@consiliency/agent-board-schema 1.64.0 → 1.74.0

package/tests/fixtures/agent_board_667_conversion_guard.sql

@@ -0,0 +1,162 @@
+-- Test-only conversion dispatch proof. Reference data is generated from the
+-- captured catalog and PostgreSQL 17.11; it is not a namespace exemption.
+-- All helpers read catalogs. None invokes a captured application routine.
+create or replace function pg_temp.xb_cf_type(p_oid oid) returns text
+language sql volatile set search_path=pg_catalog as $$
+  select format('%I.%I',n.nspname,t.typname) from pg_type t
+  join pg_namespace n on n.oid=t.typnamespace where t.oid=p_oid
+$$;
+create or replace function pg_temp.xb_cf_fn(p_oid oid) returns text
+language sql volatile set search_path=pg_catalog as $$
+  select format('%I.%I(%s)',n.nspname,p.proname,replace(oidvectortypes(p.proargtypes),', ',','))
+  from pg_proc p join pg_namespace n on n.oid=p.pronamespace where p.oid=p_oid
+$$;
+create or replace function pg_temp.xb_cf_named(p_oid oid,p_catalog text) returns text
+language plpgsql volatile set search_path=pg_catalog as $$
+begin
+  if p_oid=0 then return null; end if;
+  if p_catalog='family' then return (select format('%I.%I/%s',n.nspname,f.opfname,a.amname)
+    from pg_opfamily f join pg_namespace n on n.oid=f.opfnamespace join pg_am a on a.oid=f.opfmethod where f.oid=p_oid);
+  elsif p_catalog='class' then return (select format('%I.%I/%s',n.nspname,c.opcname,a.amname)
+    from pg_opclass c join pg_namespace n on n.oid=c.opcnamespace join pg_am a on a.oid=c.opcmethod where c.oid=p_oid);
+  elsif p_catalog='operator' then return (select format('%I.%s(%s,%s)',n.nspname,o.oprname,
+    pg_temp.xb_cf_type(o.oprleft),pg_temp.xb_cf_type(o.oprright)) from pg_operator o join pg_namespace n on n.oid=o.oprnamespace where o.oid=p_oid);
+  elsif p_catalog='parser' then return (select format('%I.%I',n.nspname,p.prsname) from pg_ts_parser p join pg_namespace n on n.oid=p.prsnamespace where p.oid=p_oid);
+  elsif p_catalog='template' then return (select format('%I.%I',n.nspname,t.tmplname) from pg_ts_template t join pg_namespace n on n.oid=t.tmplnamespace where t.oid=p_oid);
+  elsif p_catalog='dictionary' then return (select format('%I.%I',n.nspname,d.dictname) from pg_ts_dict d join pg_namespace n on n.oid=d.dictnamespace where d.oid=p_oid);
+  elsif p_catalog='configuration' then return (select format('%I.%I',n.nspname,c.cfgname) from pg_ts_config c join pg_namespace n on n.oid=c.cfgnamespace where c.oid=p_oid);
+  elsif p_catalog='collation' then return (select format('%I.%I',n.nspname,c.collname) from pg_collation c join pg_namespace n on n.oid=c.collnamespace where c.oid=p_oid);
+  end if;
+  raise exception 'unclassified conversion catalog %',p_catalog;
+end$$;
+create or replace function pg_temp.xb_cf_meta(p_oid oid) returns jsonb
+language sql volatile set search_path=pg_catalog as $$
+  select jsonb_build_object('definition_md5',case when p.prokind<>'a' then md5(pg_get_functiondef(p.oid)) end,
+    'owner',pg_get_userbyid(p.proowner),
+    'acl',(select jsonb_agg(a::text order by a::text collate "C") from unnest(p.proacl) a),'kind',p.prokind)
+  from pg_proc p where p.oid=p_oid
+$$;
+
+-- Every registered conversion, operator and subsidiary callback is discovered
+-- here, including callbacks hidden behind a built-in type input function.
