@consiliency/agent-board-schema 1.68.0 → 1.74.0

package/tests/fixtures/agent_board_667_timestamp_graph.sql

@@ -0,0 +1,84 @@
+-- Test-only parser graph for the eight reviewed SELECT templates and the SQL
+-- folder helper. Parsing creates views; none of these views is queried. The
+-- caller must first establish the exact wrappers, dispatch and target profile.
+create temp table xb_st_views(rel oid primary key) on commit drop;
+create temp table xb_st_static(fn oid,problem text) on commit drop;
+do $graph$
+declare q record; nm text;
+begin
+  if not exists(select 1 from pg_temp.xb_st_prerequisite_problems()) then
+    for q in select identity,payload#>>'{}' as sql from pg_temp.xb_st_reference where kind='query' order by identity loop
+      nm := 'xb_st_query_'||q.identity;
+      execute format('create temp view %I as %s',nm,q.sql);
+      insert into pg_temp.xb_st_views values(to_regclass('pg_temp.'||nm));
+    end loop;
+    begin
+      insert into pg_temp.xb_st_static select d.oid::oid,null::text
+        from extensions.plpgsql_show_dependency_tb(
+          'storage.search_by_timestamp(text,text,integer,integer,text,text,text,text,text,text,text)'::regprocedure,0::oid) d
+        where d.type='FUNCTION';
+    exception when others then
+      insert into pg_temp.xb_st_static values(null,sqlstate||':'||sqlerrm);
+    end;
+  end if;
+end $graph$;
+create or replace function pg_temp.xb_st_collations() returns table(coll oid)
+language sql volatile set search_path=pg_catalog as $$
+  select distinct m[1]::oid from pg_temp.xb_st_views v join pg_rewrite r on r.ev_class=v.rel
+    cross join lateral regexp_matches(r.ev_action::text,':(?:inputcollid|collid|varcollid|constcollid|opcollid|funccollid) ([0-9]+)','g') m
+    where m[1]::oid<>0
+  union select a.attcollation from pg_attribute a where a.attrelid=to_regclass('storage.objects') and a.attcollation<>0
+  union select x from pg_index i cross join lateral unnest(i.indcollation) x where i.indrelid=to_regclass('storage.objects') and x<>0
+$$;
+create or replace function pg_temp.xb_st_roots() returns table(origin text,fn oid)
+language sql volatile set search_path=pg_catalog as $$
+  select 'query '||v.rel::regclass::text,d.refobjid from pg_temp.xb_st_views v
+    join pg_rewrite r on r.ev_class=v.rel join pg_depend d on d.classid='pg_rewrite'::regclass and d.objid=r.oid
+    where d.refclassid='pg_proc'::regclass
+  -- pg_depend intentionally omits pinned built-ins. The stored parser trees
+  -- retain their executable OIDs; enumerate those as well, including MIN.
+  union select 'query executable '||v.rel::regclass::text,m[2]::oid
+    from pg_temp.xb_st_views v join pg_rewrite r on r.ev_class=v.rel
+    cross join lateral regexp_matches(r.ev_action::text,':(funcid|aggfnoid|winfnoid|opfuncid|elemfuncid) ([0-9]+)','g') m
+    where m[2]::oid<>0
+  union select 'static callable '||m[1],p.oid from pg_proc target
+    cross join lateral regexp_matches(target.prosrc,'([a-z_][a-z_0-9]*)\s*\(','g') m
+    join pg_proc p on p.proname=m[1]
+    where target.oid=to_regprocedure('storage.search_by_timestamp(text,text,integer,integer,text,text,text,text,text,text,text)')
+      and p.prokind<>'a'
+  union select 'static reader expression',fn from pg_temp.xb_st_static where fn is not null
+  union select 'target expression',d.refobjid from pg_depend d
+    where d.refclassid='pg_proc'::regclass and (
+      d.classid='pg_attrdef'::regclass and d.objid in(select oid from pg_attrdef where adrelid=to_regclass('storage.objects'))
+      or d.classid='pg_constraint'::regclass and d.objid in(select oid from pg_constraint where conrelid=to_regclass('storage.objects'))
+      or d.classid='pg_class'::regclass and d.objid in(select indexrelid from pg_index where indrelid=to_regclass('storage.objects')))
+  union select 'target executable',m[2]::oid from (
+    select adbin::text as tree from pg_attrdef where adrelid=to_regclass('storage.objects')
+    union select conbin::text from pg_constraint where conrelid=to_regclass('storage.objects') and conbin is not null
+    union select indexprs::text from pg_index where indrelid=to_regclass('storage.objects') and indexprs is not null
+    union select indpred::text from pg_index where indrelid=to_regclass('storage.objects') and indpred is not null
+  ) e cross join lateral regexp_matches(e.tree,':(funcid|aggfnoid|winfnoid|opfuncid|elemfuncid) ([0-9]+)','g') m
+    where m[2]::oid<>0
+$$;
+-- Discover aggregate callback columns from the catalog, rather than writing a
+-- list that silently omits the next PostgreSQL callback slot.
