@team-semicolon/semicolony-cli 4.18.56 → 4.18.57

package/migrations/164_fabric_bridge_principal_boundary.sql

@@ -0,0 +1,678 @@
+-- 164_fabric_bridge_principal_boundary.sql
+-- Least-privilege credential resolver for the isolated SEMO Ops Knowledge Fabric bridge.
+--
+-- The bridge role receives no core-schema/table privileges. It can use one dedicated
+-- schema and execute one SECURITY DEFINER function that returns four sanitized fields.
+-- The migration runner wraps this file in a transaction.
+-- @schema-retarget: off
+
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'sc_fabric_bridge_owner') THEN
+    CREATE ROLE sc_fabric_bridge_owner NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT NOBYPASSRLS;
+  ELSE
+    ALTER ROLE sc_fabric_bridge_owner
+      WITH NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT NOBYPASSRLS;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'sc_fabric_bridge') THEN
+    CREATE ROLE sc_fabric_bridge LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT NOBYPASSRLS;
+  ELSE
+    ALTER ROLE sc_fabric_bridge
+      WITH LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT NOBYPASSRLS;
+  END IF;
+  EXECUTE format(
+    'GRANT CONNECT ON DATABASE %I TO sc_fabric_bridge',
+    current_database()
+  );
+END $$;
+
+-- NOINHERIT does not prevent SET ROLE. Reject every inbound or outbound membership
+-- before temporarily granting the migration runner the owner role.
+DO $$
+DECLARE
+  v_owner_oid oid;
+  v_bridge_oid oid;
+BEGIN
+  SELECT oid INTO STRICT v_owner_oid
+    FROM pg_catalog.pg_roles
+   WHERE rolname = 'sc_fabric_bridge_owner';
+  SELECT oid INTO STRICT v_bridge_oid
+    FROM pg_catalog.pg_roles
+   WHERE rolname = 'sc_fabric_bridge';
+
+  IF EXISTS (
+    SELECT 1
+      FROM pg_catalog.pg_auth_members m
+     WHERE m.roleid IN (v_owner_oid, v_bridge_oid)
+        OR m.member IN (v_owner_oid, v_bridge_oid)
+  ) THEN
+    RAISE EXCEPTION 'fabric bridge role membership rejected';
+  END IF;
+
+  EXECUTE format('GRANT sc_fabric_bridge_owner TO %I', current_user);
+END $$;
+
+-- Never adopt an untrusted schema or silently preserve pre-existing objects or ACLs.
+-- Only an empty schema owned by the migration runner, or this migration's exact
+-- resolver and exact owner/bridge ACL, is safe to converge.
+DO $$
+DECLARE
+  v_bridge_oid oid;
+  v_owner_oid oid;
+  v_schema_oid oid;
+  v_schema_owner text;
+  v_unexpected_objects boolean;
+  v_unexpected_functions integer;
+  v_wrong_resolver_owner integer;
+  v_unsafe_default_acl boolean;
+  v_unsafe_schema_acl boolean;
+  v_unsafe_function_acl boolean;
+BEGIN
+  SELECT oid INTO STRICT v_owner_oid
+    FROM pg_catalog.pg_roles
+   WHERE rolname = 'sc_fabric_bridge_owner';
+  SELECT oid INTO STRICT v_bridge_oid
+    FROM pg_catalog.pg_roles
+   WHERE rolname = 'sc_fabric_bridge';
+
+  SELECT n.oid, r.rolname
+    INTO v_schema_oid, v_schema_owner
+    FROM pg_catalog.pg_namespace n
+    JOIN pg_catalog.pg_roles r ON r.oid = n.nspowner
+   WHERE n.nspname = 'fabric_bridge';
+
+  IF v_schema_owner IS NOT NULL
+     AND v_schema_owner NOT IN (current_user, 'sc_fabric_bridge_owner') THEN
+    RAISE EXCEPTION 'fabric bridge schema ownership rejected';
+  END IF;
+
+  SELECT EXISTS (
+    SELECT 1
+      FROM pg_catalog.pg_class c
+      JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+     WHERE n.nspname = 'fabric_bridge'