+create or replace function pg_temp.xb_cf_slots() returns table(origin text,fn oid)
+language sql volatile set search_path=pg_catalog as $$
+  select 'type '||pg_temp.xb_cf_type(t.oid)||' '||v.slot,v.fn from pg_type t
+    cross join lateral(values ('typinput',t.typinput::oid),('typoutput',t.typoutput::oid),
+      ('typreceive',t.typreceive::oid),('typsend',t.typsend::oid),('typmodin',t.typmodin::oid),
+      ('typmodout',t.typmodout::oid),('typanalyze',t.typanalyze::oid),('typsubscript',t.typsubscript::oid)) v(slot,fn) where v.fn<>0
+  union all select 'operator '||pg_temp.xb_cf_named(o.oid,'operator')||' '||v.slot,v.fn from pg_operator o
+    cross join lateral(values ('implementation',o.oprcode::oid),('restriction',o.oprrest::oid),('join',o.oprjoin::oid)) v(slot,fn) where v.fn<>0
+  union all select 'cast '||pg_temp.xb_cf_type(c.castsource)||' -> '||pg_temp.xb_cf_type(c.casttarget),c.castfunc from pg_cast c where c.castfunc<>0
+  union all select 'range '||pg_temp.xb_cf_type(r.rngtypid)||' '||v.slot,v.fn from pg_range r
+    cross join lateral(values ('canonical',r.rngcanonical::oid),('subdiff',r.rngsubdiff::oid)) v(slot,fn) where v.fn<>0
+  union all select 'family '||pg_temp.xb_cf_named(p.amprocfamily,'family')||' support '||p.amprocnum,p.amproc::oid from pg_amproc p
+  union all select 'parser '||pg_temp.xb_cf_named(p.oid,'parser')||' '||v.slot,v.fn from pg_ts_parser p
+    cross join lateral(values ('start',p.prsstart::oid),('token',p.prstoken::oid),('end',p.prsend::oid),
+      ('headline',p.prsheadline::oid),('lextype',p.prslextype::oid)) v(slot,fn) where v.fn<>0
+  union all select 'template '||pg_temp.xb_cf_named(t.oid,'template')||' '||v.slot,v.fn from pg_ts_template t
+    cross join lateral(values ('init',t.tmplinit::oid),('lexize',t.tmpllexize::oid)) v(slot,fn) where v.fn<>0
+  union all select 'transform '||pg_temp.xb_cf_type(t.trftype)||' '||v.slot,v.fn from pg_transform t
+    cross join lateral(values ('from_sql',t.trffromsql::oid),('to_sql',t.trftosql::oid)) v(slot,fn) where v.fn<>0
+  union all select 'language '||l.lanname||' '||v.slot,v.fn from pg_language l
+    cross join lateral(values ('handler',l.lanplcallfoid::oid),('inline',l.laninline::oid),('validator',l.lanvalidator::oid)) v(slot,fn) where v.fn<>0
+  union all select 'access method '||a.amname,a.amhandler::oid from pg_am a
+$$;
+
+-- Independently derive the pointer-column class from pg_attribute. A new type
+-- callback column, or an accidentally omitted discovery arm above, names itself.
+create or replace function pg_temp.xb_cf_type_coverage() returns table(identity text)
+language plpgsql volatile set search_path=pg_catalog as $$
+declare a record; discovered jsonb;
+begin
+  select jsonb_object_agg(origin,fn::text) into discovered from pg_temp.xb_cf_slots() where origin like 'type %';
+  for a in select attname from pg_attribute where attrelid='pg_type'::regclass
+    and atttypid='regproc'::regtype and attnum>0 and not attisdropped
+  loop
+    return query execute format(
+      'select ''type ''||pg_temp.xb_cf_type(t.oid)||%L||pg_temp.xb_cf_fn(t.%I::oid)
+       from pg_type t where t.%I::oid<>0 and
+         ($1->>(''type ''||pg_temp.xb_cf_type(t.oid)||%L)) is distinct from t.%I::oid::text',
+      '.'||a.attname||' -> ',a.attname,a.attname,' '||a.attname,a.attname) using discovered;
+  end loop;
+end$$;
+
+-- Definitions are bound separately from these portable relationships. Arrays,
+-- composites and enums add no arbitrary dispatch beyond the registered type
+-- hooks; domain expressions and range/opclass/text-search delegation do.