+create or replace function pg_temp.xb_st_aggregate_slots() returns table(aggregate oid,slot text,fn oid)
+language plpgsql volatile set search_path=pg_catalog as $$
+declare a record;
+begin
+  for a in select attname from pg_attribute where attrelid='pg_aggregate'::regclass
+    and atttypid='regproc'::regtype and attnum>0 and not attisdropped loop
+    return query execute format('select g.aggfnoid::oid,%L,g.%I::oid from pg_aggregate g where g.%I::oid<>0',a.attname,a.attname,a.attname);
+  end loop;
+end $$;
+create or replace function pg_temp.xb_st_reach() returns table(fn oid)
+language sql volatile set search_path=pg_catalog as $$
+  with recursive edges(source,target) as (
+    select p.oid,p.prosupport::oid from pg_proc p where p.prosupport<>0
+    union select d.objid,d.refobjid from pg_depend d where d.classid='pg_proc'::regclass and d.refclassid='pg_proc'::regclass
+    union select aggregate,fn from pg_temp.xb_st_aggregate_slots()
+  ), reach(fn) as (
+    select fn from pg_temp.xb_st_roots()
+    union select e.target from reach r join edges e on e.source=r.fn
+  ) select fn from reach
+$$;

package/tests/fixtures/agent_board_667_timestamp_guard.sql

@@ -0,0 +1,94 @@
+-- Finite test-only effect proof for search_by_timestamp, not a Storage exemption.
+-- Requires conversion_guard and sender_guard (portable relation metadata only).
+create or replace function pg_temp.xb_st_profile(p_rel oid) returns jsonb
+language sql volatile set search_path=pg_catalog as $$
+  select jsonb_set(s,'{indexes}',(select jsonb_agg(x order by x::text collate "C")
+    from jsonb_array_elements(s->'indexes') x)) from (select pg_temp.xb_sf_profile(p_rel) s) q
+$$;
+create or replace function pg_temp.xb_st_aggregate(p_fn oid) returns jsonb
+language plpgsql volatile set search_path=pg_catalog as $$
+declare result jsonb; a record; slots jsonb := '{}';
+begin
+  select to_jsonb(g)-'aggfnoid'-'aggsortop'-'aggtranstype'-'aggmtranstype' into result
+    from pg_aggregate g where g.aggfnoid=p_fn;
+  if result is null then return null; end if;
+  for a in select attname from pg_attribute where attrelid='pg_aggregate'::regclass
+    and atttypid='regproc'::regtype and attnum>0 and not attisdropped loop
+    execute format('select to_jsonb(pg_temp.xb_cf_fn(%I::oid)) from pg_aggregate where aggfnoid=$1',a.attname)
+      into slots using p_fn;
+    result := (result-a.attname)||jsonb_build_object(a.attname,slots);
+  end loop;
+  return result||(select jsonb_build_object('sort_operator',pg_temp.xb_cf_named(g.aggsortop,'operator'),
+    'transition_type',pg_temp.xb_cf_type(g.aggtranstype),'moving_type',pg_temp.xb_cf_type(g.aggmtranstype),
