@consiliency/agent-board-schema 1.64.0 → 1.74.0

package/tests/fixtures/agent_board_667_sender_guard.sql

@@ -0,0 +1,102 @@
+-- Requires conversion_guard.sql in this transaction. This is a finite effect
+-- disposition for the two native INSERT/SET templates, not a schema exemption.
+-- Dates and relation names are data: every live descendant is checked by shape.
+create or replace function pg_temp.xb_sf_name(p_oid oid,p_kind text) returns jsonb
+language sql volatile set search_path=pg_catalog as $$
+  select jsonb_build_array(n.nspname,t.typname) from pg_type t join pg_namespace n on n.oid=t.typnamespace
+    where p_kind='type' and t.oid=p_oid
+  union all select jsonb_build_array(n.nspname,c.collname) from pg_collation c join pg_namespace n on n.oid=c.collnamespace
+    where p_kind='collation' and c.oid=p_oid
+  union all select jsonb_build_array(n.nspname,c.opcname,a.amname) from pg_opclass c
+    join pg_namespace n on n.oid=c.opcnamespace join pg_am a on a.oid=c.opcmethod where p_kind='class' and c.oid=p_oid
+$$;
+create or replace function pg_temp.xb_sf_targets() returns table(rel oid)
+language sql volatile set search_path=pg_catalog as $$
+  with recursive targets(rel) as (
+    select to_regclass('realtime.messages')::oid where to_regclass('realtime.messages') is not null
+    union select i.inhrelid from targets t join pg_inherits i on i.inhparent=t.rel
+  ) select rel from targets
+$$;
+create or replace function pg_temp.xb_sf_profile(p_rel oid) returns jsonb
+language sql volatile set search_path=pg_catalog as $$
+  select jsonb_build_object(
+    'relation',jsonb_build_object('owner',pg_get_userbyid(c.relowner),
+      'acl',(select jsonb_agg(a::text order by a::text collate "C") from unnest(c.relacl) a),
+      'kind',c.relkind,'access_method',(select amname from pg_am where oid=c.relam),
+      'options',c.reloptions,'is_partition',c.relispartition,'row_security',c.relrowsecurity,
+      'force_row_security',c.relforcerowsecurity,'partition_key',pg_get_partkeydef(c.oid)),
+    'columns',(select jsonb_agg(jsonb_build_object('number',a.attnum,'name',a.attname,
+      'type',pg_temp.xb_sf_name(a.atttypid,'type'),'modifier',a.atttypmod,'dimensions',a.attndims,
+      'not_null',a.attnotnull,'dropped',a.attisdropped,'identity',a.attidentity,
+      'generated',a.attgenerated,'collation',pg_temp.xb_sf_name(a.attcollation,'collation'),
+      'acl',a.attacl,'options',a.attoptions,'has_missing',a.atthasmissing,
+      'default',pg_get_expr(d.adbin,d.adrelid)) order by a.attnum)
+      from pg_attribute a left join pg_attrdef d on d.adrelid=a.attrelid and d.adnum=a.attnum
+      where a.attrelid=c.oid and a.attnum>0),
+    'constraints',(select coalesce(jsonb_agg(jsonb_build_object('type',k.contype,
+      'columns',k.conkey,'definition',pg_get_constraintdef(k.oid),'validated',k.convalidated)
+      order by k.contype,pg_get_constraintdef(k.oid)),'[]') from pg_constraint k where k.conrelid=c.oid),
+    'indexes',(select coalesce(jsonb_agg(jsonb_build_object(
+      'keys',i.indkey::smallint[],'classes',(select jsonb_agg(pg_temp.xb_sf_name(x,'class')) from unnest(i.indclass) x),
+      'collations',(select jsonb_agg(pg_temp.xb_sf_name(x,'collation')) from unnest(i.indcollation) x),
+      'options',i.indoption::smallint[],'attributes',i.indnatts,'key_attributes',i.indnkeyatts,
+      'unique',i.indisunique,'primary',i.indisprimary,'exclusion',i.indisexclusion,
+      'immediate',i.indimmediate,'nulls_not_distinct',i.indnullsnotdistinct,
+      'valid',i.indisvalid,'ready',i.indisready,'live',i.indislive,
+      'predicate',pg_get_expr(i.indpred,i.indrelid),'expression',pg_get_expr(i.indexprs,i.indrelid),
+      'access_method',m.amname,'relation_options',ic.reloptions)
+      order by i.indisprimary,i.indexrelid),'[]') from pg_index i
+      join pg_class ic on ic.oid=i.indexrelid join pg_am m on m.oid=ic.relam where i.indrelid=c.oid))
+  from pg_class c where c.oid=p_rel
+$$;
+
+\ir agent_board_667_sender_reference.sql
+
+create or replace function pg_temp.xb_sf_problems() returns table(identity text,problem text)
+language sql volatile set search_path=pg_catalog as $$
+  with targets as (select rel,rel=to_regclass('realtime.messages') as root from pg_temp.xb_sf_targets()),
+  shapes as (select t.*,pg_temp.xb_sf_profile(t.rel) as actual,r.payload as expected
+    from targets t join pg_temp.xb_sf_reference r on r.kind='shape' and r.identity=case when t.root then 'root' else 'leaf' end)
