@consiliency/agent-board-schema 1.68.0 → 1.74.0

package/tests/fixtures/agent_board_667_search_guard.sql

@@ -0,0 +1,92 @@
+-- Requires the reviewed conversion/sender/timestamp helpers in this transaction.
+-- This admits one exact search OID; it is not a Storage reader exemption.
+\ir agent_board_667_search_reference.sql
+create function pg_temp.xb_ss_prerequisite_problems() returns table(identity text,problem text)
+language sql volatile set search_path=pg_catalog as $$
+  select identity,problem from pg_temp.xb_st_problems()
+  union all select r.identity,'search declaration or security drift' from pg_temp.xb_ss_reference r
+    where r.kind='wrapper' and r.payload is distinct from pg_temp.xb_cf_meta(to_regprocedure(r.identity))
+  union all select pg_temp.xb_cf_fn(p.oid),'unreviewed search overload or shadow' from pg_proc p
+    where p.proname in(select payload#>>'{}' from pg_temp.xb_ss_reference where kind='name')
+      and not exists(select 1 from pg_temp.xb_ss_reference r where r.kind='resolution' and to_regprocedure(r.identity)=p.oid)
+  union all select r.identity,'search resolution declaration drift' from pg_temp.xb_ss_reference r
+    where r.kind='resolution' and r.payload is distinct from
+      case when (select prokind from pg_proc where oid=to_regprocedure(r.identity))='a'
+        then pg_temp.xb_st_aggregate(to_regprocedure(r.identity)) else pg_temp.xb_cf_meta(to_regprocedure(r.identity)) end
+$$;
+create temp table xb_ss_views(rel oid primary key,identity text not null,category text not null) on commit drop;
+do $graph$
+declare q record; nm text;
+begin
+  if not exists(select 1 from pg_temp.xb_ss_prerequisite_problems()) then
+    for q in select identity,payload from pg_temp.xb_ss_reference where kind='query' order by identity loop
+      nm:='xb_ss_'||q.identity;
+      execute format('create temp view %I as %s',nm,q.payload->>'sql');
+      insert into pg_temp.xb_ss_views values(to_regclass('pg_temp.'||nm),q.identity,q.payload->>'group');
+    end loop;
+  end if;
+end $graph$;
+create function pg_temp.xb_ss_roots() returns table(fn oid)
+language sql volatile set search_path=pg_catalog as $$
+  select d.refobjid from pg_temp.xb_ss_views v join pg_rewrite w on w.ev_class=v.rel
+    join pg_depend d on d.classid='pg_rewrite'::regclass and d.objid=w.oid where d.refclassid='pg_proc'::regclass
+  union select m[2]::oid from pg_temp.xb_ss_views v join pg_rewrite w on w.ev_class=v.rel
+    cross join lateral regexp_matches(w.ev_action::text,':(funcid|aggfnoid|winfnoid|opfuncid|elemfuncid) ([0-9]+)','g') m
+    where m[2]::oid<>0
+  union select fn from pg_temp.xb_st_roots() where origin like 'target %'
+$$;
+create function pg_temp.xb_ss_reach() returns table(fn oid)
+language sql volatile set search_path=pg_catalog as $$
+  with recursive edges(source,target) as (
+    select p.oid,p.prosupport::oid from pg_proc p where p.prosupport<>0
+    union select d.objid,d.refobjid from pg_depend d where d.classid='pg_proc'::regclass and d.refclassid='pg_proc'::regclass
+    union select aggregate,fn from pg_temp.xb_st_aggregate_slots()
+  ), reach(fn) as (select fn from pg_temp.xb_ss_roots() union select e.target from reach r join edges e on e.source=r.fn)
+  select fn from reach
+$$;
+create function pg_temp.xb_ss_collations() returns table(coll oid)
+language sql volatile set search_path=pg_catalog as $$
+  select distinct m[1]::oid from pg_temp.xb_ss_views v join pg_rewrite w on w.ev_class=v.rel
+    cross join lateral regexp_matches(w.ev_action::text,':(?:inputcollid|collid|varcollid|constcollid|opcollid|funccollid) ([0-9]+)','g') m
+    where m[1]::oid<>0
+  union select coll from pg_temp.xb_st_collations()
+$$;
