@everystack/cli 0.4.44 → 0.4.46

package/src/cli/authz-ownership.ts

@@ -0,0 +1,193 @@
+/**
+ * Table OWNERSHIP — reported, never compared.
+ *
+ * A table's owner bypasses its own RLS policies unless the table is FORCEd. So the
+ * pair (owner, FORCE) decides whether the policies this repo argues about are actually
+ * in force for the principal that writes. Neither half is visible in the contract:
+ * `GRANTS_SQL` deliberately EXCLUDES the owner's self-grant because the owner is
+ * environment-specific (the dev user locally, the master/operator role when deployed),
+ * and committing it would make the contract non-portable and drift on every stage.
+ *
+ * That exclusion is right, and it is exactly why this module exists. The owner is a
+ * fact about the DEPLOYED database that no committed artifact can carry, so the only
+ * honest treatment is to NAME it on every surface that can see a live database, and
+ * let the human read it. Locally it is the dev user and nothing fires; on the stage it
+ * is somebody else, and that difference is the whole point.
+ *
+ * **The owner is NOT part of the contract.** It does not enter `TableContract`, it does
+ * not enter `canonicalAuthz`, and it therefore does not touch the fingerprint. Putting
+ * an environment-specific field into the content address would make the same declared
+ * state hash differently per stage — and adding any field to the canonical form is a
+ * FORMAT BUMP, which this does not need: it needs to be reported, not equated.
+ *
+ * Search_path: this query deparses nothing (`pg_get_expr` is not involved) — it reads
+ * catalog names directly — so it needs no canonical-path pinning to be stable.
+ */
+
+import type { WrittenBy, ModelDescriptor } from '@everystack/model';
+import { IGNORED_SCHEMAS, type QueryRunner, type AuthzContract } from './authz-contract.js';
+
+/**
+ * Every base table with its owner. The exclusions are RLS_SQL's, verbatim — base
+ * relations only, no `pg_catalog` / `information_schema` / `pg_%`, no extension-owned
+ * objects — so the two queries agree about which tables exist and the report can be
+ * joined onto the contract without either side inventing a table the other cannot see.
+ */
+export const TABLE_OWNERS_SQL = `
+SELECT
+  n.nspname AS schema,
+  c.relname AS "table",
+  r.rolname AS owner
+FROM pg_class c
+JOIN pg_namespace n ON n.oid = c.relnamespace
+JOIN pg_roles r ON r.oid = c.relowner
+WHERE c.relkind = 'r'
+  AND n.nspname NOT IN ('pg_catalog', 'information_schema')
+  AND n.nspname NOT LIKE 'pg_%'
+  AND NOT EXISTS (
+    SELECT 1 FROM pg_depend d
+    WHERE d.objid = c.oid AND d.deptype = 'e'
+  )
+ORDER BY n.nspname, c.relname;
+`.trim();
+
+export interface TableOwnerRow {
+  schema: string;
+  table: string;
+  owner: unknown;
+}
+
+/** One live table's owner, keyed by the same schema-qualified identity the contract uses. */
+export interface TableOwner {
+  /** Schema-qualified table, e.g. `public.posts`. */
+  table: string;
+  /** The role that owns it. */
+  owner: string;
+}
+
+/**
+ * Fold owner rows into the reportable set. Tooling schemas are dropped here rather than
+ * in SQL, matching `assembleContract` — one definition of "not the app's", applied the
+ * same way on both sides.
+ */
+export function assembleOwners(rows: TableOwnerRow[]): TableOwner[] {
+  return rows
+    .filter((row) => !IGNORED_SCHEMAS.has(row.schema))
+    .map((row) => ({ table: `${row.schema}.${row.table}`, owner: String(row.owner ?? '') }))
+    .sort((a, b) => a.table.localeCompare(b.table));
+}
+
+/** Read the live table owners. Read-only, one query, no canonical-path pinning needed. */
+export async function introspectTableOwners(run: QueryRunner): Promise<TableOwner[]> {
+  return assembleOwners((await run(TABLE_OWNERS_SQL)) as TableOwnerRow[]);
+}
+
+/** One governed table's ownership posture, with the model's own intent beside it. */
+export interface OwnershipRow {
+  /** Schema-qualified table. */
+  table: string;
+  /** The live owner, or null when the ownership query did not return this table. */
+  owner: string | null;
+  /** Live `relforcerowsecurity` — whether the owner is subject to its own policies. */
+  forced: boolean;
+  /** The model's declared write principal, or null when there is no model (db:pull). */
+  writtenBy: WrittenBy | null;
