@consiliency/agent-board-schema 1.64.0 → 1.74.0

package/tests/fixtures/agent_board_667_apply_rls_guard.sql

@@ -0,0 +1,195 @@
+-- Requires the reviewed conversion and timestamp helpers in this transaction.
+-- This admits one exact apply_rls OID; it is not a Realtime exemption. The
+-- prepared target is named by regclass output, which is unqualified whenever
+-- the relation is visible, and PostgreSQL re-parses a prepared statement when
+-- the active search path changes (for example "$user" or USAGE under the
+-- subscriber role). Every relation sharing a relname with a possible target is
+-- therefore in the closure, independent of any session search path.
+\ir agent_board_667_apply_rls_reference.sql
+create temp table xb_ar_rel(rel oid primary key,origin text not null) on commit drop;
+create temp table xb_ar_fn(fn oid primary key,origin text not null) on commit drop;
+create temp table xb_ar_parse(fn oid primary key,tree text,problem text) on commit drop;
+create function pg_temp.xb_ar_wrapper() returns oid
+language sql volatile set search_path=pg_catalog as $$
+  select to_regprocedure(identity)::oid from pg_temp.xb_ar_reference
+    where kind='wrapper' and identity='realtime.apply_rls(jsonb,integer)'
+$$;
+create function pg_temp.xb_ar_meta(p_fn oid) returns jsonb
+language sql volatile set search_path=pg_catalog as $$
+  select case when prokind='a' then pg_temp.xb_st_aggregate(oid) else pg_temp.xb_cf_meta(oid) end from pg_proc where oid=p_fn
+$$;
+create function pg_temp.xb_ar_prerequisite_problems() returns table(identity text,problem text)
+language sql volatile set search_path=pg_catalog as $$
+  select identity,problem from pg_temp.xb_cf_problems()
+  union all select identity,problem from pg_temp.xb_cf_wrapper_problems()
+  union all select r.identity,'apply_rls declaration or security drift' from pg_temp.xb_ar_reference r
+    where r.kind in('wrapper','constructor') and r.payload is distinct from pg_temp.xb_cf_meta(to_regprocedure(r.identity))
+  union all select 'realtime.apply_rls(jsonb,integer)','apply_rls source coverage drift'
+    where (select md5(prosrc) from pg_proc where oid=pg_temp.xb_ar_wrapper())
+      is distinct from (select payload->>'prosrc_md5' from pg_temp.xb_ar_reference where kind='coverage')
+$$;
+-- Executable and relation edges stored in a parser tree. pg_depend omits pinned
+-- built-ins, so the stored OIDs are read as well as the dependency rows.
+create function pg_temp.xb_ar_tree_fns(p_tree text) returns table(fn oid)
+language sql volatile set search_path=pg_catalog as $$
+  select distinct m[2]::oid from regexp_matches(coalesce(p_tree,''),
+    ':(funcid|aggfnoid|winfnoid|opfuncid|elemfuncid|hashfuncid|negfuncid) ([0-9]+)','g') m where m[2]::oid<>0
+$$;
+create function pg_temp.xb_ar_tree_rels(p_tree text) returns table(rel oid)
+language sql volatile set search_path=pg_catalog as $$
+  select distinct m[1]::oid from regexp_matches(coalesce(p_tree,''),':relid ([0-9]+)','g') m where m[1]::oid<>0
+$$;
+-- A SQL body is parsed by recreating it as a temporary SQL-standard body under
+-- the function's own pinned search_path, so the catalog stores its parse tree.
+create function pg_temp.xb_ar_parse_sql(p_fn oid) returns void
+language plpgsql volatile as $$
+declare f record; body text; path text; nm text := 'xb_ar_parsed_'||p_fn; prior text := current_setting('search_path');
+begin
+  delete from pg_temp.xb_ar_parse where fn=p_fn;
+  select p.*,l.lanname into f from pg_proc p join pg_language l on l.oid=p.prolang where p.oid=p_fn;
+  -- Built-in entry points are admitted only as individually reviewed leaves.