+create function pg_temp.xb_ss_problems() returns table(identity text,problem text)
+language sql volatile set search_path=pg_catalog as $$
+  select identity,problem from pg_temp.xb_ss_prerequisite_problems()
+  union all select 'search parser inventory','query inventory incomplete'
+    where (select count(*) from pg_temp.xb_ss_views)<>(select count(*) from pg_temp.xb_ss_reference where kind='query')
+  union all select r.identity,'parsed group incomplete' from pg_temp.xb_ss_reference r where r.kind='group'
+    and (select count(*) from pg_temp.xb_ss_views v where v.category=r.identity)<>(r.payload#>>'{}')::integer
+  union all select pg_temp.xb_cf_fn(g.fn),'unreviewed search executable or support callback' from pg_temp.xb_ss_reach() g
+    where not exists(select 1 from pg_temp.xb_ss_reference r where r.kind in('primitive','helper','aggregate') and to_regprocedure(r.identity)=g.fn)
+  union all select r.identity,'search primitive or helper declaration drift' from pg_temp.xb_ss_reference r
+    where r.kind in('primitive','helper') and r.payload is distinct from pg_temp.xb_cf_meta(to_regprocedure(r.identity))
+  union all select r.identity,'search aggregate dispatch drift' from pg_temp.xb_ss_reference r
+    where r.kind='aggregate' and r.payload is distinct from pg_temp.xb_st_aggregate(to_regprocedure(r.identity))
+  union all select n.nspname||'.'||c.collname,'unreviewed search collation' from pg_temp.xb_ss_collations() x
+    join pg_collation c on c.oid=x.coll join pg_namespace n on n.oid=c.collnamespace
+    where not exists(select 1 from pg_temp.xb_ss_reference r where r.kind='collation'
+      and r.identity=format('%I.%I',n.nspname,c.collname) and r.payload=pg_temp.xb_st_collation(c.oid))
+  union all select d.refobjid::regclass::text,'unexpected search relation' from pg_temp.xb_ss_views v
+    join pg_rewrite w on w.ev_class=v.rel join pg_depend d on d.classid='pg_rewrite'::regclass and d.objid=w.oid
+    where d.refclassid='pg_class'::regclass and d.refobjid not in(v.rel,to_regclass('storage.objects'))
+  -- The normalization parser binds v_current to the reviewed objects row type.
+  -- Prove that binding against every actual parsed batch projection and every
+  -- field discovered in the source, not an assumed record-column list.
+  union all select v.identity||'.'||field,'search record anchor type drift'
+    from pg_temp.xb_ss_views v join pg_temp.xb_ss_reference q on q.kind='query' and q.identity=v.identity
+    cross join lateral (select jsonb_array_elements_text(payload->'record_fields') as field
+      from pg_temp.xb_ss_reference where kind='coverage') f
+    left join pg_attribute a on a.attrelid=v.rel and a.attname=f.field and a.attnum>0 and not a.attisdropped
+    left join pg_attribute target on target.attrelid=to_regclass('storage.objects') and target.attname=f.field
+      and target.attnum>0 and not target.attisdropped
+    where q.payload->>'role'='record' and (a.attname is null or target.attname is null
+      or row(a.atttypid,a.atttypmod,a.attcollation) is distinct from row(target.atttypid,target.atttypmod,target.attcollation))
+$$;
+create function pg_temp.xb_ss_admitted() returns table(fn oid)
+language sql volatile set search_path=pg_catalog as $$
+  select to_regprocedure(identity)::oid from pg_temp.xb_ss_reference where kind='wrapper'
+    and identity='storage.search(text,text,integer,integer,integer,text,text,text,text,text)'
+    and not exists(select 1 from pg_temp.xb_ss_problems())
+$$;

package/tests/fixtures/agent_board_667_search_provenance.md

@@ -0,0 +1,141 @@
+# #667: finite Storage `search` disposition
+
+This test-only admission is for exactly
+`storage.search(text,text,integer,integer,integer,text,text,text,text,text)`.