+  /** The owner writes past every policy on this table, and the model did not ask for that. */
+  flagged: boolean;
+}
+
+/**
+ * Build the ownership report for the tables the models govern.
+ *
+ * The flag rule follows the FORCE axiom the compiler already encodes: FORCE iff the
+ * write principal is subject to its own policies.
+ *
+ *   - `writtenBy: 'app'` + FORCE off  -> FLAGGED. The app writes through the owner
+ *     connection past policies the model believes are enforcing. A silent bypass.
+ *   - `writtenBy: 'worker' | 'functions'` + FORCE off -> reported, NOT flagged. These
+ *     write on the owner connection on purpose; a FORCEd table would block them (on RDS
+ *     the owner is not a superuser). Correct, and still named.
+ *   - FORCE on -> reported, not flagged, whatever the principal.
+ *
+ * Without models (`db:pull`, where the models do not exist yet) `writtenBy` is null and
+ * NOTHING is flagged: the intent that would make a bypass wrong has not been declared.
+ * The owner is still named — that half is a live fact the pull genuinely saw.
+ */
+export function buildOwnershipReport(
+  owners: readonly TableOwner[],
+  live: AuthzContract,
+  opts: { models?: readonly ModelDescriptor[]; tables?: readonly string[] } = {},
+): OwnershipRow[] {
+  const ownerByTable = new Map(owners.map((o) => [o.table, o.owner]));
+  const liveByTable = new Map(live.tables.map((t) => [t.table, t]));
+
+  // Governed = the tables the models declare when there are models; else the caller's
+  // explicit subject list (the pull's schema-scoped tables); else every live table.
+  const subjects: { table: string; writtenBy: WrittenBy | null }[] = opts.models
+    ? opts.models.map((m) => ({ table: `${m.schema}.${m.table}`, writtenBy: m.writtenBy }))
+    : (opts.tables ?? live.tables.map((t) => t.table)).map((table) => ({ table, writtenBy: null }));
+
+  const rows: OwnershipRow[] = [];
+  for (const s of subjects) {
+    const l = liveByTable.get(s.table);
+    // A model with no live table is a CREATE — it has no owner yet, and nothing to report.
+    if (!l) continue;
+    const forced = l.rls.forced;
+    rows.push({
+      table: s.table,
+      owner: ownerByTable.get(s.table) ?? null,
+      forced,
+      writtenBy: s.writtenBy,
+      flagged: s.writtenBy === 'app' && !forced,
+    });
+  }
+  return rows.sort((a, b) => a.table.localeCompare(b.table));
+}
+
+/**
+ * Render the report. Grouped by owner, because one operator role usually owns the whole
+ * schema and thirty-three identical lines would bury the findings — the same reason
+ * `db:pull` says "grants exist for X" once instead of repeating it in every model.
+ *
+ * When ONE owner owns everything, that is a single line naming it. When there is more
+ * than one, every owner is named WITH its tables: a split ownership is itself the
+ * anomaly, and a count alone would not say which table changed hands.
+ */
+export function renderOwnershipReport(rows: readonly OwnershipRow[]): string[] {
+  if (rows.length === 0) return [];
+
+  const byOwner = new Map<string, OwnershipRow[]>();
+  for (const r of rows) {
+    const key = r.owner ?? '(not returned by the ownership query)';
+    let group = byOwner.get(key);
+    if (!group) byOwner.set(key, (group = []));
+    group.push(r);
+  }
+  const owners = [...byOwner.keys()].sort();
+
+  const lines = [
+    `Ownership of ${rows.length} governed table(s) — the owner bypasses RLS unless the table is FORCEd:`,
+  ];
+  for (const owner of owners) {
+    const group = byOwner.get(owner)!;
+    const forced = group.filter((r) => r.forced).length;
+    const notForced = group.length - forced;
+    const tail = notForced > 0 ? `, ${notForced} NOT forced` : '';
+    lines.push(`  ${owner} — ${group.length} table(s): ${forced} FORCE on${tail}`);
+    if (owners.length > 1) {
+      for (const r of group) lines.push(`      ${r.table}${r.forced ? '' : ' (not forced)'}`);
+    }
+  }
+
+  const flagged = rows.filter((r) => r.flagged);
+  for (const r of flagged) {
+    lines.push(
+      `  ! ${r.table} — written by the app but NOT FORCEd: owner ${r.owner ?? '(unknown)'} writes past every policy on this table.`,
+    );
+  }
+  const unknown = rows.filter((r) => r.owner === null);
+  for (const r of unknown) {
+    lines.push(`  ? ${r.table} — the ownership query did not return this table; its owner is unknown.`);
+  }
+  return lines;
+}