+  if f.lanname in('internal','c') then return; end if;
+  if f.lanname<>'sql' then
+    insert into pg_temp.xb_ar_parse values(p_fn,null,'helper language '||f.lanname);return;
+  end if;
+  if f.prosqlbody is not null then
+    insert into pg_temp.xb_ar_parse values(p_fn,f.prosqlbody::text,null);return;
+  end if;
+  select substr(c,13) into path from unnest(f.proconfig) c where c like 'search_path=%';
+  execute format('drop function if exists pg_temp.%I(%s)',nm,pg_get_function_identity_arguments(p_fn));
+  body := regexp_replace(f.prosrc,'[[:space:];]+$','');
+  begin
+    if path is not null then perform set_config('search_path',path,true); end if;
+    execute format('create function pg_temp.%I(%s) returns %s language sql begin atomic %s; end',
+      nm,pg_get_function_arguments(p_fn),pg_get_function_result(p_fn),body);
+    perform set_config('search_path',prior,true);
+    insert into pg_temp.xb_ar_parse select p_fn,p.prosqlbody::text,null from pg_proc p
+      where p.proname=nm and p.pronamespace=pg_my_temp_schema();
+  exception when others then
+    perform set_config('search_path',prior,true);
+    insert into pg_temp.xb_ar_parse values(p_fn,null,'unparsed SQL body '||sqlstate);
+  end;
+end $$;
+create function pg_temp.xb_ar_unpinned_path(p_fn oid) returns boolean
+language sql volatile set search_path=pg_catalog as $$
+  select not exists(select 1 from pg_proc p cross join unnest(p.proconfig) c where p.oid=p_fn and c like 'search_path=%')
+$$;
+-- Reviewed leaves are not expanded further than their support and dependency
+-- edges; their complete declarations are pinned. Everything else is parsed.
+create function pg_temp.xb_ar_leaf(p_fn oid) returns boolean
+language sql volatile set search_path=pg_catalog as $$
+  select exists(select 1 from pg_temp.xb_cf_primitives where fn=p_fn)
+    or exists(select 1 from pg_temp.xb_ar_reference where kind in('primitive','aggregate') and to_regprocedure(identity)=p_fn)
+    or exists(select 1 from pg_temp.xb_cf_wrappers where to_regprocedure(identity)=p_fn)
+$$;
+create function pg_temp.xb_ar_compute() returns void
+language plpgsql volatile as $$
+declare before bigint; after bigint; f oid; wrapper oid := pg_temp.xb_ar_wrapper();
+begin
+  truncate pg_temp.xb_ar_rel,pg_temp.xb_ar_fn,pg_temp.xb_ar_parse;
+  if wrapper is null then return; end if;
+  -- Static reads of apply_rls, by dependency and by every FROM/JOIN name.
+  insert into pg_temp.xb_ar_rel select d.oid,'static apply_rls relation'
+    from extensions.plpgsql_show_dependency_tb(wrapper::regprocedure,0::oid) d where d.type='RELATION' on conflict do nothing;
+  insert into pg_temp.xb_ar_rel select c.oid,'same name as a static read' from pg_class c
+    where c.relname in(select (regexp_match(m[1],'([a-z_][a-z_0-9]*)$'))[1] from pg_proc p
+      cross join lateral regexp_matches(p.prosrc,'\m(?:from|join)\s+([a-z_][a-z_0-9.]*)','gi') m where p.oid=wrapper)
+    on conflict do nothing;
+  -- Only a row-security target reaches PREPARE/EXECUTE. Any same-named relation
+  -- can be the resolved target after a search-path change under another role.
+  insert into pg_temp.xb_ar_rel select c.oid,'row-security target or same-name resolution' from pg_class c
+    where c.relname in(select relname from pg_class where relrowsecurity and relkind in('r','p')) on conflict do nothing;
+  insert into pg_temp.xb_ar_fn select d.oid,'static apply_rls callable'
+    from extensions.plpgsql_show_dependency_tb(wrapper::regprocedure,0::oid) d where d.type='FUNCTION' on conflict do nothing;
+  insert into pg_temp.xb_ar_fn select p.oid,'static apply_rls name '||m[1] from pg_proc target
+    cross join lateral regexp_matches(target.prosrc,'([a-z_][a-z_0-9]*)\s*\(','g') m join pg_proc p on p.proname=m[1]
+    where target.oid=wrapper on conflict do nothing;
+  -- Grammar forms that call a function without its name before a parenthesis.
