@consiliency/agent-board-schema 1.64.0 → 1.74.0

package/tests/fixtures/agent_board_667_delimiter_guard.sql

@@ -0,0 +1,92 @@
+-- Requires the reviewed conversion/sender/timestamp/search helpers in this transaction.
+-- This admits one exact delimiter OID; it is not a Storage reader exemption.
+\ir agent_board_667_delimiter_reference.sql
+create function pg_temp.xb_sd_prerequisite_problems() returns table(identity text,problem text)
+language sql volatile set search_path=pg_catalog as $$
+  select identity,problem from pg_temp.xb_ss_problems()
+  union all select r.identity,'delimiter declaration or security drift' from pg_temp.xb_sd_reference r
+    where r.kind='wrapper' and r.payload is distinct from pg_temp.xb_cf_meta(to_regprocedure(r.identity))
+  union all select pg_temp.xb_cf_fn(p.oid),'unreviewed delimiter overload or shadow' from pg_proc p
+    where p.proname in(select payload#>>'{}' from pg_temp.xb_sd_reference where kind='name')
+      and not exists(select 1 from pg_temp.xb_sd_reference r where r.kind='resolution' and to_regprocedure(r.identity)=p.oid)
+  union all select r.identity,'delimiter resolution declaration drift' from pg_temp.xb_sd_reference r
+    where r.kind='resolution' and r.payload is distinct from
+      case when (select prokind from pg_proc where oid=to_regprocedure(r.identity))='a'
+        then pg_temp.xb_st_aggregate(to_regprocedure(r.identity)) else pg_temp.xb_cf_meta(to_regprocedure(r.identity)) end
+$$;
+create temp table xb_sd_views(rel oid primary key,identity text not null,category text not null) on commit drop;
+do $graph$
+declare q record; nm text;
+begin
+  if not exists(select 1 from pg_temp.xb_sd_prerequisite_problems()) then
+    for q in select identity,payload from pg_temp.xb_sd_reference where kind='query' order by identity loop
+      nm:='xb_sd_'||q.identity;
+      execute format('create temp view %I as %s',nm,q.payload->>'sql');
+      insert into pg_temp.xb_sd_views values(to_regclass('pg_temp.'||nm),q.identity,q.payload->>'group');
+    end loop;
+  end if;
+end $graph$;
+create function pg_temp.xb_sd_roots() returns table(fn oid)
+language sql volatile set search_path=pg_catalog as $$
+  select d.refobjid from pg_temp.xb_sd_views v join pg_rewrite w on w.ev_class=v.rel
+    join pg_depend d on d.classid='pg_rewrite'::regclass and d.objid=w.oid where d.refclassid='pg_proc'::regclass
+  union select m[2]::oid from pg_temp.xb_sd_views v join pg_rewrite w on w.ev_class=v.rel
+    cross join lateral regexp_matches(w.ev_action::text,':(funcid|aggfnoid|winfnoid|opfuncid|elemfuncid) ([0-9]+)','g') m
+    where m[2]::oid<>0
+  union select fn from pg_temp.xb_st_roots() where origin like 'target %'
+$$;
+create function pg_temp.xb_sd_reach() returns table(fn oid)
+language sql volatile set search_path=pg_catalog as $$
+  with recursive edges(source,target) as (
+    select p.oid,p.prosupport::oid from pg_proc p where p.prosupport<>0
+    union select d.objid,d.refobjid from pg_depend d where d.classid='pg_proc'::regclass and d.refclassid='pg_proc'::regclass
+    union select aggregate,fn from pg_temp.xb_st_aggregate_slots()
+  ), reach(fn) as (select fn from pg_temp.xb_sd_roots() union select e.target from reach r join edges e on e.source=r.fn)
+  select fn from reach
+$$;
+create function pg_temp.xb_sd_collations() returns table(coll oid)
+language sql volatile set search_path=pg_catalog as $$
+  select distinct m[1]::oid from pg_temp.xb_sd_views v join pg_rewrite w on w.ev_class=v.rel
+    cross join lateral regexp_matches(w.ev_action::text,':(?:inputcollid|collid|varcollid|constcollid|opcollid|funccollid) ([0-9]+)','g') m
+    where m[1]::oid<>0
+  union select coll from pg_temp.xb_st_collations()
+$$;
+create function pg_temp.xb_sd_problems() returns table(identity text,problem text)
+language sql volatile set search_path=pg_catalog as $$
+  select identity,problem from pg_temp.xb_sd_prerequisite_problems()
+  union all select 'delimiter parser inventory','query inventory incomplete'
+    where (select count(*) from pg_temp.xb_sd_views)<>(select count(*) from pg_temp.xb_sd_reference where kind='query')
+  union all select r.identity,'parsed group incomplete' from pg_temp.xb_sd_reference r where r.kind='group'
+    and (select count(*) from pg_temp.xb_sd_views v where v.category=r.identity)<>(r.payload#>>'{}')::integer
+  union all select pg_temp.xb_cf_fn(g.fn),'unreviewed delimiter executable or support callback' from pg_temp.xb_sd_reach() g
+    where not exists(select 1 from pg_temp.xb_sd_reference r where r.kind in('primitive','helper','aggregate') and to_regprocedure(r.identity)=g.fn)
+  union all select r.identity,'delimiter primitive or helper declaration drift' from pg_temp.xb_sd_reference r