package/src/cli/authz-reconcile.ts

@@ -16,7 +16,8 @@
  */
 
 import type { AuthzContract, TableContract, PolicyContract } from './authz-contract.js';
-import { effectivePolicyCheck, parenthesizeOnce } from './authz-contract.js';
+import { effectivePolicyCheck, parenthesizeOnce, isPolicyDead, isPolicySubsumed } from './authz-contract.js';
+import { matchPolicies } from './authz-identity.js';
 import { quoteQualified } from './pg-ident.js';
 
 /**
@@ -135,20 +136,9 @@ function policyDropSql(table: string, name: string): string {
   return `DROP POLICY IF EXISTS ${name} ON ${table};`;
 }
 
-/**
- * Two policies are the same authorization when every diffed field matches. The check is
- * compared through {@link effectivePolicyCheck}, i.e. the server's own defaulting rule —
- * a live `FOR ALL USING (true)` and a compiled `FOR ALL USING (true) WITH CHECK (true)`
- * authorize identically, and reconciling them would emit a DROP + CREATE that changes
- * nothing.
- */
-function policiesEqual(a: PolicyContract, b: PolicyContract): boolean {
-  return a.command === b.command
-    && a.permissive === b.permissive
-    && a.roles.join(',') === b.roles.join(',')
-    && (a.using ?? '') === (b.using ?? '')
-    && (effectivePolicyCheck(a) ?? '') === (effectivePolicyCheck(b) ?? '');
-}
+// Policy equality lives in authz-identity.ts and nowhere else. The copy that used to sit here
+// compared roles as `roles.join(',')`, which made `['a,b']` equal `['a','b']` — a false match
+// on a legal role name. Two implementations of one predicate is how these surfaces drift.
 
 function tableMap(c: AuthzContract): Map<string, TableContract> {
   return new Map(c.tables.map((t) => [t.table, t]));
@@ -179,7 +169,7 @@ export function emitReconcileSql(
     // the EMITTED SQL must quote it, or a reserved table name (`public.user`) is a syntax error.
     const table = quoteQualified(d.table);
     reconcileRls(table, d, l, sql);
-    reconcilePolicies(table, d, l, sql);
+    reconcilePolicies(table, d, l, sql, governed);
     reconcileGrants(table, d, l, sql, governed);
     reconcileColumnGrants(table, d, l, sql, governed);
   }
@@ -229,19 +219,63 @@ function reconcileRls(table: string, d: TableContract, l: TableContract | undefi
   if (!d.rls.forced && l?.rls.forced) out.push(`ALTER TABLE ${table} NO FORCE ROW LEVEL SECURITY;`);
 }
 
-function reconcilePolicies(table: string, d: TableContract, l: TableContract | undefined, out: string[]): void {
-  const dMap = new Map(d.policies.map((p) => [p.name, p]));
-  const lMap = new Map((l?.policies ?? []).map((p) => [p.name, p]));
+/**
+ * Reconcile policies through the SHARED matcher — the same equivalence the differ and the
+ * fingerprint use, so the three can never contradict each other about one database.
+ *
+ * A live policy carrying the declared authorization under a different name, or covering in one
+ * policy the roles the compiler splits apart, is ADOPTED: it stays exactly as it is and
+ * nothing is emitted. Renaming it would be DDL that buys spelling.
+ *
+ * The matcher requires full field equality, so this can only turn a DROP + CREATE pair into a
+ * no-op — never emit DDL the name-keyed version would not have emitted.
+ */
+function reconcilePolicies(table: string, d: TableContract, l: TableContract | undefined, out: string[], governed: ReadonlySet<string>): void {
+  const live = l?.policies ?? [];
+  const m = matchPolicies(d.policies, live);
+  const byName = new Map(live.map((p) => [p.name, p]));
 