+  insert into pg_temp.xb_ar_fn select p.oid,'static apply_rls syntax '||(r.payload->>'syntax')
+    from pg_temp.xb_ar_reference r join pg_proc p on p.proname=r.identity
+    where r.kind='syntax' and position(r.payload->>'syntax' in (select lower(prosrc) from pg_proc where oid=wrapper))>0
+    on conflict do nothing;
+  insert into pg_temp.xb_ar_fn select to_regprocedure(identity),'constructor' from pg_temp.xb_ar_reference
+    where kind='constructor' on conflict do nothing;
+  loop
+    select (select count(*) from pg_temp.xb_ar_rel)+(select count(*) from pg_temp.xb_ar_fn) into before;
+    insert into pg_temp.xb_ar_rel select i.inhrelid,'inheritance child of '||r.rel::regclass
+      from pg_temp.xb_ar_rel r join pg_inherits i on i.inhparent=r.rel on conflict do nothing;
+    -- Every policy and rule on a closure relation, whatever its command.
+    insert into pg_temp.xb_ar_fn select x.fn,'policy '||p.polname||' on '||p.polrelid::regclass
+      from pg_policy p join pg_temp.xb_ar_rel r on r.rel=p.polrelid
+      cross join lateral (select fn from pg_temp.xb_ar_tree_fns(p.polqual::text||' '||coalesce(p.polwithcheck::text,''))
+        union select refobjid from pg_depend where classid='pg_policy'::regclass and objid=p.oid and refclassid='pg_proc'::regclass) x
+      on conflict do nothing;
+    insert into pg_temp.xb_ar_rel select x.rel,'policy '||p.polname||' on '||p.polrelid::regclass
+      from pg_policy p join pg_temp.xb_ar_rel r on r.rel=p.polrelid
+      cross join lateral (select rel from pg_temp.xb_ar_tree_rels(p.polqual::text||' '||coalesce(p.polwithcheck::text,''))
+        union select refobjid from pg_depend where classid='pg_policy'::regclass and objid=p.oid and refclassid='pg_class'::regclass) x
+      on conflict do nothing;
+    insert into pg_temp.xb_ar_fn select x.fn,'rule '||w.rulename||' on '||w.ev_class::regclass
+      from pg_rewrite w join pg_temp.xb_ar_rel r on r.rel=w.ev_class
+      cross join lateral (select fn from pg_temp.xb_ar_tree_fns(w.ev_action::text||' '||coalesce(w.ev_qual::text,''))
+        union select refobjid from pg_depend where classid='pg_rewrite'::regclass and objid=w.oid and refclassid='pg_proc'::regclass) x
+      on conflict do nothing;
+    insert into pg_temp.xb_ar_rel select x.rel,'rule '||w.rulename||' on '||w.ev_class::regclass
+      from pg_rewrite w join pg_temp.xb_ar_rel r on r.rel=w.ev_class
+      cross join lateral (select rel from pg_temp.xb_ar_tree_rels(w.ev_action::text||' '||coalesce(w.ev_qual::text,''))
+        union select refobjid from pg_depend where classid='pg_rewrite'::regclass and objid=w.oid and refclassid='pg_class'::regclass) x
+      where x.rel<>w.ev_class on conflict do nothing;
+    insert into pg_temp.xb_ar_fn select e.target,'support or dependency of '||pg_temp.xb_cf_fn(e.source) from (
+      select p.oid source,p.prosupport::oid target from pg_proc p join pg_temp.xb_ar_fn a on a.fn=p.oid where p.prosupport<>0
+      union select d.objid,d.refobjid from pg_depend d join pg_temp.xb_ar_fn a on a.fn=d.objid
+        where d.classid='pg_proc'::regclass and d.refclassid='pg_proc'::regclass
+      union select s.aggregate,s.fn from pg_temp.xb_st_aggregate_slots() s join pg_temp.xb_ar_fn a on a.fn=s.aggregate) e
+      on conflict do nothing;
+    for f in select a.fn from pg_temp.xb_ar_fn a where not pg_temp.xb_ar_leaf(a.fn)
+      and not exists(select 1 from pg_temp.xb_ar_parse p where p.fn=a.fn) loop
+      perform pg_temp.xb_ar_parse_sql(f);
+    end loop;
+    insert into pg_temp.xb_ar_fn select x.fn,'body of '||pg_temp.xb_cf_fn(p.fn) from pg_temp.xb_ar_parse p
+      cross join lateral pg_temp.xb_ar_tree_fns(p.tree) x on conflict do nothing;
+    insert into pg_temp.xb_ar_rel select x.rel,'body of '||pg_temp.xb_cf_fn(p.fn) from pg_temp.xb_ar_parse p
+      cross join lateral pg_temp.xb_ar_tree_rels(p.tree) x on conflict do nothing;
+    -- A body without a pinned search_path resolves names at run time.