+    UNION ALL
+    SELECT 1
+      FROM pg_catalog.pg_type t
+      JOIN pg_catalog.pg_namespace n ON n.oid = t.typnamespace
+     WHERE n.nspname = 'fabric_bridge'
+    UNION ALL
+    SELECT 1
+      FROM pg_catalog.pg_collation c
+      JOIN pg_catalog.pg_namespace n ON n.oid = c.collnamespace
+     WHERE n.nspname = 'fabric_bridge'
+    UNION ALL
+    SELECT 1
+      FROM pg_catalog.pg_conversion c
+      JOIN pg_catalog.pg_namespace n ON n.oid = c.connamespace
+     WHERE n.nspname = 'fabric_bridge'
+    UNION ALL
+    SELECT 1
+      FROM pg_catalog.pg_operator o
+      JOIN pg_catalog.pg_namespace n ON n.oid = o.oprnamespace
+     WHERE n.nspname = 'fabric_bridge'
+    UNION ALL
+    SELECT 1
+      FROM pg_catalog.pg_opclass o
+      JOIN pg_catalog.pg_namespace n ON n.oid = o.opcnamespace
+     WHERE n.nspname = 'fabric_bridge'
+    UNION ALL
+    SELECT 1
+      FROM pg_catalog.pg_opfamily o
+      JOIN pg_catalog.pg_namespace n ON n.oid = o.opfnamespace
+     WHERE n.nspname = 'fabric_bridge'
+    UNION ALL
+    SELECT 1
+      FROM pg_catalog.pg_statistic_ext s
+      JOIN pg_catalog.pg_namespace n ON n.oid = s.stxnamespace
+     WHERE n.nspname = 'fabric_bridge'
+    UNION ALL
+    SELECT 1
+      FROM pg_catalog.pg_ts_config t
+      JOIN pg_catalog.pg_namespace n ON n.oid = t.cfgnamespace
+     WHERE n.nspname = 'fabric_bridge'
+    UNION ALL
+    SELECT 1
+      FROM pg_catalog.pg_ts_dict t
+      JOIN pg_catalog.pg_namespace n ON n.oid = t.dictnamespace
+     WHERE n.nspname = 'fabric_bridge'
+    UNION ALL
+    SELECT 1
+      FROM pg_catalog.pg_ts_parser t
+      JOIN pg_catalog.pg_namespace n ON n.oid = t.prsnamespace
+     WHERE n.nspname = 'fabric_bridge'
+    UNION ALL
+    SELECT 1
+      FROM pg_catalog.pg_ts_template t
+      JOIN pg_catalog.pg_namespace n ON n.oid = t.tmplnamespace
+     WHERE n.nspname = 'fabric_bridge'
+    UNION ALL
+    SELECT 1
+      FROM pg_catalog.pg_constraint c
+      JOIN pg_catalog.pg_namespace n ON n.oid = c.connamespace
+     WHERE n.nspname = 'fabric_bridge'
+    UNION ALL
+    SELECT 1
+      FROM pg_catalog.pg_extension e
+      JOIN pg_catalog.pg_namespace n ON n.oid = e.extnamespace
+     WHERE n.nspname = 'fabric_bridge'
+  ) INTO v_unexpected_objects;
+
+  IF v_unexpected_objects THEN
+    RAISE EXCEPTION 'fabric bridge schema inventory rejected';
+  END IF;
+
+  SELECT count(*)
+    INTO v_unexpected_functions
+    FROM pg_catalog.pg_proc p
+    JOIN pg_catalog.pg_namespace n ON n.oid = p.pronamespace
+   WHERE n.nspname = 'fabric_bridge'
+     AND NOT (
+       p.proname = 'resolve_principal'
+       AND p.prokind = 'f'
+       AND p.pronargs = 1
+       AND p.proargtypes = '25'::pg_catalog.oidvector
+       AND p.proretset
+       AND p.prorettype = 2249
+       AND p.proallargtypes = ARRAY[25, 2950, 25, 25, 25]::oid[]
+       AND p.proargmodes = ARRAY['i', 't', 't', 't', 't']::"char"[]
+       AND p.proargnames = ARRAY[
+         'p_token_hash',
+         'credential_id',
+         'credential_kind',
+         'actor_id',
+         'principal_id'
+       ]::text[]
+     );
+
+  IF v_unexpected_functions <> 0 THEN
+    RAISE EXCEPTION 'fabric bridge schema inventory rejected';
+  END IF;
+
+  SELECT count(*)
+    INTO v_wrong_resolver_owner
+    FROM pg_catalog.pg_proc p
+    JOIN pg_catalog.pg_namespace n ON n.oid = p.pronamespace