+create or replace function pg_temp.xb_cf_registry() returns table(kind text,identity text,payload jsonb)
+language sql volatile set search_path=pg_catalog as $$
+  select 'operator',pg_temp.xb_cf_named(o.oid,'operator'),jsonb_build_array(pg_get_userbyid(o.oprowner),
+    pg_temp.xb_cf_type(o.oprresult),o.oprkind,o.oprcanmerge,o.oprcanhash,pg_temp.xb_cf_fn(o.oprcode),
+    pg_temp.xb_cf_fn(o.oprrest),pg_temp.xb_cf_fn(o.oprjoin),pg_temp.xb_cf_named(o.oprcom,'operator'),pg_temp.xb_cf_named(o.oprnegate,'operator')) from pg_operator o
+  union all select 'cast',pg_temp.xb_cf_type(c.castsource)||' -> '||pg_temp.xb_cf_type(c.casttarget),
+    jsonb_build_array(pg_temp.xb_cf_fn(c.castfunc),c.castcontext,c.castmethod) from pg_cast c
+  union all select 'domain',pg_temp.xb_cf_type(t.oid),jsonb_build_array(pg_temp.xb_cf_type(t.typbasetype),t.typnotnull,t.typtypmod,
+    (select coalesce(jsonb_agg(jsonb_build_array(c.conname,pg_get_constraintdef(c.oid),c.convalidated) order by c.conname),'[]') from pg_constraint c where c.contypid=t.oid))
+    from pg_type t where t.typtype='d'
+  union all select 'range',pg_temp.xb_cf_type(r.rngtypid),jsonb_build_array(pg_temp.xb_cf_type(r.rngsubtype),pg_temp.xb_cf_type(r.rngmultitypid),
+    pg_temp.xb_cf_named(r.rngcollation,'collation'),pg_temp.xb_cf_named(r.rngsubopc,'class'),pg_temp.xb_cf_fn(r.rngcanonical),pg_temp.xb_cf_fn(r.rngsubdiff)) from pg_range r
+  union all select 'family',pg_temp.xb_cf_named(f.oid,'family'),jsonb_build_array(pg_get_userbyid(f.opfowner)) from pg_opfamily f
+  union all select 'class',pg_temp.xb_cf_named(c.oid,'class'),jsonb_build_array(pg_get_userbyid(c.opcowner),pg_temp.xb_cf_named(c.opcfamily,'family'),
+    pg_temp.xb_cf_type(c.opcintype),pg_temp.xb_cf_type(c.opckeytype),c.opcdefault) from pg_opclass c
+  union all select 'family operator',pg_temp.xb_cf_named(o.amopfamily,'family')||'/'||pg_temp.xb_cf_type(o.amoplefttype)||'/'||pg_temp.xb_cf_type(o.amoprighttype)||'/'||o.amopstrategy||'/'||o.amoppurpose::text,
+    jsonb_build_array(pg_temp.xb_cf_named(o.amopopr,'operator'),pg_temp.xb_cf_named(o.amopsortfamily,'family')) from pg_amop o
+  union all select 'family procedure',pg_temp.xb_cf_named(p.amprocfamily,'family')||'/'||pg_temp.xb_cf_type(p.amproclefttype)||'/'||pg_temp.xb_cf_type(p.amprocrighttype)||'/'||p.amprocnum,
+    jsonb_build_array(pg_temp.xb_cf_fn(p.amproc)) from pg_amproc p
+  union all select 'parser',pg_temp.xb_cf_named(p.oid,'parser'),jsonb_build_array(pg_temp.xb_cf_fn(p.prsstart),pg_temp.xb_cf_fn(p.prstoken),pg_temp.xb_cf_fn(p.prsend),
+    pg_temp.xb_cf_fn(p.prsheadline),pg_temp.xb_cf_fn(p.prslextype)) from pg_ts_parser p
+  union all select 'template',pg_temp.xb_cf_named(t.oid,'template'),jsonb_build_array(pg_temp.xb_cf_fn(t.tmplinit),pg_temp.xb_cf_fn(t.tmpllexize)) from pg_ts_template t
+  union all select 'dictionary',pg_temp.xb_cf_named(d.oid,'dictionary'),jsonb_build_array(pg_get_userbyid(d.dictowner),pg_temp.xb_cf_named(d.dicttemplate,'template'),md5(d.dictinitoption)) from pg_ts_dict d
+  union all select 'configuration',pg_temp.xb_cf_named(c.oid,'configuration'),jsonb_build_array(pg_get_userbyid(c.cfgowner),pg_temp.xb_cf_named(c.cfgparser,'parser')) from pg_ts_config c
+  union all select 'configuration mapping',pg_temp.xb_cf_named(m.mapcfg,'configuration')||'/'||m.maptokentype||'/'||m.mapseqno,
+    jsonb_build_array(pg_temp.xb_cf_named(m.mapdict,'dictionary')) from pg_ts_config_map m
+  union all select 'transform',pg_temp.xb_cf_type(t.trftype)||'/'||l.lanname,jsonb_build_array(pg_temp.xb_cf_fn(t.trffromsql),pg_temp.xb_cf_fn(t.trftosql))
