@consiliency/agent-board-schema 1.48.0 → 1.51.0

package/tests/seeds/20261001000100_agent_board_claimpolicy_lock_grant_revoke.sql.pre.sql

@@ -0,0 +1,99 @@
+-- Consiliency/message-board#405 — the ADVERSARIAL PRE-STATE for 20261001000100.
+--
+-- WHAT THIS GATES, and why an assertion could not. CPR-22 checks the lock helper's final ACL in the
+-- ordinary fixture — where there is no delegated grant — so it stays GREEN if the migration's
+-- `CASCADE` were removed or its sweep narrowed back to a list of known roles. The migration's
+-- claimed behaviour is about a state the fixture never contains, so the fixture has to contain it.
+--
+-- THE STATE: `service_role` holds EXECUTE **WITH GRANT OPTION** and has granted it onward to
+-- `anon`. That is the adopter shape the migration exists to survive: a plain `REVOKE` defaults to
+-- RESTRICT and fails `dependent privileges exist` against it, which on an adopter database is a
+-- FAILED UPGRADE rather than a tidier ACL. Measured against this bundle: the plain form errors, the
+-- shipped form exits 0 and leaves `{postgres=X/postgres}`.
+--
+-- HOW THE GATE READS. This runs BEFORE 20261001000100 (the runner's tests/seeds/<migration>.pre.sql
+-- hook, #103). Afterwards, either
+--   * the migration swept the chain and CPR-22 reports an empty ACL — the claim holds; or
+--   * the migration RAISED, and the whole bundle replay fails loudly at this migration.
+-- There is no third outcome in which a narrowed sweep passes quietly.
+--
+-- ONLY PRE-EXISTING ROLES ARE USED — no CREATE ROLE. Roles are cluster-global, so a seed that
+-- created them would leak them into a shared cluster and could collide with a concurrent run;
+-- service_role and anon are part of the adopter base this bundle already assumes.
+--
+-- WHAT THIS FIXTURE GATES, precisely — and the second clause is NARROWER than an earlier version of
+-- this paragraph claimed. It gates that the sweep CASCADEs, and that it reaches a grantee OUTSIDE
+-- THE HISTORICAL HAND LIST (public/anon/authenticated/service_role). It does NOT gate that the
+-- sweep is catalog-DERIVED: a migration hard-coded to those four PLUS `authenticator` clears this
+-- fixture and its guard below. A fixture names specific roles by construction, so only a randomly
+-- generated grantee defeats any hand list.
+--
+-- A DISPOSABLE RANDOM GRANTEE WAS CONSIDERED AND REJECTED, checked rather than reasoned about. The
+-- runner has a `.pre.sql` hook and no post hook, so a role created here is never dropped; a seed
+-- that swept `mb_seed405_%` at its start to compensate would be dropping roles belonging to any
+-- CONCURRENT run on the same cluster, and this cluster is shared. Trading a stated gap for
+-- cross-run interference is the worse deal. Derivation itself stays mutation-verified: narrowing
+-- the sweep to known roles was injected and CPR-22 named the survivor.
+--
+-- WHAT IT DOES NOT GATE: that the sweep derives its SIGNATURES. That needs a pre-existing overload,
+-- and a seeded overload PERSISTS — the runner has a `.pre.sql` hook and no post hook, so nothing
+-- drops it, and tests/catalog/p_metadata_parameters.json enumerates every agent_board signature and
+-- would go red. Checked rather than assumed. So a migration narrowed back to the `(uuid)` signature
+-- stays green here; that half is mutation-verified only, and this paragraph is the record of it
+-- rather than a silence someone has to rediscover.
+
+do $$
+begin
+  -- Idempotent: a re-replay onto a database that already carries the chain must not fail here, or
+  -- the seed becomes a worse failure mode than the one it tests for.
+  if not exists (select 1 from pg_roles where rolname = 'service_role')
+     or not exists (select 1 from pg_roles where rolname = 'anon') then
+    raise exception
+      'claimpolicy lock-grant seed: service_role/anon absent — the adopter base this bundle assumes is not present'
+      using errcode = '42704';
+  end if;
+
+  -- A GRANTEE OUTSIDE THE FOUR NAMES THE OLD HAND LIST USED. Without this the fixture gates only
+  -- "CASCADE is present": a migration hard-coded to revoke public/anon/authenticated/service_role
+  -- with CASCADE would sweep the chain below, pass, and still abandon every arbitrary adopter
+  -- grantee — which is the entire reason the sweep was made catalog-derived. `authenticator` is
+  -- outside that list and is part of the Supabase adopter base, so nothing has to be created:
+  -- a role invented here would linger cluster-wide, since a seed has no post hook to drop it.
+  execute 'grant execute on function agent_board._claimgate_lock_board_policy(uuid) to authenticator';
+
+  execute 'grant execute on function agent_board._claimgate_lock_board_policy(uuid) to service_role with grant option';
+end $$;
+
+-- The onward grant must be made BY service_role, so the dependency really exists.
+--
+-- `SET ROLE`, NOT `SET LOCAL ROLE`, and that distinction is the whole gate. The runner applies this
+-- file with `psql -f` in AUTOCOMMIT, so every statement is its own implicit transaction and a
+-- `SET LOCAL` is discarded before the next one runs. The first version used SET LOCAL: the grant was
+-- then made by `postgres`, recorded as `anon=X/postgres` with no dependency on service_role's grant,
+-- and a plain RESTRICT revoke would have swept it happily — a gate that passed whether or not the
+-- migration cascaded. The check below caught exactly that, which is why it is here.
+set role service_role;
+grant execute on function agent_board._claimgate_lock_board_policy(uuid) to anon;
+reset role;
+
+-- Proof the pre-state is what this file claims, checked rather than assumed: if the chain did not
+-- form, the migration would sweep a state no harder than the ordinary one and the gate would be
+-- vacuous — green for the wrong reason, which is the failure mode this whole effort keeps finding.
+do $$
+declare v_acl text;
+begin
+  select coalesce(proacl::text, '<null>') into v_acl
+    from pg_proc where oid = to_regprocedure('agent_board._claimgate_lock_board_policy(uuid)');
+  if v_acl not like '%anon=X/service_role%' then
+    raise exception
+      'claimpolicy lock-grant seed: the delegated grant did not form (acl=%) — refusing to leave a VACUOUS gate that would pass whether or not the migration cascades',
+      v_acl
+      using errcode = '55000';
+  end if;
+  if v_acl not like '%authenticator=%' then
+    raise exception
+      'claimpolicy lock-grant seed: the out-of-list grantee did not take (acl=%) — without it this fixture gates only CASCADE, and a migration narrowed to the four historical role names would pass',
+      v_acl
+      using errcode = '55000';
+  end if;
+end $$;