+    where r.kind in('primitive','helper') and r.payload is distinct from pg_temp.xb_cf_meta(to_regprocedure(r.identity))
+  union all select r.identity,'delimiter aggregate dispatch drift' from pg_temp.xb_sd_reference r
+    where r.kind='aggregate' and r.payload is distinct from pg_temp.xb_st_aggregate(to_regprocedure(r.identity))
+  union all select n.nspname||'.'||c.collname,'unreviewed delimiter collation' from pg_temp.xb_sd_collations() x
+    join pg_collation c on c.oid=x.coll join pg_namespace n on n.oid=c.collnamespace
+    where not exists(select 1 from pg_temp.xb_sd_reference r where r.kind='collation'
+      and r.identity=format('%I.%I',n.nspname,c.collname) and r.payload=pg_temp.xb_st_collation(c.oid))
+  union all select d.refobjid::regclass::text,'unexpected delimiter relation' from pg_temp.xb_sd_views v
+    join pg_rewrite w on w.ev_class=v.rel join pg_depend d on d.classid='pg_rewrite'::regclass and d.objid=w.oid
+    where d.refclassid='pg_class'::regclass and d.refobjid not in(v.rel,to_regclass('storage.objects'))
+  -- The normalization parser binds v_current to the reviewed objects row type.
+  -- Prove that binding against every actual parsed batch projection and every
+  -- field discovered in the source, not an assumed record-column list.
+  union all select v.identity||'.'||field,'delimiter record anchor type drift'
+    from pg_temp.xb_sd_views v join pg_temp.xb_sd_reference q on q.kind='query' and q.identity=v.identity
+    cross join lateral (select jsonb_array_elements_text(payload->'record_fields') as field
+      from pg_temp.xb_sd_reference where kind='coverage') f
+    left join pg_attribute a on a.attrelid=v.rel and a.attname=f.field and a.attnum>0 and not a.attisdropped
+    left join pg_attribute target on target.attrelid=to_regclass('storage.objects') and target.attname=f.field
+      and target.attnum>0 and not target.attisdropped
+    where q.payload->>'role'='record' and (a.attname is null or target.attname is null
+      or row(a.atttypid,a.atttypmod,a.attcollation) is distinct from row(target.atttypid,target.atttypmod,target.attcollation))
+$$;
+create function pg_temp.xb_sd_admitted() returns table(fn oid)
+language sql volatile set search_path=pg_catalog as $$
+  select to_regprocedure(identity)::oid from pg_temp.xb_sd_reference where kind='wrapper'
+    and identity='storage.list_objects_with_delimiter(text,text,text,integer,text,text,text,text,text,timestamp with time zone,text)'
+    and not exists(select 1 from pg_temp.xb_sd_problems())
+$$;

package/tests/fixtures/agent_board_667_delimiter_provenance.md

@@ -0,0 +1,116 @@
+# Finite delimiter-reader effect disposition
+
+This proof covers only
+`storage.list_objects_with_delimiter(text,text,text,integer,text,text,text,text,text,timestamp with time zone,text)`.
+It is separate from the timestamp and search readers. `realtime.apply_rls` remains
+unadmitted. A missing native wrapper gives no native behavior or effect credit.
+
+The reference input is the retained full Supabase CI catalog for `e2770539`,
+SHA-256 `9582cf9fce0dd7ec70ad5f16bbca3c906aa5d9312a540348a251306f79241aca`.
+The captured delimiter declaration has MD5 `7747efec8583d78cd01449d9b99cd2eb`.
+The owned PostgreSQL 17.11.0.004 preparation matched that declaration, owner and
+ACL. Native CI on the candidate must establish the additional profile equality
+with its 17.11.0.006 installation. Declaration equality is not C binary attestation.
+
+## Source inventory and call closure
+
+The existing bounded source interpreter is reused unchanged. The exact native
+body has three dynamic execution sites with 18, 324 and 324 non-null constructor
+alternatives, ten static SELECTs and 166 scalar expressions: 842 parser views.
+The inventory includes initializers, assignments, branch selectors/conditions,
+EXIT conditions, USING expressions, constructor expressions and RAISE arguments.
+Two execution sites have an additional null alternative, which PostgreSQL refuses
+with `22004`; null is never converted into executable caller text. Ignoring exits
+over-approximates possible later construction. SQL constructor assignments inside
+loops and unclassified statement forms remain refused by the interpreter. The
+present body uses only bare RETURN/RETURN NEXT; completeness for another body is
+not claimed.
+
+These are source-derived parser inputs, not runtime branch coverage or a sample
+of argument strings. All caller prefixes, delimiters and cursors remain typed
+bound data. Branch merging includes unreachable constructor combinations. Record
+expressions bind the ten source-discovered `v_current` fields to `storage.objects`;
+the guard positively checks every field's type, modifier and collation against
+all 324 actual parsed batch projections.