-  // Drops first: policies removed, or changed (dropped then recreated below).
-  for (const [name, lp] of lMap) {
-    const dp = dMap.get(name);
-    if (!dp || !policiesEqual(dp, lp)) out.push(policyDropSql(table, name));
+  // Drops first, so a replaced policy never briefly co-exists with its old form.
+  for (const name of m.toDrop) {
+    // A live policy scoped ENTIRELY to roles the models do not govern is left alone, exactly
+    // as reconcileGrants leaves that role's privileges alone. Without this the two lanes
+    // disagree about the same role: it keeps its GRANT and loses its POLICY, and on an
+    // RLS-enabled table that combination reads zero rows. A bounded read-only role added for
+    // one indexable query is the shape this bites — the model has no word for it, so "no
+    // declaration" and "no access" collapsed into the same thing. Same failure as the
+    // ungoverned-grantee bug, one lane over.
+    //
+    // Only when EVERY role is ungoverned. A policy naming anon alongside such a role still
+    // governs anon, and leaving it would be the reconciler declining to do its job.
+    const p = byName.get(name);
+    if (p && p.roles.length > 0 && p.roles.every((r) => !isGoverned(governed, r))) continue;
+    // A DEAD policy authorizes nothing — no role it names holds the privilege it polices, so
+    // Postgres refuses at the GRANT before ever consulting it. Dropping it changes no access,
+    // which makes it churn: a statement an adopter must read, approve and apply to reach zero,
+    // whose only effect is to tidy a catalog. Leave it, exactly as the canonical form leaves
+    // it out of the state.
+    //
+    // DEAD BEFORE **AND AFTER**, and the second half is the whole safety of this. Deadness is
+    // a property of the contract, not the policy: if THIS plan grants the privilege the policy
+    // polices, the policy wakes up the moment the plan lands — undeclared, ungoverned, and
+    // granting access the model never asked for. Leaving it would be a widening the plan
+    // performs on itself. So it may only be left alone when the DECLARED state keeps it just
+    // as inert as the live one does.
+    if (p && l && isPolicyDead(l, p) && isPolicyDead(d, p)) continue;
+    // Subsumed, before AND after, for exactly the reason deadness needs both: if this plan
+    // drops the PUBLIC policy that was covering it, the role-scoped one stops being redundant
+    // the moment the plan lands — and leaving it would keep access the model never declared.
+    if (p && l && isPolicySubsumed(l, p) && isPolicySubsumed(d, p)) continue;
+    out.push(policyDropSql(table, name));
   }
-  // Creates: policies added, or changed (recreated to the declared form).
-  for (const [name, dp] of dMap) {
-    const lp = lMap.get(name);
-    if (!lp || !policiesEqual(dp, lp)) out.push(policyCreateSql(table, dp));
+  // Symmetric with the drop rule above, and required by the same identity: a DECLARED policy
+  // the declared grants do not back is inert — it would authorize nothing the moment it
+  // landed. The canonical form already leaves it out of the declared state, so creating it
+  // would emit a statement for a difference the hash says does not exist. It appears the
+  // moment the model grants the privilege it polices.
+  for (const p of m.toCreate) {
+    if (isPolicyDead(d, p) || isPolicySubsumed(d, p)) continue;
+    out.push(policyCreateSql(table, p));
   }
 }
 

package/src/cli/aws.ts

@@ -7,6 +7,7 @@
 
 import { isOpsHandlerCrash, formatOpsCrashReport, fetchDiagnosisWithRetry } from './ops-diagnostics.js';
 import { tagInvokeTransport } from './ops-advice.js';
+import type { SessionRunner } from './session.js';
 
 let s3Client: InstanceType<typeof import('@aws-sdk/client-s3').S3Client> | null = null;
 let lambdaClient: InstanceType<typeof import('@aws-sdk/client-lambda').LambdaClient> | null = null;
@@ -302,6 +303,37 @@ export function lambdaQueryRunner(
   };
 }
 