+    'owner',pg_get_userbyid(p.proowner),'acl',p.proacl,'kind',p.prokind,'volatility',p.provolatile,
+    'security_definer',p.prosecdef,'settings',p.proconfig,'parallel',p.proparallel,'strict',p.proisstrict,
+    'source',p.prosrc,'library',p.probin,'cost',p.procost,'rows',p.prorows,'leakproof',p.proleakproof,
+    'result',pg_temp.xb_cf_type(p.prorettype),'arguments',pg_get_function_arguments(p.oid),
+    'support',pg_temp.xb_cf_fn(p.prosupport),'variadic',pg_temp.xb_cf_type(p.provariadic),
+    'argument_modes',p.proargmodes,'argument_names',p.proargnames)
+    from pg_aggregate g join pg_proc p on p.oid=g.aggfnoid where g.aggfnoid=p_fn);
+end $$;
+create or replace function pg_temp.xb_st_collation(p_oid oid) returns jsonb
+language sql volatile set search_path=pg_catalog as $$
+  select to_jsonb(c)-'oid'-'collnamespace'-'collowner'||jsonb_build_object(
+    'owner',pg_get_userbyid(c.collowner),'schema',n.nspname) from pg_collation c
+    join pg_namespace n on n.oid=c.collnamespace where c.oid=p_oid
+$$;
+
+\ir agent_board_667_timestamp_reference.sql
+
+create or replace function pg_temp.xb_st_prerequisite_problems() returns table(identity text,problem text)
+language sql volatile set search_path=pg_catalog as $$
+  select r.identity,'wrapper or helper declaration/security drift' from pg_temp.xb_st_reference r
+    where r.kind='wrapper' and r.payload is distinct from pg_temp.xb_cf_meta(to_regprocedure(r.identity))
+  union all select 'storage.objects','missing or unreviewed ordinary target profile'
+    where (select payload from pg_temp.xb_st_reference where kind='target') is distinct from pg_temp.xb_st_profile(to_regclass('storage.objects'))
+  union all select 'storage.objects.'||p.polname,'unreviewed SELECT policy' from pg_policy p where p.polrelid=to_regclass('storage.objects')
+  union all select 'storage.objects.'||r.rulename,'unreviewed rewrite rule' from pg_rewrite r where r.ev_class=to_regclass('storage.objects')
+  union all select i.inhrelid::regclass::text||' -> '||i.inhparent::regclass::text,'unreviewed inheritance edge'
+    from pg_inherits i where to_regclass('storage.objects') in(i.inhrelid,i.inhparent)
+  union all select 'schema storage','schema security drift' from pg_namespace n
+    where n.nspname='storage' and (select payload from pg_temp.xb_st_reference where kind='schema') is distinct from
+      jsonb_build_object('owner',pg_get_userbyid(n.nspowner),'acl',(select jsonb_agg(a::text order by a::text collate "C") from unnest(n.nspacl) a))
+  union all select identity,problem from pg_temp.xb_cf_problems()
+  -- Every overload/shadow of a called name is a resolution input. Names are
+  -- derived from the parser graph plus the static PL/pgSQL dependency parser.