+    from pg_transform t join pg_language l on l.oid=t.trflang
+$$;
+
+\ir agent_board_667_conversion_reference.sql
+
+create or replace function pg_temp.xb_cf_function_problem(p_fn oid) returns text
+language sql volatile set search_path=pg_catalog as $$
+  select case when r.identity is null then 'unreviewed primitive '||coalesce(pg_temp.xb_cf_fn(p_fn),p_fn::text)
+    when r.metadata is distinct from pg_temp.xb_cf_meta(p_fn) then 'primitive drift '||r.identity end
+  from (select p_fn as fn) s left join pg_temp.xb_cf_primitives r on r.fn=s.fn
+$$;
+create or replace function pg_temp.xb_cf_problems() returns table(identity text,problem text)
+language sql volatile set search_path=pg_catalog as $$
+  with recursive roots(fn) as (
+    select fn from pg_temp.xb_cf_slots()
+    union select p.oid from pg_proc p join pg_namespace n on n.oid=p.pronamespace
+      where n.nspname='pg_catalog' and p.proname in ('format','to_jsonb','upper')
+  ), edges(source,target) as (
+    select p.oid,p.prosupport::oid from pg_proc p where p.prosupport<>0
+    union select d.objid,d.refobjid from pg_depend d
+      where d.classid='pg_proc'::regclass and d.refclassid='pg_proc'::regclass
+  ), reach(fn) as (
+    select fn from roots union select e.target from reach r join edges e on e.source=r.fn
+  ), actual as (select * from pg_temp.xb_cf_registry())
+  select pg_temp.xb_cf_fn(r.fn),pg_temp.xb_cf_function_problem(r.fn) from reach r
+    where pg_temp.xb_cf_function_problem(r.fn) is not null
+  union all select a.kind||' '||a.identity,case when e.identity is null then 'unreviewed dispatch' else 'dispatch drift' end
+    from actual a left join pg_temp.xb_cf_reference e on e.kind=a.kind and e.identity=a.identity
+    where e.identity is null or a.payload is distinct from e.payload
+  union all select e.kind||' '||e.identity,'missing reviewed dispatch' from pg_temp.xb_cf_reference e
+    where not exists(select 1 from actual a where a.kind=e.kind and a.identity=e.identity)
+  union all select pg_temp.xb_cf_fn(p.oid),'shadow of fixed conversion call' from pg_proc p join pg_namespace n on n.oid=p.pronamespace
+    where p.proname in ('format','to_jsonb','upper') and n.nspname<>'pg_catalog'
+  union all select 'PostgreSQL '||current_setting('server_version'),'unreviewed primitive build'
+    where current_setting('server_version_num')<>'170011'
+  union all select identity,'missing registered type callback' from pg_temp.xb_cf_type_coverage()
+$$;
+create or replace function pg_temp.xb_cf_wrapper_problems() returns table(identity text,problem text)
+language sql volatile set search_path=pg_catalog as $$
+  select e.identity,'native conversion definition or security drift' from pg_temp.xb_cf_wrappers e
+  join pg_proc p on p.oid=to_regprocedure(e.identity)
+  where pg_temp.xb_cf_meta(p.oid) is distinct from e.metadata
+$$;
+create or replace function pg_temp.xb_cf_admitted() returns table(fn oid)
+language sql volatile set search_path=pg_catalog as $$
+  select p.oid from pg_temp.xb_cf_wrappers e join pg_proc p on p.oid=to_regprocedure(e.identity)
+  where not exists(select 1 from pg_temp.xb_cf_problems())
+    and not exists(select 1 from pg_temp.xb_cf_wrapper_problems())
+$$;

package/tests/fixtures/agent_board_667_conversion_reference.md

@@ -0,0 +1,23 @@
+The conversion reference is a finite snapshot for PostgreSQL 17.11, not a permission for a schema or for arbitrary dynamic SQL. It covers `realtime.cast` and the two `realtime.check_equality_op` overloads only. `apply_rls`, both senders and the Storage readers have separate relation/policy effects and remain unresolved.