+/**
+ * A `SessionRunner` backed by the ops Lambda's `db:session` action — the stage lane's
+ * only consistent read.
+ *
+ * `lambdaQueryRunner` above sends one invoke per statement, so a multi-statement read is
+ * answered by however many containers happen to be warm, each on its own connection.
+ * This sends the statements TOGETHER: one invoke, one container, one connection, one
+ * transaction. The response arrives gzipped (catalog JSON compresses 10-20x, which is
+ * what keeps a real schema inside the 6 MB invoke-response limit).
+ */
+export function lambdaSessionRunner(
+  region: string,
+  functionName: string,
+  invoke: typeof invokeAction = invokeAction,
+): SessionRunner {
+  return async (statements, opts) => {
+    const result: any = await invoke(region, functionName, 'db:session', {
+      statements,
+      ...(opts ?? {}),
+    });
+    if (result?.error) throw new Error(`Session failed: ${result.error}`);
+    if (typeof result?.gzip !== 'string') {
+      throw new Error(
+        'the ops Lambda did not answer db:session. Deploy a server build that ships the db:session action — the stage lane cannot read consistently without it.',
+      );
+    }
+    const { gunzipSync } = await import('node:zlib');
+    return JSON.parse(gunzipSync(Buffer.from(result.gzip, 'base64')).toString('utf8'));
+  };
+}
+
 export async function invokeAction(
   region: string,
   functionName: string,

package/src/cli/commands/db-apply.ts

@@ -18,14 +18,19 @@
  *      is exact even on brownfield targets (mint predicted it with the
  *      unmodeled tables merged in). A mismatch here is a real fault, loud.
  *
- * Needs a direct connection (--database-url / DATABASE_URL): apply writes.
+ * Two lanes. DIRECT (--database-url / --stage --direct) executes CLI-side over
+ * one session. STAGE (--stage) executes credential-free in the ops Lambda —
+ * and reads over `lambdaQueryRunner`, one Lambda invoke per catalog query, so a
+ * single introspection can be assembled from several containers holding
+ * connections to different databases. That lane therefore reads the stage TWICE
+ * and refuses a disagreement, reports agreement as a non-detection (it cannot
+ * verify read consistency), and refuses a DESTRUCTIVE plan outright — losing
+ * data on a read that cannot be verified is not a trade the ceremony can buy.
+ * See stage-read-consistency.ts.
  */
 
 import fs from 'node:fs/promises';
 import { type QueryRunner } from '../authz-contract.js';
-import { introspectSchema } from '../schema-introspect.js';
-import { introspectContract } from '../authz-contract.js';
-import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog.js';
 import { currentGitRef } from '../state-apply.js';
 import { planHash, PLAN_VERSION, type EdgePlan } from '../edge-plan.js';
 import { verifyDescent, type DescentVerdict, type LiveState } from '../git-descent.js';
@@ -37,12 +42,14 @@ import { compileTableContract } from '../authz-compile.js';
 import { governedRoleSet, ungovernedGrants } from '../authz-reconcile.js';
 import { readBaselineFile, checkAgainstBaseline, baselineRefusal } from '../authz-baseline.js';
 import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source.js';
+import { borrowedSessionRunner, type SessionRunner } from '../session.js';
 import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction, lambdaQueryRunner } from '../aws.js';
+import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws.js';
 import { executeApplyPlan, type ApplyPlanResult } from '../apply-execute.js';
 import { estimateOpsRuntimeFit } from '../ops-fit.js';
 import { resolveOperatorUrlViaStage } from '../direct-venue.js';
 import { withMutationLease, MutationLeaseError } from '../mutation-lease.js';
+import { readStageStateTwice, stageDestructiveRefusal } from '../stage-read-consistency.js';
 import { step, success, fail, info, warn } from '../output.js';
 
 // The apply core lives in apply-execute.ts (shared with the ops Lambda's
@@ -128,20 +135,34 @@ async function applyPlanViaStage(
 
   info(`plan ${planHash(plan).slice(0, 12)}: ${plan.fromFingerprint.slice(0, 12)} → ${plan.toFingerprint.slice(0, 12)} (${plan.executable} statement(s)${plan.destructive ? `, ${plan.destructive} destructive` : ''})`);
 