+    insert into pg_temp.xb_ar_fn select o.oid,'same name as a run-time resolved call in '||pg_temp.xb_cf_fn(p.fn)
+      from pg_temp.xb_ar_parse p cross join lateral pg_temp.xb_ar_tree_fns(p.tree) x
+      join pg_proc c on c.oid=x.fn join pg_proc o on o.proname=c.proname
+      where pg_temp.xb_ar_unpinned_path(p.fn) on conflict do nothing;
+    insert into pg_temp.xb_ar_rel select o.oid,'same name as a run-time resolved read in '||pg_temp.xb_cf_fn(p.fn)
+      from pg_temp.xb_ar_parse p cross join lateral pg_temp.xb_ar_tree_rels(p.tree) x
+      join pg_class c on c.oid=x.rel join pg_class o on o.relname=c.relname
+      where pg_temp.xb_ar_unpinned_path(p.fn) on conflict do nothing;
+    select (select count(*) from pg_temp.xb_ar_rel)+(select count(*) from pg_temp.xb_ar_fn) into after;
+    exit when after=before;
+  end loop;
+end $$;
+create function pg_temp.xb_ar_problems() returns table(identity text,problem text)
+language plpgsql volatile as $$
+begin
+  return query select p.identity,p.problem from pg_temp.xb_ar_prerequisite_problems() p;
+  if pg_temp.xb_ar_wrapper() is null then
+    return query select 'realtime.apply_rls(jsonb,integer)'::text,'native apply_rls absent'::text;return;
+  end if;
+  perform pg_temp.xb_ar_compute();
+  -- Built-ins must be reviewed leaves with exact declarations. A SQL body is
+  -- instead admitted by its own parsed structure below, not by a frozen hash.
+  return query select pg_temp.xb_cf_fn(a.fn),'unreviewed apply_rls executable'::text from pg_temp.xb_ar_fn a
+    where not exists(select 1 from pg_temp.xb_cf_primitives c where c.fn=a.fn and c.metadata=pg_temp.xb_cf_meta(a.fn))
+      and not exists(select 1 from pg_temp.xb_cf_wrappers w where to_regprocedure(w.identity)=a.fn and w.metadata=pg_temp.xb_cf_meta(a.fn))
+      and not exists(select 1 from pg_temp.xb_ar_reference r where r.kind in('primitive','aggregate','constructor')
+        and to_regprocedure(r.identity)=a.fn and r.payload=pg_temp.xb_ar_meta(a.fn))
+      and not exists(select 1 from pg_temp.xb_ar_parse p where p.fn=a.fn and p.tree is not null and p.problem is null);
+  -- Every Query node of a parsed body, including CTEs, sublinks and CALL, must
+  -- be a SELECT. Its calls are in the closure above, so a writer anywhere below
+  -- names itself.