+  union all select pg_temp.xb_cf_fn(p.oid),'unreviewed overload or shadow' from pg_proc p
+    where p.proname in(select payload#>>'{}' from pg_temp.xb_st_reference where kind='name')
+      and not exists(select 1 from pg_temp.xb_st_reference r where r.kind='resolution' and to_regprocedure(r.identity)=p.oid)
+  union all select r.identity,'resolution declaration/security drift' from pg_temp.xb_st_reference r
+    where r.kind='resolution' and r.payload is distinct from case when (select prokind from pg_proc where oid=to_regprocedure(r.identity))='a'
+      then pg_temp.xb_st_aggregate(to_regprocedure(r.identity)) else pg_temp.xb_cf_meta(to_regprocedure(r.identity)) end
+$$;
+
+\ir agent_board_667_timestamp_graph.sql
+
+create or replace function pg_temp.xb_st_problems() returns table(identity text,problem text)
+language sql volatile set search_path=pg_catalog as $$
+  select identity,problem from pg_temp.xb_st_prerequisite_problems()
+  union all select 'timestamp query graph','not all eight dynamic shapes and the helper were parsed'
+    where (select count(*) from pg_temp.xb_st_views)<>9
+  union all select 'timestamp static parser',problem from pg_temp.xb_st_static where problem is not null
+  union all select 'timestamp aggregate parser','timestamp MIN was not discovered'
+    where not exists(select 1 from pg_temp.xb_st_roots() r join pg_proc p on p.oid=r.fn where p.prokind='a')
+  union all select pg_temp.xb_cf_fn(g.fn),'unreviewed query/support/aggregate callback'
+    from pg_temp.xb_st_reach() g where not exists(select 1 from pg_temp.xb_st_reference r
+      where r.kind in('primitive','aggregate','wrapper') and to_regprocedure(r.identity)=g.fn)
+  union all select r.identity,'query/support callback declaration or security drift' from pg_temp.xb_st_reference r
+    where r.kind='primitive' and r.payload is distinct from pg_temp.xb_cf_meta(to_regprocedure(r.identity))
+  union all select r.identity,'aggregate dispatch drift' from pg_temp.xb_st_reference r
+    where r.kind='aggregate' and r.payload is distinct from pg_temp.xb_st_aggregate(to_regprocedure(r.identity))
+  union all select n.nspname||'.'||c.collname,'unreviewed query collation' from pg_temp.xb_st_collations() x
+    join pg_collation c on c.oid=x.coll join pg_namespace n on n.oid=c.collnamespace
+    where not exists(select 1 from pg_temp.xb_st_reference r where r.kind='collation'
+      and r.identity=format('%I.%I',n.nspname,c.collname) and r.payload=pg_temp.xb_st_collation(c.oid))
+  union all select d.refobjid::regclass::text,'unexpected query relation' from pg_temp.xb_st_views v
+    join pg_rewrite r on r.ev_class=v.rel join pg_depend d on d.classid='pg_rewrite'::regclass and d.objid=r.oid
+    where d.refclassid='pg_class'::regclass and d.refobjid not in(v.rel,to_regclass('storage.objects'))
+$$;
+create or replace function pg_temp.xb_st_admitted() returns table(fn oid)
+language sql volatile set search_path=pg_catalog as $$
+  select to_regprocedure(identity)::oid from pg_temp.xb_st_reference where kind='wrapper'
+    and identity='storage.search_by_timestamp(text,text,integer,integer,text,text,text,text,text,text,text)'
+    and not exists(select 1 from pg_temp.xb_st_problems())
+$$;

package/tests/fixtures/agent_board_667_timestamp_provenance.md

@@ -0,0 +1,99 @@
+# #667: finite Storage timestamp-reader disposition
+
+This test-only disposition covers exactly
+`storage.search_by_timestamp(text,text,integer,integer,text,text,text,text,text,text,text)`.
+It does not admit the other Storage readers or `realtime.apply_rls` and does not
+approve PR #707. No application migration or protected isolation input changes.
+
+## Source and reconstruction
+
+The input is CI run `40555288153`, job `122369607014`, protocol-2 failure catalog
+SHA256 `bd5946a94b8c7266ca186ff6a33949008418cd156c1b500786a916a7e9673156`.
+It records PostgreSQL 17.11, Storage v1.84.19 and the exact reader/helper bodies,
+owners, ACLs, relation metadata and registered dispatch. The reader definition
+MD5 is `323c4e2739e9c9bcfc082f7f14289338`; the SQL folder helper's is
+`0dc62b74fb855d4f504f50f900f93927`.
+
+The owned reconstruction used cached PostgreSQL `17.11.0.004`; CI used
+`17.11.0.006`. The retained Storage migrations were replayed with role installation
+disabled, since their bootstrap conflicts with the disposable image's existing
+role graph. The empty `storage.objects` table was then reconstructed from the
+captured column, constraint, index and trigger declarations. This removes a
+historical dropped-column slot and supplies the captured version-key index.
+These are changes to the disposable fixture only. The resulting target profile,
+reader/helper bodies and security metadata match the captured catalog. This is
+a selective reconstruction, not a claim that the entire native platform matches.