+  // THE STAGE LANE'S READ GUARD, before anything is dispatched. Each introspection is
+  // one session, but a full read is two of them (state, then authz) and they can be
+  // answered by two containers at two moments. Read the stage twice and refuse a
+  // disagreement — the apply never starts. Deliberately OUTSIDE the try below: this
+  // refusal must exit as itself, not as "Apply failed".
+  step('Reading the stage TWICE (state and authz are separate ops-Lambda invokes)...');
+  const readSession = lambdaSessionRunner(region, fn);
+  const readPair = await readStageStateTwice(readSession).catch((err: any) => {
+    fail(`Apply failed: could not read the stage — ${err.message}`);
+    process.exit(1);
+  });
+  if (!readPair.ok) {
+    fail(readPair.reason);
+    process.exit(1);
+  }
+  warn(readPair.warning);
+
   try {
     // Descent — the fast-forward rule needs the git checkout, so the CLI
-    // decides it (the Lambda has no checkout). Read the stage's state read-only
-    // via the ops Lambda's db:query action, run the rule locally, and hand the
-    // verdict to the write action, which enforces + records it in order.
+    // decides it (the Lambda has no checkout). It runs against the state the
+    // double read already produced (no third trip), and the verdict goes to the
+    // write action, which enforces + records it in order.
     let descentVerdict: { ok: true } | { ok: false; reason: string };
     if (forceDescent !== undefined) {
       warn(`DESCENT FORCED — the fast-forward rule is bypassed for this apply. Snapshot on record: ${forceDescent}.`);
       descentVerdict = { ok: true };
     } else {
-      step('Asking the stage its state (read-only via the ops Lambda)...');
-      const readRunner = lambdaQueryRunner(region, fn);
-      const snapshot = await introspectSchema(readRunner);
-      const contract = await introspectContract(readRunner, contractFunctionRow, FUNCTIONS_SQL);
+      const { snapshot, contract } = readPair.state;
       step("Descent: searching git for the commit that declares the stage's state...");
       const verdict = await verifyDescent(resolveModelsPath(flags.models), { snapshot, contract }, {});
       switch (verdict.status) {
@@ -166,6 +187,11 @@ async function applyPlanViaStage(
     // and checks it against the stage's declared approver set (SSM). The safety
     // net is a VERIFIED backup: the Lambda auto-resolves the stage's newest (or
     // the id in --snapshot-ref) and refuses unless it covers this plan. --confirm always.
+    //
+    // CURRENTLY UNREACHABLE: dbApplyCommand refuses every destructive plan on the
+    // stage lane before it gets here (read consistency cannot be guaranteed on this
+    // lane). Kept intact and second in line, so lifting that refusal restores the
+    // full ceremony rather than silently shipping without one.
     let authorityVerdict: AuthorityVerdict | undefined;
     if (plan.destructive > 0) {
       const shape = `${plan.classification.drops} drop(s), ${plan.classification.narrowings} narrowing type change(s)`;
@@ -272,6 +298,16 @@ export async function dbApplyCommand(flags: Record<string, string>): Promise<voi
   // Deployed stage, no direct URL: the write runs in the ops Lambda — the
   // operator never holds a database URL. --database-url stays local-only.
   if (dbSource.kind === 'stage') {
+    // A DESTRUCTIVE plan does not run on this lane at all — no ceremony lifts it.
+    // The stage lane's fingerprint (the concurrency lock) can be assembled from
+    // several ops-Lambda containers, and the double read below only DETECTS that;
+    // it cannot rule it out. Dropping data on a read that may be a collage is the
+    // one trade never worth making, so the destructive path is the direct lane's.
+    if (plan.destructive > 0) {
+      const shape = `${plan.classification.drops} drop(s), ${plan.classification.narrowings} narrowing type change(s)`;
+      fail(stageDestructiveRefusal(shape, planPath, flags.stage));
+      process.exit(1);
+    }
     // Will this edge fit the ops-Lambda's 900-second clock? If not, refuse up front and
     // name --direct (credential-free, unbounded) instead of burning 15 minutes to learn it.
     const fit = estimateOpsRuntimeFit(plan);
@@ -328,7 +364,7 @@ export async function dbApplyCommand(flags: Record<string, string>): Promise<voi
   }
 
   step(connectingVia(dbSource));
-  const { runner, end } = await createUrlRunner(dbSource.url);
+  const { runner, session, end } = await createUrlRunner(dbSource.url);
 