+    JOIN pg_catalog.pg_roles r ON r.oid = p.proowner
+   WHERE n.nspname = 'fabric_bridge'
+     AND p.proname = 'resolve_principal'
+     AND p.prokind = 'f'
+     AND p.pronargs = 1
+     AND p.proargtypes = '25'::pg_catalog.oidvector
+     AND r.rolname <> 'sc_fabric_bridge_owner';
+
+  IF v_wrong_resolver_owner <> 0 THEN
+    RAISE EXCEPTION 'fabric bridge schema ownership rejected';
+  END IF;
+
+  SELECT EXISTS (
+    SELECT 1
+      FROM pg_catalog.pg_default_acl d
+      CROSS JOIN LATERAL pg_catalog.aclexplode(d.defaclacl) acl
+     WHERE d.defaclrole = v_owner_oid
+       AND d.defaclobjtype = 'f'
+       AND (
+         d.defaclnamespace = 0
+         OR d.defaclnamespace = v_schema_oid
+       )
+       AND NOT (
+         acl.grantee = v_owner_oid
+         AND acl.grantor = v_owner_oid
+         AND acl.privilege_type = 'EXECUTE'
+         AND NOT acl.is_grantable
+       )
+  ) INTO v_unsafe_default_acl;
+
+  IF v_unsafe_default_acl THEN
+    RAISE EXCEPTION 'fabric bridge default acl rejected';
+  END IF;
+
+  SELECT EXISTS (
+    SELECT 1
+      FROM pg_catalog.pg_namespace n
+      CROSS JOIN LATERAL pg_catalog.aclexplode(
+        COALESCE(n.nspacl, pg_catalog.acldefault('n', n.nspowner))
+      ) acl
+     WHERE n.nspname = 'fabric_bridge'
+       AND NOT (
+         (
+           acl.grantee = n.nspowner
+           AND acl.grantor = n.nspowner
+           AND acl.privilege_type IN ('CREATE', 'USAGE')
+           AND NOT acl.is_grantable
+         )
+         OR (
+           acl.grantee = v_bridge_oid
+           AND acl.grantor = n.nspowner
+           AND acl.privilege_type = 'USAGE'
+           AND NOT acl.is_grantable
+         )
+       )
+  ) INTO v_unsafe_schema_acl;
+
+  SELECT EXISTS (
+    SELECT 1
+      FROM pg_catalog.pg_proc p
+      JOIN pg_catalog.pg_namespace n ON n.oid = p.pronamespace
+      CROSS JOIN LATERAL pg_catalog.aclexplode(
+        COALESCE(p.proacl, pg_catalog.acldefault('f', p.proowner))
+      ) acl
+     WHERE n.nspname = 'fabric_bridge'
+       AND NOT (
+         acl.grantee IN (v_owner_oid, v_bridge_oid)
+         AND acl.grantor = p.proowner
+         AND acl.privilege_type = 'EXECUTE'
+         AND NOT acl.is_grantable
+       )
+  ) INTO v_unsafe_function_acl;
+
+  IF v_unsafe_schema_acl OR v_unsafe_function_acl THEN
+    RAISE EXCEPTION 'fabric bridge schema acl rejected';
+  END IF;
+END $$;
+
+CREATE SCHEMA IF NOT EXISTS fabric_bridge AUTHORIZATION sc_fabric_bridge_owner;
+ALTER SCHEMA fabric_bridge OWNER TO sc_fabric_bridge_owner;
+REVOKE ALL ON SCHEMA fabric_bridge FROM PUBLIC;
+ALTER DEFAULT PRIVILEGES FOR ROLE sc_fabric_bridge_owner
+  REVOKE EXECUTE ON FUNCTIONS FROM PUBLIC;
+ALTER DEFAULT PRIVILEGES FOR ROLE sc_fabric_bridge_owner IN SCHEMA fabric_bridge
+  REVOKE EXECUTE ON FUNCTIONS FROM PUBLIC;
+
+ALTER TABLE semicolony.worker_devices
+  ADD COLUMN IF NOT EXISTS fabric_gateway_credential_id uuid
+  REFERENCES semicolony.gateway_credentials(id);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_worker_devices_fabric_gateway_credential_id
+  ON semicolony.worker_devices (fabric_gateway_credential_id)
+  WHERE fabric_gateway_credential_id IS NOT NULL;
+
+GRANT USAGE ON SCHEMA semicolony, public TO sc_fabric_bridge_owner;
+GRANT SELECT (id, tenant_id, tenant_slug, token_hash, scopes, status, expires_at, metadata)