+  select 'realtime.messages','missing native destination' where to_regclass('realtime.messages') is null
+  union all select 'realtime.messages','no writable leaf partition' where not exists(select 1 from targets where not root)
+  union all select s.rel::regclass::text,'unreviewed relation profile: '||k
+    from shapes s cross join lateral jsonb_object_keys(s.expected) k where s.actual->k is distinct from s.expected->k
+  union all select s.rel::regclass::text||'.'||(a->>'name'),'unreviewed column/default expression'
+    from shapes s cross join lateral jsonb_array_elements(s.actual->'columns') a
+    where not exists(select 1 from jsonb_array_elements(s.expected->'columns') e where e=a)
+  union all select s.rel::regclass::text||'.'||k.conname,'unreviewed constraint'
+    from shapes s join pg_constraint k on k.conrelid=s.rel
+    where not exists(select 1 from jsonb_array_elements(s.expected->'constraints') e
+      where e=jsonb_build_object('type',k.contype,'columns',k.conkey,'definition',pg_get_constraintdef(k.oid),'validated',k.convalidated))
+      or k.condeferrable or k.condeferred
+  union all select i.indexrelid::regclass::text,'index set requires exact effect disposition'
+    from shapes s join pg_index i on i.indrelid=s.rel where s.actual->'indexes' is distinct from s.expected->'indexes'
+  union all select s.rel::regclass::text,'unreviewed inheritance/partition edge' from shapes s
+    where (s.root and exists(select 1 from pg_inherits i where i.inhrelid=s.rel))
+      or (not s.root and (select count(*) from pg_inherits i where i.inhrelid=s.rel and i.inhparent=to_regclass('realtime.messages') and not i.inhdetachpending)<>1)
+      or (not s.root and (select count(*) from pg_inherits i where i.inhrelid=s.rel)<>1)
+  union all select t.rel::regclass::text||'.'||p.polname,'unreviewed RLS policy' from targets t join pg_policy p on p.polrelid=t.rel
+  union all select t.rel::regclass::text||'.'||g.tgname||' -> '||pg_temp.xb_cf_fn(g.tgfoid),'unreviewed trigger'
+    from targets t join pg_trigger g on g.tgrelid=t.rel
+  union all select t.rel::regclass::text||'.'||r.rulename,'unreviewed rewrite rule' from targets t join pg_rewrite r on r.ev_class=t.rel
+  union all select k.conrelid::regclass::text||'.'||k.conname,'unreviewed foreign-key edge'
+    from pg_constraint k where k.contype='f' and exists(select 1 from targets t where t.rel in (k.conrelid,k.confrelid))
+  union all select 'schema realtime','native schema security drift' from pg_namespace n
+    join pg_temp.xb_sf_reference r on r.kind='schema' and r.identity=n.nspname
+    where r.payload is distinct from jsonb_build_object('owner',pg_get_userbyid(n.nspowner),
+      'acl',(select jsonb_agg(a::text order by a::text collate "C") from unnest(n.nspacl) a))
+  union all select pg_temp.xb_cf_fn(p.oid),'unreviewed fixed-call shadow' from pg_proc p
+    where p.proname in ('format','to_jsonb','gen_random_uuid','jsonb_set','timezone','clock_timestamp')
+      and not exists(select 1 from pg_temp.xb_sf_reference r where r.kind='primitive' and to_regprocedure(r.identity)=p.oid)
+  union all select r.identity,'fixed-call declaration or security drift' from pg_temp.xb_sf_reference r
+    where r.kind='primitive' and r.payload is distinct from pg_temp.xb_cf_meta(to_regprocedure(r.identity))
+  union all select r.identity,'native sender declaration or security drift' from pg_temp.xb_sf_reference r
+    join pg_proc p on p.oid=to_regprocedure(r.identity)
+    where r.kind='wrapper' and r.payload is distinct from pg_temp.xb_cf_meta(p.oid)
+  union all select identity,problem from pg_temp.xb_cf_problems()
+$$;
+create or replace function pg_temp.xb_sf_admitted() returns table(fn oid)
+language sql volatile set search_path=pg_catalog as $$
+  select p.oid from pg_temp.xb_sf_reference r join pg_proc p on p.oid=to_regprocedure(r.identity)
+  where r.kind='wrapper' and not exists(select 1 from pg_temp.xb_sf_problems())
+$$;

package/tests/fixtures/agent_board_667_sender_reference.md

@@ -0,0 +1,20 @@
+This is a finite effect disposition for `realtime.send(jsonb,text,text,boolean)` and `realtime.send_binary(bytea,text,text,boolean)`. It does not admit Storage, `apply_rls`, arbitrary invoker SQL, or a whole schema. Native bodies/security, fixed calls, target columns/defaults, constraints, indexes and schema permissions are explicit references. Primitive declarations rest on the trusted PostgreSQL 17.11 implementation and the existing conversion dispatch guard, not binary attestation.