+
+The dispatch tables came from CI run [40532374972](https://github.com/Consiliency/message-board/actions/runs/40532374972), head `50c7c9c184c227984c153e061c51b270682978d5`. Protocol-2 catalog SHA-256: `2c4598bd8b03474d54dc2221e17a83c6a47e1c14b48bd4fe2946e51d08a8160f`. The corresponding tables in an owned `public.ecr.aws/supabase/postgres:17.11.0.004` container matched that captured metadata byte for byte. The generator verifies those comparisons and each primitive's observable catalog metadata before producing portable identities.
+
+The reference contains declaration fingerprints, owners and ACLs for the relevant registered primitive callbacks, fixed conversion calls and their support/dependency closure. The existing trusted PostgreSQL implementation remains the foundation: a declaration fingerprint is not a binary attestation or a separate behavior proof for every built-in. Fourteen SQL declarations whose standard bodies were absent from `prosrc` were read with `pg_get_functiondef` on the owned reference build. Live native declarations must match these proposed references before admission; those bodies were not present in the original CI artifact.
+
+The guard discovers type I/O, casts, operators, ranges, operator-family support, text-search callbacks, transforms, language and access-method callbacks from the catalog. It checks portable relationship records and full primitive declaration/security fingerprints. Domain expressions and fixed-call shadows are checked separately. An independent `pg_attribute` query checks that every actual `regproc` pointer column on `pg_type` was discovered. Unknown or changed paths name themselves and close admission.
+
+Arrays, enums and composites use the checked type dispatch; custom domain checks and subsidiary callbacks cannot gain permission merely by sharing a built-in input function. The admitted SQL templates operate on typed scalar literals rather than relations, so this reference does not establish RLS, trigger or table-read closure for the other six routines. Literal-quoting and native-call witnesses are separate from the catalog pins.
+
+When the native wrappers are absent, tests report that fact and give no native-call or admission credit. Classifier negative controls still run and must restore the prior profile, including on an unreviewed build. When wrappers are present, an unsupported primitive build remains a named failure.
+
+To reproduce the reference, retain the native catalog, an owned reference catalog produced by `pgtap-failure-catalog.sql`, and the owned declaration/relationship packet. The generator performs no database connections. Its `--collect` mode prints a metadata-only collection query for an **owned test database**; it creates only transaction-local test objects and rolls them back. Supply connection credentials through libpq environment, never URL arguments.
+
+```sh
+node scripts/generate-667-conversion-reference.mjs --collect native.json > collect.sql
+# Run collect.sql against the owned reference build, retaining its single JSON result.
+node scripts/generate-667-conversion-reference.mjs native.json owned-reference.json owned-catalog.json --check
+# After reviewing a legitimate new reference:
+node scripts/generate-667-conversion-reference.mjs native.json owned-reference.json owned-catalog.json --output proposed-reference.sql
+```
+
+Review the evidence and generated diff before replacing the checked-in reference. CI never regenerates it to make a failure pass. The native wrapper identities, declaration fingerprints and security context must also remain within the explicitly reviewed three-routine scope.