+  ON semicolony.gateway_credentials TO sc_fabric_bridge_owner;
+GRANT SELECT (fabric_gateway_credential_id, worker_id, device_id, status, kb_access_mode, last_doctor_status, last_seen_at)
+  ON semicolony.worker_devices TO sc_fabric_bridge_owner;
+GRANT SELECT (bot_id, tenant_id, status)
+  ON semicolony.bot_status TO sc_fabric_bridge_owner;
+GRANT SELECT (slug, tenant_id, status)
+  ON semicolony.agent_personas TO sc_fabric_bridge_owner;
+GRANT SELECT (id, slug, tenant_type, metadata)
+  ON public.tenants TO sc_fabric_bridge_owner;
+REVOKE EXECUTE ON FUNCTION public.current_tenant_id(), public.is_provider()
+  FROM PUBLIC, sc_fabric_bridge;
+GRANT EXECUTE ON FUNCTION public.current_tenant_id(), public.is_provider()
+  TO sc_app, sc_provider, sc_fabric_bridge_owner;
+
+SET ROLE sc_fabric_bridge_owner;
+
+CREATE OR REPLACE FUNCTION fabric_bridge.resolve_principal(p_token_hash text)
+RETURNS TABLE (
+  credential_id uuid,
+  credential_kind text,
+  actor_id text,
+  principal_id text
+)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $function$
+DECLARE
+  v_credential_id uuid;
+  v_tenant_id uuid;
+  v_metadata jsonb;
+BEGIN
+  IF p_token_hash !~ '^[0-9a-f]{64}$' THEN
+    RETURN;
+  END IF;
+
+  SELECT gc.id, gc.tenant_id, gc.metadata
+    INTO v_credential_id, v_tenant_id, v_metadata
+    FROM semicolony.gateway_credentials gc
+   WHERE gc.token_hash = p_token_hash
+     AND gc.tenant_slug = 'team-semicolon'
+     AND gc.status = 'active'
+     AND (gc.expires_at IS NULL OR gc.expires_at > clock_timestamp())
+     AND gc.scopes = ARRAY['fabric:query']::text[]
+     AND gc.metadata->>'credential_audience' = 'semo-ops:fabric-bridge'
+     AND gc.metadata->>'credential_scope' = 'fabric:query'
+     AND gc.metadata->>'tenant_anchor' = 'team-semicolon'
+     AND COALESCE(gc.metadata->>'lineage_status', 'active') = 'active'
+   LIMIT 1;
+  IF NOT FOUND THEN
+    RETURN;
+  END IF;
+
+  -- Bind RLS to the credential's immutable tenant before consulting tenant-owned rows.
+  PERFORM set_config('app.current_tenant_id', v_tenant_id::text, true);
+  PERFORM set_config('app.is_provider', 'off', true);
+  IF NOT EXISTS (
+    SELECT 1
+      FROM public.tenants t
+     WHERE t.id = v_tenant_id
+       AND t.slug = 'team-semicolon'
+       AND t.tenant_type = 'team'
+       AND COALESCE(t.metadata->>'status', 'active') = 'active'
+  ) THEN
+    RETURN;
+  END IF;
+
+  IF v_metadata->>'credential_kind' = 'agent'
+     AND v_metadata->>'agent_id' = 'colony'
+     AND v_metadata->>'actor' = 'agent:team-semicolon:colony'
+     AND v_metadata->>'principal_kind' = 'group'
+     AND v_metadata->>'principal' = 'team-semicolon:member'
+     AND EXISTS (
+       SELECT 1
+         FROM semicolony.bot_status bs
+        WHERE bs.bot_id = 'colony'
+          AND bs.tenant_id = v_tenant_id
+          AND bs.status IN ('online', 'active')
+     )
+     AND EXISTS (
+       SELECT 1
+         FROM semicolony.agent_personas ap
+        WHERE ap.slug = 'colony'
+          AND ap.tenant_id = v_tenant_id
+          AND ap.status = 'active'
+     ) THEN
+    RETURN QUERY
+      SELECT
+        v_credential_id,
+        'agent'::text,
+        'agent:team-semicolon:colony'::text,
+        'team-semicolon:member'::text;
+    RETURN;
+  END IF;
+
+  IF v_metadata->>'credential_kind' = 'worker'
+     AND v_metadata->>'worker_id' ~ '^[a-z][a-z0-9-]{0,63}$'