+
+Source: CI run [40532374972](https://github.com/Consiliency/message-board/actions/runs/40532374972), head `50c7c9c184c227984c153e061c51b270682978d5`, protocol-2 catalog SHA256 `2c4598bd8b03474d54dc2221e17a83c6a47e1c14b48bd4fe2946e51d08a8160f`. All captured destination descendants share one portable leaf profile. The owned `public.ecr.aws/supabase/postgres:17.11.0.004` reconstruction matched the captured parent and five leaf profiles, sender declarations/security, schema permissions and sixteen fixed-call declarations. Its initially different `extensions.gen_random_uuid` grants were corrected on that owned database to the captured ACL before collecting the reference. This is metadata reconstruction, not a native Supabase service instance or authorization for a production change.
+
+Every live descendant is discovered recursively through `pg_inherits` and positively compared with the structural profile. No date or partition name is an exemption. Unknown policies, triggers, rules, foreign-key edges, expressions, callbacks and shadows name themselves and close admission. The class permits ordinary direct leaves with the reviewed columns/defaults, heap storage and two reviewed btree indexes; a subpartition or foreign leaf requires new disposition. Trigger/policy bodies need no purity inference because none is admitted in this captured destination class. Defaults and index/check expressions match the reviewed templates; all registered type/operator/access-method dispatch also passes the conversion guard. Fixed-call shadows include the explicitly bound pgcrypto UUID alias; sharing its name or schema is insufficient.
+
+The root `RANGE (inserted_at)` key is a proposed structural condition checked against the live catalog. Protocol 2 did not record `pg_partitioned_table`; its parent primary key, timestamp bounds and descendant profiles support the reconstruction but are not a direct native key observation. That key, additional live constraint flags, and all owned-build declaration references must still match native CI before acceptance. A passing minimal database or an absent wrapper gives no native call/effect credit.
+
+Native senders catch errors and return void. Positive probes therefore check exact own rows and payload/ID/event/topic/private/extension/default state separately from `lives_ok`. Refusal probes keep the native RLS warning and require no own row. Topic-unquoting controls must actually insert the own message and append the intended own history; syntax errors in the swallowed exception block receive no mutation credit. Other controls introduce valid registered paths and test the recognizer's named refusal and restoration. Some diagnostic controls are redundant with another refusal layer; they are not independent safety-family credits.
+
+Regeneration is manual and review bound. `--collect` prints a metadata-only SQL transaction for an **owned test database**; it creates only temporary helpers and rolls back. Connect using libpq environment, never a URL in argv. Retain the single JSON result along with the native catalog, inspect the generated diff, and verify the native environment separately:
+
+```sh
+node scripts/generate-667-sender-reference.mjs --collect native-catalog.json > collect.sql
+# Run collect.sql on the owned reference database; retain its single JSON result.
+node scripts/generate-667-sender-reference.mjs native-catalog.json collected-fixed.json --check
+node scripts/generate-667-sender-reference.mjs native-catalog.json collected-fixed.json --output proposed-reference.sql
+```
+
+CI never regenerates a reference to clear a failure. It requires the live definitions and effect class to match. The remaining four native routines need separate positive dispositions and proof.