+  return query select pg_temp.xb_cf_fn(p.fn),coalesce(p.problem,'apply_rls helper is not SELECT-only') from pg_temp.xb_ar_parse p
+    where p.problem is not null or p.tree is null
+      or exists(select 1 from regexp_matches(p.tree,':commandType ([0-9]+)','g') m where m[1]<>'1');
+  return query select r.rel::regclass::text,'unreviewed apply_rls relation kind '||c.relkind::text from pg_temp.xb_ar_rel r
+    join pg_class c on c.oid=r.rel where c.relkind not in('r','p','v');
+end $$;
+create function pg_temp.xb_ar_admitted() returns table(fn oid)
+language sql volatile set search_path=pg_catalog as $$
+  select pg_temp.xb_ar_wrapper() where pg_temp.xb_ar_wrapper() is not null
+    and not exists(select 1 from pg_temp.xb_ar_problems())
+$$;

package/tests/fixtures/agent_board_667_apply_rls_provenance.md

@@ -0,0 +1,125 @@
+# Finite apply_rls effect disposition
+
+This proof covers only `realtime.apply_rls(jsonb,integer)`. It is separate from
+the conversion, sender and Storage reader proofs, which it composes. A missing
+native function gives no native behavior or effect credit.
+
+The reference input is the retained full Supabase CI catalog for `267dfa1d`,
+SHA-256 `2c4598bd8b03474d54dc2221e17a83c6a47e1c14b48bd4fe2946e51d08a8160f`.
+The captured `apply_rls` declaration has MD5 `d7b17bcce71440ab486770b53d15bd3d`
+and is `SECURITY INVOKER` with no `SET` clause; `PUBLIC` holds `EXECUTE`. An
+owned PostgreSQL 17.11.0.004 reconstruction reproduced that declaration, both SQL
+constructors and every reached built-in declaration byte-for-byte. Declaration
+equality is not C binary attestation.
+
+## Execution sites and the prepared target
+
+The body has two `EXECUTE` sites. `build_prepared_statement_sql` constructs
+`PREPARE walrus_rls_stmt AS SELECT EXISTS(SELECT 1 FROM <entity> WHERE <col>=<lit> ...)`,
+with `quote_ident` columns and `quote_nullable` values; the second site executes
+that statement after `set_config('role', <subscriber role>, true)` and
+`set_config('request.jwt.claims', ...)`. Both sites are reached only when the
+entity has row security and the action is not `DELETE`; conversion and filter
+helpers run for every entity. The behavior test observes both boundaries.
+The comparison operator, literal input, casts and operator-family support stay
+inside the existing conversion registry, which pins every registered dispatch.
+
+`<entity>` is `regclass` output, which is unqualified whenever the relation is
+visible on the caller's search path. PostgreSQL re-parses a prepared statement
+when the active search path changes between uses, and under the subscriber role
+both `"$user"` expansion and schema `USAGE` change it. This was established by
+experiment before relying on any target set, in an owned database with the exact
+native routines:
+
+- a schema named after the subscriber role holding a same-named view whose
+  qualifier calls a writer: the writer ran (`"$user"` redirection);
+- a first-path schema the subscriber cannot use, with a same-named view later in
+  the path: the writer ran (`USAGE` redirection);
+- the same entity with a schema-qualified `regclass` text: no write.
+
+The native behavior test repeats the first case and its qualified control. So a
+row-security target set alone is not a closure. The guard adds every relation in
+any schema whose relname equals that of a row-security relation, which bounds
+every resolution independent of search path, role or schema privileges.
+
+## Closure
+
+Relations, to a fixed point: row-security targets and every same-named relation;
+`apply_rls` static reads by `plpgsql_check` dependency and by every `FROM`/`JOIN`
+name in the exact body, with their same-named relations; inheritance and partition
+children; every relation referenced by a policy or rule; and every relation read
+by a parsed SQL body, with its same-named relations when that body has no pinned
+`search_path`. Only ordinary and partitioned tables and views are admitted kinds.