+It adds no application migration or runtime privilege. The delimiter listing and
+`realtime.apply_rls` remain unadmitted, and this is not whole-PR acceptance.
+
+## Bound source and complete constructor inventory
+
+The native input is CI run `40573455512`, job `122433487035`, protocol-2 catalog
+SHA256 `9582cf9fce0dd7ec70ad5f16bbca3c906aa5d9312a540348a251306f79241aca`.
+The search definition SHA256 is
+`554f4855e4490792b6c854ba68e622f39f004515d092e7409b0167a44b4acc99`.
+The owned fixture uses cached PostgreSQL 17.11.0.004; CI uses 17.11.0.006.
+The selective seven-routine reconstruction inherits the previously reviewed
+target/helper DDL and adds the captured search definition with native owner and
+ACL. It is not a reconstruction of the entire native platform.
+
+The earlier delegate parsed 103 sampled variants and observed an offset mutant.
+That investigation is retained but supplies no complete-constructor claim.
+`scripts/lib/agent-board-667-search-templates.mjs` now lexes the entire captured
+body, excluding comments and quoted strings from the procedural statement census.
+It accepts a bounded statement grammar and rejects unclassified statements.
+
+The constructor analysis follows IF/ELSIF/ELSE and CASE branches with separate
+environments and unions their literal domains. Repeated uses of a variable share
+one selected value, rather than independently selecting contradictory format
+directions. It follows every assignment that contributes to executable SQL.
+Only literals, concatenation, CASE-selected domains and `format` are accepted
+constructors. Caller text cannot become executable SQL. SQL-constructor mutation
+inside a loop is refused; in this captured body the constructor domains are
+fixed before the loop. All four `EXECUTE` sites must be visited.
+
+The result is a conservative over-approximation, not sampled caller values:
+
+| Source site | Non-null query shapes |
+| --- | ---: |
+| non-name format | 8 |
+| initial descending seek | 18 |
+| marker peek | 90 |
+| record batch | 36 |
+
+It includes unreachable combinations such as name sorting in the non-name arm.
+Extra combinations increase the refusal surface; they are not runtime coverage.
+The nullable peek alternative supplies no executable SQL; a positive PostgreSQL
+control verifies the `22004` refusal for a null `EXECUTE` argument.
+
+All 152 dynamic shapes, all 13 static SELECTs and 176 scalar expressions become
+341 temporary parser views. The expressions include declarations, assignments,
+conditions, CASE selectors, exit conditions, USING arguments, RAISE arguments
+and the SQL-constructor expressions themselves. Bound data is replaced with
+typed null expressions derived from the native argument catalog and declarations.
+No parser view is queried. Every discovered `v_current` field is checked against
+all 36 parsed batch descriptors and the reviewed object-column types/modifiers/
+collations, so the record type used for overload resolution is proved positively.
+
+## Catalog and effect closure
+
+The guard first requires the existing native timestamp/target/dispatch proof,
+the exact search declaration/security, and a resolution census over every
+overload and shadow of the discovered callable names. It then parses the frozen
+inventory. A changed upstream source requires a new reviewed inventory; no CI
+failure automatically refreshes a hash or reference.
+
+Executable OIDs come from `pg_depend` and stored parser nodes because pinned
+built-ins are deliberately absent from `pg_depend`. Function support/dependency
+and catalog-derived aggregate callback edges recurse. The current search graph
+has no aggregate; adding one requires an explicit disposition. Every reached
+non-helper executable is a reviewed PostgreSQL C/internal primitive. The only
+SQL helper is the exact prefix helper, whose body/effects are provided by the
+separately reviewed timestamp proof. New callbacks or metadata drift name
+themselves and close exact-OID admission.
