@consiliency/agent-board-schema 1.35.0 → 1.38.0

package/tests/fixtures/isolation-substrate.sql

@@ -1,7 +1,7 @@
 -- Minimal Supabase substrate for the two-session ISOLATION harness only.
 --
 -- The pgTAP runner applies the agent_board bundle onto the DB that `supabase
--- start` provisions (54322/postgres), which already carries GoTrue's `auth`
+-- start` provisions (24322/postgres), which already carries GoTrue's `auth`
 -- schema, the `extensions` schema, pgcrypto, and the base roles. The isolation
 -- harness instead builds a THROWAWAY template database (specs COMMIT across
 -- sessions and cannot share the live DB), so it must self-provision the same

package/tests/fixtures/test-prereqs.sql

@@ -470,6 +470,7 @@ declare
   v_def  text;
   v_src  text;
   v_at   int;
+  v_hits int;
 begin
   select pg_get_functiondef(p.oid),
          coalesce(nullif(p.prosrc, ''), pg_catalog.pg_get_function_sqlbody(p.oid))
@@ -488,6 +489,27 @@ begin
     raise exception
       'agent_board_test.stripped_def: body not found verbatim inside pg_get_functiondef for oid % -- refusing to guess', p_fn;
   end if;
+  -- AMBIGUITY (message-board#304). `position()` returns the FIRST match, and
+  -- pg_get_functiondef emits AUTHOR-CONTROLLED text -- the function name, every
+  -- argument name, the SET clauses -- BEFORE the body. When a short body also
+  -- occurs in that header, the splice lands on the HEADER occurrence: the header
+  -- is corrupted and the real body is returned UNSTRIPPED, so a positive or
+  -- negative assertion over the result reads text that was never stripped. Not
+  -- hypothetical: a `mint_harden` assertion was already defeated once by an
+  -- argument named `p_raw_key_fingerprint` (the #196 lint's rule 3), so header
+  -- text is a live surface. The BEGIN ATOMIC arm above makes this MORE likely,
+  -- not less: a deparsed body is short and normalized (`RETURN (p + 1)`).
+  --
+  -- Anchoring on the last occurrence instead would still be a GUESS about which
+  -- match is the body. The `v_at = 0` arm already refuses to guess when the body
+  -- is not found; ambiguity gets the same answer, matching strip_sql's
+  -- fail-closed behaviour on an unterminated construct. `replace` counts
+  -- non-overlapping occurrences, which is the count that matters for a splice.
+  v_hits := (length(v_def) - length(replace(v_def, v_src, ''))) / length(v_src);
+  if v_hits > 1 then
+    raise exception
+      'agent_board_test.stripped_def: body occurs % times inside pg_get_functiondef for oid % — ambiguous splice, refusing to guess which occurrence is the body (a match in the author-controlled header would corrupt it and return the body unstripped)', v_hits, p_fn;
+  end if;
   return substr(v_def, 1, v_at - 1)
       || agent_board_test.strip_sql(v_src, p_keep_literals)
       || substr(v_def, v_at + length(v_src));