+
+`generate-667-timestamp-reference.mjs` validates retained native, owned-collection
+and query-expansion JSON inputs. It has only manual `--check` and `--output`
+modes; it never connects to a database or refreshes a CI failure automatically.
+The collector uses the fixture's metadata/parser helpers and retains complete
+declarations, callback metadata, parser roots and security records. The generator
+checks every observed primitive against native source/library/security fields;
+full declarations and additional aggregate fields collected from the owned
+build must still match live native CI. A declaration hash is not binary attestation.
+
+## Effect boundary
+
+The reviewed body has one dynamic SELECT template. Its two sort columns, two
+directions and two version expressions produce eight query shapes. Caller
+values remain bound parameters. The generator derives all eight expansions
+directly from the captured body, replaces parameters with typed constants and
+checks that the supplied expansions are identical. A ninth parser view contains
+the exact SQL folder-helper expression. Views are parsed, never queried.
+
+Before parsing, the guard checks both wrappers, the ordinary heap target,
+schema security, the existing conversion-dispatch proof, and every overload or
+shadow of the discovered callable names. New policies, rules or inheritance
+edges refuse admission. Relation profiles retain columns, defaults, generated
+expressions, constraints, ACLs and indexes, with index records sorted by content.
+
+`pg_depend` omits pinned built-ins. Therefore the executable OIDs in the stored
+PostgreSQL 17 parser trees are inspected as well. This is deliberately a parser
+for these exact templates, not arbitrary SQL. Roots also include stored target
+expressions, the static dependency parser and a conservative callable-name census
+of the bound reader body. That census may include harmless matches in comments;
+it cannot exempt a new overload. Support and function-dependency edges are
+followed recursively. SQL helper effects are parsed separately; every reached
+non-helper executable must be a reviewed PostgreSQL C/internal primitive.
+
+Aggregate callback columns come from `pg_attribute`, not a callback allowlist.
+Timestamp MIN's transition/combine functions, aggregate flags, sort operator and
+types are bound. Query and target collations are discovered and bound as well.
+The pre-existing conversion guard supplies the type/operator/cast/range/operator
+family/text-search/language/access-method dispatch boundary.
+
+DML triggers are not SELECT callbacks. A positive control installs a live
+INSERT trigger: native SELECT leaves its marker untouched; an own INSERT invokes
+it. A DML-performing reader mutant fails the no-callback assertion. This is not
+an exemption for SELECT policies or rewrite rules.
+
+## Executed scope and limits
+
+Native behavior emits 19 assertions; the native profile emits 15. The independent
+overload control emits four even on a minimal substrate. Absent-native branches
+emit a real absence/no-admission assertion and receive no native credit.
+
+The retained parent ledgers contain 80 complete phases, 974 assertions and 33
+planned red observations. These are repeated/scoped observations, not 33 distinct
+mutation families. Physical catalog changes and detection-arm omissions were
+tested separately. Source mutations have installed-definition readbacks;
+catalog-state mutations retain the changed catalogs. Restored runs check the
+reviewed profiles and applicable exact function definitions.
+
+Tests exercise filtering, projection, cursor/limit, literal prefixes, default and
+inclusive version modes, service-role reads and authenticated empty-policy reads.
+The folder fixture has two timestamps, so replacing MIN with MAX fails its
+specific assertion. An owned policy callback actually writes its marker during
+the native SELECT, and the policy remains unadmitted.
+
+Unaccepted attempts remain retained: the initial filter mutation aborted a
+single-row assertion (now replaced by aggregate state comparison); one concurrent
+proof restoration deadlocked (completed serially); and changing a pinned built-in
+declaration did not change its builtin-OID runtime dispatch. The latter receives
+no primitive-behavior kill credit. Its metadata drift was caught separately, and
+a real reader-expression mutation pins the affected result field. No test claims
+to mutate PostgreSQL's C binary or prove arbitrary privileged SQL safe.
+
+These tests do not establish whole-PR acceptance, fresh native-platform equality,
+new isolation credit, or the effects of the three still-unresolved routines.