   try {
     info(`plan ${planHash(plan).slice(0, 12)}: ${plan.fromFingerprint.slice(0, 12)} → ${plan.toFingerprint.slice(0, 12)} (${plan.executable} statement(s)${plan.destructive ? `, ${plan.destructive} destructive` : ''})`);
@@ -342,7 +378,7 @@ export async function dbApplyCommand(flags: Record<string, string>): Promise<voi
     const result = await withMutationLease(
       runner,
       { verb: 'db:apply', actor: process.env.USER ?? 'unknown' },
-      () => executeApplyPlan(runner, plan, {
+      () => executeApplyPlan(runner, session, plan, {
       actor: process.env.USER ?? null,
       gitRef: currentGitRef() ?? plan.gitRef,
       ...(verifyAuthority ? { verifyAuthority } : {}),
@@ -371,6 +407,16 @@ export async function dbApplyCommand(flags: Record<string, string>): Promise<voi
               info('descent: fresh target (no tables) — nothing to protect, bootstrapping.');
               return { ok: true };
             case 'no-git':
+              // A DESTRUCTIVE plan may not ride an accidental waiver: the fast-forward
+              // rule's verdict must never depend on which directory the operator ran
+              // from. Unverifiable + destructive ⇒ the waiver must be the deliberate
+              // ceremony (--force-descent <snapshot-ref> --confirm), not a warning.
+              if (plan.destructive > 0) {
+                return {
+                  ok: false,
+                  reason: 'descent: not a git checkout, and this plan is DESTRUCTIVE — the fast-forward rule cannot be verified here, so waive it deliberately: re-run with --force-descent <snapshot-ref> --confirm.',
+                };
+              }
               warn('descent: not a git checkout — the fast-forward rule cannot be verified here.');
               return { ok: true };
             case 'diverged':

package/src/cli/commands/db-authz.ts

@@ -57,22 +57,14 @@ import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog.js';
 import { resolveConfig, opsFunction } from '../config.js';
 import { resolveModelsPath } from '../models-path.js';
 import { resolveDbSource, connectingVia, createUrlProbeRunner } from '../db-source.js';
-import { invokeAction } from '../aws.js';
+import { borrowedSessionRunner, type SessionRunner } from '../session.js';
+import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws.js';
 import { step, success, fail, info, warn } from '../output.js';
 import { opsAdviceLines, IAM_ADVICE } from '../ops-advice.js';
 import { loadModels } from './db-generate.js';
 
 const DEFAULT_DIR = 'authz';
 
-/** A QueryRunner backed by the ops Lambda `db:query` action (read-only). */
-function lambdaRunner(region: string, fn: string): QueryRunner {
-  return async (sql: string) => {
-    const result: any = await invokeAction(region, fn, 'db:query', { sql });
-    if (result?.error) throw new Error(`Introspection query failed: ${result.error}`);
-    return result?.rows ?? [];
-  };
-}
-
 /**
  * Where an authz command runs. Both venues expose the same two capabilities, so the
  * commands never branch on venue after this point — that is what keeps the local
@@ -81,6 +73,8 @@ function lambdaRunner(region: string, fn: string): QueryRunner {
 interface AuthzVenue {
   /** Read-only introspection. */
   runner: QueryRunner;
+  /** The consistent multi-statement read — what every introspection takes. */
+  session: SessionRunner;
   /** Self-reverting red-team probe (writes, always rolled back). */
   probe: (setup: string, read: string) => Promise<any[]>;
   /** Human-readable venue, printed with every verdict. */
@@ -97,15 +91,16 @@ async function resolveVenue(flags: Record<string, string>): Promise<AuthzVenue>
   const source = resolveDbSource(flags);
   if (source.kind === 'url') {
     step(connectingVia(source));
-    const { runner, probe, end } = await createUrlProbeRunner(source.url);
-    return { runner, probe, end, label: 'direct connection' };
+    const { runner, session, probe, end } = await createUrlProbeRunner(source.url);
+    return { runner, session, probe, end, label: 'direct connection' };
   }
   step('Resolving deployed config...');
   const config = await resolveConfig(flags.stage);
   const fn = opsFunction(config);
   info(`Region: ${config.region}, Function: ${fn}`);
   return {
-    runner: lambdaRunner(config.region, fn),
+    runner: lambdaQueryRunner(config.region, fn),
+    session: lambdaSessionRunner(config.region, fn),
     probe: async (setup: string, read: string) => {
       const result: any = await invokeAction(config.region, fn, 'db:authz:probe', { setup, read });
       if (result?.error) throw new Error(result.error);
@@ -120,7 +115,7 @@ async function introspectVenue(flags: Record<string, string>): Promise<{ contrac
   const venue = await resolveVenue(flags);
   try {
     step('Introspecting authorization (rls + grants + policies + secdef)...');
-    return { contract: await introspectContract(venue.runner, contractFunctionRow, FUNCTIONS_SQL), label: venue.label };
+    return { contract: await introspectContract(venue.session, contractFunctionRow, FUNCTIONS_SQL), label: venue.label };
   } finally {
     await venue.end();
   }