+
+The graph combines `pg_depend` with stored parser-node callable OIDs, including
+pinned builtins omitted from normal dependencies. It follows callable dependency
+and support edges and the existing aggregate callback census. This reader reaches
+no aggregate; a newly reached one requires a new disposition. Parsed relations
+must be their own view or the fixed `storage.objects` target. Resolution profiles
+cover all catalog overloads/shadows for every reached callable name. A changed
+declaration, collation, executable or target prevents admission by exact OID.
+
+The delimiter prerequisite composes the earlier search, timestamp, sender and
+conversion proofs. Consequently target columns, defaults, constraints, indexes,
+owner/ACL, schema access, policies, rewrite rules, inheritance and registered
+type/output/operator/opfamily dispatch remain guarded. Source preparation does
+not add entries to any earlier reference. The reference generator requires every
+reached primitive to match an earlier reviewed search primitive, except the one
+newly reviewed timestamp entry point below. It cannot enroll an arbitrary
+`pg_catalog` or C/internal function merely because of its namespace or language.
+
+## Newly reached timestamp primitive
+
+There are 25 reached primitive identities and the composed SQL prefix helper.
+Twenty-four primitive dispositions are inherited byte-for-byte from the reviewed
+search reference. The sole new primitive is
+`pg_catalog.date_trunc(text,timestamp with time zone)`, internal entry point
+`timestamptz_trunc`. The exact delimiter source contains 19 calls, each with the
+literal unit `milliseconds`; callers cannot select the unit or implementation.
+
+The implementation was read from PostgreSQL's `REL_17_11` sources:
+
+- [`timestamptz_trunc` and its internal implementation](https://github.com/postgres/postgres/blob/REL_17_11/src/backend/utils/adt/timestamp.c#L4838)
+  use the session timezone to decode a finite timestamp, truncate the fractional
+  second with integer arithmetic, and convert it back. Infinite timestamps return
+  unchanged. The millisecond branch does not request timezone-offset recomputation.
+- [`DecodeUnits`](https://github.com/postgres/postgres/blob/REL_17_11/src/backend/utils/adt/datetime.c)
+  and the identifier normalization in
+  [`scansup.c`](https://github.com/postgres/postgres/blob/REL_17_11/src/backend/parser/scansup.c)
+  classify the fixed unit. Timestamp conversion reads backend timezone state and
+  [`timezone implementation data`](https://github.com/postgres/postgres/blob/REL_17_11/src/timezone/localtime.c).
+
+Those paths allocate, read backend/timezone data and may raise errors; this is not
+a claim of no effects at all. Within the reviewed implementation they introduce
+no SQL callback or application thread-history DML. The existing finite dispatch
+proof remains a premise for the other reached primitives and their callbacks.
+Upstream source inspection does not attest the deployed PostgreSQL or locale
+binaries, arbitrary extension hooks, or arbitrary privileged SQL.
+
+## Witnesses and recording boundaries
+
+The behavior fixture uses a fresh own bucket, a separate decoy bucket, versioned
+objects, two archived rows within one millisecond, an interleaved deletion marker,
+and nested names. It checks full leaf/folder fields, ascending and descending
+results, empty delimiter, nested prefix, start-after and next-token precedence,
+limits, version/marker modes, the timestamp-plus-version cursor, literal SQL-looking
+data, service visibility and authenticated RLS refusal. Version ties sort ASC in
+the captured source. An initial fixture assumed DESC; its four failed assertions
+are retained without verification credit. The corrected fixture pins the actual
+source contract, including resuming from version `a` to `b` in the same millisecond.
+
+Profile/control tests separately check all inventory groups, the timestamp
+primitive, constructor and SQL-helper roots, every typed record projection, the
+fixed relation, null-execution refusal, and an injected overload. Removing the new overload census fails its named census
+assertion while an inherited guard still refuses admission; that witness receives
+no separate refusal credit. A SELECT with a
+live INSERT trigger has zero trigger effects, and an explicit own INSERT invokes
+that same trigger. A real SELECT-policy callback demonstrates that STABLE alone
+cannot establish absence of writes; the policy remains unadmitted.
+
+Mutation receipts must retain actual full reader source and `pg_proc` metadata
+before every phase, including passing phases, full plans and exact named failures.
+Post-rollback readbacks compare the same-owned-database baseline: reader/source,
+all policies, every Storage rule/relation/attribute/default/index/constraint,
+inheritance and non-temporary namespace rows, the global persistent-function
+census and SHA-256, and a separate temporary-function census. This is scoped
+semantic restoration; physical statistics, file numbers, vacuum horizons and
+temporary namespace allocation are not claimed restored. Setup failures and
+surviving mutations receive no credit. Repeated phases do not add distinct-family
+credit. Each allow call uses `lives_ok` followed by a separate state assertion.
+
+The manual generator accepts retained native and owned parser catalogs, writes
+only with explicit `--output`, and otherwise checks the checked-in reference.
+There is no live production query or automatic reference refresh. New source,
+dispatch or primitive effects require review before updating the reference.