for it a run later, never right after the DETACH, whose invalidation every backend's plan of log_uses is still replanning from.
+CREATE FUNCTION drop_day(p_day date) RETURNS text
+    LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog, pg_temp SET lock_timeout = '100ms' AS $$
+DECLARE
+    name text := 'log_uses_' || to_char(p_day, 'YYYYMMDD');
+    hi bigint := (p_day + 1 - date '1970-01-01')::bigint * 86400000;
+    relation regclass := to_regclass('public.' || quote_ident(name));
+    attached boolean;
+BEGIN
+    IF p_day >= (clock_timestamp() AT TIME ZONE 'UTC')::date - 1 THEN RAISE EXCEPTION 'the uses of % are not past', p_day USING ERRCODE = 'invalid_parameter_value'; END IF;
+    IF relation IS NULL THEN RETURN 'gone'; END IF;
+    IF NOT coalesce((SELECT k.upto FROM public.log_checkpoints k WHERE k.at_floor >= hi ORDER BY k.at_floor, k.upto LIMIT 1) <= (SELECT c.upto FROM public.log_cut() c), false) THEN
+        RAISE EXCEPTION 'no sealed retention change cuts the uses of %', p_day USING ERRCODE = 'invalid_parameter_value';
+    END IF;
+    attached := EXISTS (SELECT 1 FROM pg_inherits i WHERE i.inhrelid = relation AND i.inhparent = 'public.log_uses'::regclass);
+    IF attached THEN
+        -- The day as make_day made it, by its bound: a table of that name holding anything else is not dropped.
+        IF pg_get_expr((SELECT c.relpartbound FROM pg_class c WHERE c.oid = relation), relation) IS DISTINCT FROM format('FOR VALUES FROM (%L) TO (%L)', hi - 86400000, hi) THEN
+            RAISE EXCEPTION '% is not the uses of %', name, p_day;
+        END IF;
+        EXECUTE format('ALTER TABLE public.log_uses DETACH PARTITION public.%I', name);
+        RETURN 'detached';
+    END IF;
+    -- Detached: only one this function detached is dropped, a table with log_uses's columns and no parent (make_day's, by name).
+    IF EXISTS (SELECT 1 FROM pg_inherits i WHERE i.inhrelid = relation) OR (SELECT c.relkind FROM pg_class c WHERE c.oid = relation) <> 'r' THEN
+        RAISE EXCEPTION '% is not a detached day of uses', name;
+    END IF;
+    EXECUTE format('DROP TABLE public.%I', name);
+    RETURN 'dropped';
+END
+$$;
+--> statement-breakpoint
+-- The uses tree's tiles below a cut (W212): every tile whose leaves all lie below p_below, the cut's uses size, at most log_cut()'s, at every level; the tile that holds the cut, at each level, stays, and so does every proof of a leaf at or above it and every consistency proof from a size at or above it. The leaf tiles go a range at a time (make_tiles's partitions, those wholly below), detached then dropped, a step a call, the tiles above in one DELETE. Unlike a day's, a range is dropped right after its DETACH: no use's plan reads log_tiles, only the checkpointer's own statements and proofs, so no replan stalls a use. Answers what it did: 'detached <range>', 'dropped <range>', or 'done <rows deleted>'.
+CREATE FUNCTION drop_tiles(p_below bigint) RETURNS text
+    LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog, pg_temp SET lock_timeout = '1s' AS $$
+DECLARE
+    part record;
+    deleted integer;
+BEGIN
+    IF p_below IS NULL OR p_below < 0 OR p_below > coalesce((SELECT c.uses FROM public.log_cut() c), 0) THEN
+        RAISE EXCEPTION 'no sealed retention change cuts the uses tree at %', p_below USING ERRCODE = 'invalid_parameter_value';
+    END IF;
+    -- A detached range first (a call that stopped between the two), then the next attached one wholly below.
+    FOR part IN
+        SELECT c.relname, (regexp_match(pg_get_expr(c.relpartbound, c.oid), '^FOR VALUES FROM \(''?(\d+)''?\) TO \(''?(\d+)''?\)$'))[2]::bigint AS hi, i.inhparent IS NOT NULL AS attached
+          FROM pg_class c LEFT JOIN pg_inherits i ON i.inhrelid = c.oid
+         WHERE c.relnamespace = 'public'::regnamespace AND c.relname ~ '^log_tiles_uses_\d+$' AND c.relkind = 'r'
+         ORDER BY i.inhparent IS NOT NULL, c.relname
+    LOOP
+        IF NOT part.attached THEN
+            -- Detached by this function: no other way leaves one of make_tiles's names without its parent.
+            EXECUTE format('DROP TABLE public.%I', part.relname);
+            RETURN 'dropped ' || part.relname;
+        END IF;
+        IF part.hi IS NOT NULL AND part.hi <= p_below THEN
+            EXECUTE format('ALTER TABLE public.log_tiles_uses_leaves DETACH PARTITION public.%I', part.relname);
+            RETURN 'detached ' || part.relname;
+        END IF;
+    END LOOP;
+    DELETE FROM public.log_tiles_uses_upper t WHERE t.leaf + (256::numeric ^ (t.level + 1)) <= p_below;
+    GET DIAGNOSTICS deleted = ROW_COUNT;
+    RETURN 'done ' || deleted;
+END
+$$;
+--> statement-breakpoint
+-- A day's cut, the first checkpoint whose floor is past its end, by an index: floors only rise with upto (the barrier raises the floor, never lowers it, and the signer refuses a pair whose floor runs back), so the lowest floor past the end, then the lowest upto, is that checkpoint, however many there are.
+CREATE INDEX log_checkpoints_floor_idx ON log_checkpoints USING btree (at_floor, upto);
+--> statement-breakpoint
+REVOKE ALL ON FUNCTION log_retention(text, bigint, text, bytea), log_cut(), drop_day(date), drop_tiles(bigint) FROM PUBLIC;
+--> statement-breakpoint
+GRANT EXECUTE ON FUNCTION log_retention(text, bigint, text, bytea), log_cut(), drop_day(date), drop_tiles(bigint) TO coffre_vault;