+
+The finite primitive effect review is separate from the namespace restriction
+used when generating references. The 31 reached primitive identities comprise
+text/array slicing, formatting, normalization and comparison; integer arithmetic/
+comparison/conversion; timestamp comparisons; the ILIKE planner-support callback;
+and the target's `now`/UUID defaults. None is classified as pure merely because it
+is in pg_catalog. The defaults do not execute during SELECT; including their
+dependencies is conservative. Generic formatting/array operations also require
+the registered type/output dispatch proof. A new reached PostgreSQL primitive
+still requires a fresh effect review, not just a regenerated declaration hash.
+
+The existing conversion proof supplies registered type/operator/cast/range/
+operator-family/text-search/language/access-method dispatch. The peer target
+proof binds objects columns, defaults, generated expressions, constraints,
+indexes, ownership, ACL and schema security, and refuses policies, rewrite rules
+and inheritance. Collations are also bound. These are dependency checks, not a
+schema/owner/extension/volatility exemption. An omission of the peer check is
+causally tested against a real changed SELECT policy.
+
+Source/library/security fields are compared with the native catalog. Additional
+full declarations collected from the owned image remain conditional on equality
+in live native CI. Metadata hashes do not attest C binaries or arbitrary
+privileged SQL.
+
+## Executed witnesses
+
+Native behavior has 42 assertions over own rows: name/date ordering, offsets,
+prefixes, search data, versions, delete markers, exact leaf/folder fields and
+service/authenticated role behavior. These are representative native witnesses,
+not a claim that every Storage feature or query combination ran. The native
+profile has 18 assertions; the injected-overload control has four. Absent-native
+branches get real absence/no-admission assertions and zero native-call credit.
+
+The counted runtime, guard and extra ledgers contain 66 complete phases and
+1,504 pgTAP assertions with 25 planned red observations. A separate whole-class
+opaque control has real outer exits 0/1/0 and 59 emitted assertions per phase:
+an unrelated opaque RPC remains named and rejected. Those three phases add 177
+inner assertions; expected red inner failures are not suite passes.
+
+The source-inventory compiler has 11 named unit tests. Nineteen baseline/red/
+restored phases execute 209 unit tests and nine named assertion-failure phases.
+Unit-test counts are not pgTAP assertion counts or distinct mutation-family credit.
+The helper glob already includes these unit tests in the after-migration gate
+and CI. No test-list or workflow weakening was added.
+
+Mutants cover source offsets, field projection, version/marker filtering, search
+input, sort direction, definer/RLS behavior, DML effects, target/catalog drift,
+support edges, peer dependencies, record types, inventory omissions and overloads.
+Installed definitions/catalogs are retained before assertions; restored runs and
+applicable exact-definition comparisons are retained. The unrelated opaque
+control preserves the exact routine-OID correlation.
+
+A live INSERT trigger is invoked by own DML and not by native SELECT. A
+DML-performing reader mutant fails that distinction. A real policy callback
+writes its own marker during the native SELECT and remains unadmitted; removing
+that fixture write fails its causal marker assertion. STABLE alone is not purity.
+
+The first marker-filter mutation survived because its marker sorted after a
+folder boundary and was hidden by static peek. That attempt receives zero kill
+credit and is preserved. The final fixture interleaves the marker between leaves;
+the same omission then fails named assertions with all 42 emitted. Earlier
+pre-record-type repetitions and delegate observations remain separate and earn
+no additional distinct-family credit. Backend-local temporary-schema names are
+normalized only in temporary guard-function headers for source readback; bodies
+and attributes are compared in full, with raw definitions retained.
+
+All original product/runtime/isolation inputs remain unchanged. Existing core
+isolation evidence is not new native-platform race evidence. Full release and
+whole-PR review remain separate from this finite disposition.