+
+Executables: every routine named before a parenthesis in the exact `apply_rls`
+body (all overloads, including aggregates), the two grammar forms that call a
+function without that spelling (`trim(` and `AT TIME ZONE`), `plpgsql_check`
+dependencies and both constructors; every policy, whatever its command, and every
+rule on a closure relation, by `pg_depend` and by stored parser-tree OIDs; support,
+dependency and aggregate-callback edges; and every SQL body reached.
+
+A SQL body is parsed by recreating it as a temporary SQL-standard body under its
+own pinned `search_path`, so PostgreSQL stores its parse tree. It is admitted only
+if every `Query` node, including CTEs, sublinks and `CALL`, is a `SELECT`, and its
+callees are themselves in the closure. A body without a pinned `search_path`
+resolves names at run time, so every same-named routine and relation is added. SQL
+bodies are admitted by this live structure rather than a frozen hash, so editing a
+policy helper re-runs the proof instead of failing on drift. A body that does not
+parse, or a helper in another procedural language, fails closed.
+
+Built-ins are admitted only as reviewed leaves with exact declarations: the
+existing conversion primitives, or this reference. The comparison dispatch helpers
+`cast` and `check_equality_op` keep their existing conversion admission.
+
+The over-approximations are deliberate. All policy commands and all rules are
+included although a `SELECT` evaluates only `SELECT`/`ALL` policies and `ON SELECT`
+rules, and the name scan reads comments, so a comment word before a parenthesis
+adds `auth.role()`.
+
+## Reviewed built-in leaves
+
+The reference holds the wrapper, source coverage, the two grammar forms, the two
+pinned constructors, 106 primitive declarations and 16 aggregate dispatch records.
+Four primitive declarations are inherited unchanged from the search, delimiter and
+timestamp references. The generator binds every other one to its exact identity,
+`internal` language and REL_17_11 entry point; it refuses catalog membership,
+namespace or language as authority. The one SQL built-in,
+`quote_nullable(anyelement)`, is bound to its exact body, which casts to `text`
+through the argument type output and calls `quote_nullable(text)`.
+
+All 105 internal entry points were located in the REL_17_11 sources (`acl.c`,
+`guc_funcs.c`, `prepare.c`, `varlena.c`, `quote.c`, `oracle_compat.c`, `varbit.c`,
+`varchar.c`, `formatting.c`, `timestamp.c`, `date.c`, `numeric.c`, `int8.c`,
+`array_userfuncs.c`, `arrayfuncs.c`, `jsonb.c`, `jsonfuncs.c`, `tsvector_op.c`,
+`multirangetypes.c`). None of their bodies calls SPI, `table_open` or a heap,
+catalog, index or executor write entry point. The families are: GUC read/write (3),
+catalog privilege lookup (12), the session prepared-statement hash (1), text
+quoting, trimming, length and array rendering (10), datetime/numeric formatting and
+time-zone arithmetic (17), set-returning expansion and its planner estimate (5),
+jsonb construction (2) and aggregate entry and in-memory state functions (67).
+Transitive C callees were not traced exhaustively. Dispatch through type I/O and
+casts is bounded by the conversion registry. The `role` assign hook
+(`variable.c`) checks `SET` membership against the session user; the behavior test
+shows an unsettable subscriber role is refused with `42501`. `request.jwt.claims`
+is not registered by any loaded library in the observed environment, but no
+assertion pins that.
+
+## Recorded native behavior, not endorsed
+
+After a successful call the role is reset to the session default rather than
+restored to the entry role. The last subscriber's claims remain set for the rest
+of the transaction, and `walrus_rls_stmt` remains a session resource. The behavior
+test records all three. They change session state only; no closure routine writes
+a relation, and the agent_board history relations are unchanged by the native
+calls.
+
+## Limits
+
+The guard is a catalog proof at test time. An object created later, including a
+temporary relation in a caller's own session, is outside it until the next run;
+session-local objects are the caller's own static capability. Nothing here attests
+deployed binaries, extension hooks or arbitrary privileged SQL.
+
+The manual generator accepts the retained native catalog and an owned closure
+observation, writes only with explicit `--output`, and otherwise checks the
+checked-in reference. There is no live production query or automatic refresh.