+     AND v_metadata->>'device_id' ~ '^[a-z][a-z0-9-]{0,99}$'
+     AND EXISTS (
+       SELECT 1
+         FROM semicolony.worker_devices wd
+        WHERE wd.fabric_gateway_credential_id = v_credential_id
+          AND wd.worker_id = v_metadata->>'worker_id'
+          AND wd.device_id = v_metadata->>'device_id'
+          AND wd.status = 'active'
+          AND wd.kb_access_mode = 'worker-gateway'
+          AND wd.last_doctor_status = 'pass'
+          AND wd.last_seen_at >= clock_timestamp() - interval '24 hours'
+     ) THEN
+    RETURN QUERY
+      SELECT
+        v_credential_id,
+        'worker'::text,
+        ('worker:team-semicolon:' || (v_metadata->>'worker_id'))::text,
+        'team-semicolon:member'::text;
+  END IF;
+END;
+$function$;
+
+RESET ROLE;
+
+REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA semicolony, public FROM sc_fabric_bridge;
+REVOKE ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA semicolony, public FROM sc_fabric_bridge;
+REVOKE ALL PRIVILEGES ON ALL FUNCTIONS IN SCHEMA semicolony, public FROM sc_fabric_bridge;
+REVOKE ALL ON SCHEMA semicolony, public FROM sc_fabric_bridge;
+REVOKE EXECUTE ON ALL FUNCTIONS IN SCHEMA fabric_bridge
+  FROM PUBLIC, sc_app, sc_provider, sc_fabric_bridge;
+REVOKE ALL ON SCHEMA fabric_bridge FROM sc_fabric_bridge;
+
+SET ROLE sc_fabric_bridge_owner;
+
+GRANT USAGE ON SCHEMA fabric_bridge TO sc_fabric_bridge;
+GRANT EXECUTE ON FUNCTION fabric_bridge.resolve_principal(text) TO sc_fabric_bridge;
+
+RESET ROLE;
+
+DO $$
+BEGIN
+  EXECUTE format('REVOKE sc_fabric_bridge_owner FROM %I', current_user);
+END $$;
+
+-- Treat the migration result as a catalog-level security postcondition, not merely
+-- a sequence of successful GRANT/REVOKE statements.
+DO $$
+DECLARE
+  v_bridge_oid oid;
+  v_owner_oid oid;
+  v_schema_oid oid;
+  v_resolver_oid oid;
+  v_unexpected_objects boolean;
+  v_function_count integer;
+  v_schema_acl_count integer;
+  v_schema_owner_create integer;
+  v_schema_owner_usage integer;
+  v_schema_bridge_usage integer;
+  v_function_acl_count integer;
+  v_function_owner_execute integer;
+  v_function_bridge_execute integer;
+  v_unsafe_default_acl boolean;
+  v_global_default_acl_count integer;
+  v_global_owner_execute integer;
+BEGIN
+  SELECT oid INTO STRICT v_owner_oid
+    FROM pg_catalog.pg_roles
+   WHERE rolname = 'sc_fabric_bridge_owner';
+  SELECT oid INTO STRICT v_bridge_oid
+    FROM pg_catalog.pg_roles
+   WHERE rolname = 'sc_fabric_bridge';
+  SELECT n.oid
+    INTO v_schema_oid
+    FROM pg_catalog.pg_namespace n
+   WHERE n.nspname = 'fabric_bridge'
+     AND n.nspowner = v_owner_oid;
+
+  SELECT EXISTS (
+    SELECT 1
+      FROM pg_catalog.pg_class c
+      JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+     WHERE n.nspname = 'fabric_bridge'
+    UNION ALL
+    SELECT 1
+      FROM pg_catalog.pg_type t
+      JOIN pg_catalog.pg_namespace n ON n.oid = t.typnamespace
+     WHERE n.nspname = 'fabric_bridge'
+    UNION ALL
+    SELECT 1
+      FROM pg_catalog.pg_collation c
+      JOIN pg_catalog.pg_namespace n ON n.oid = c.collnamespace
+     WHERE n.nspname = 'fabric_bridge'
+    UNION ALL
+    SELECT 1
+      FROM pg_catalog.pg_conversion c
+      JOIN pg_catalog.pg_namespace n ON n.oid = c.connamespace
+     WHERE n.nspname = 'fabric_bridge'
+    UNION ALL
+    SELECT 1
+      FROM pg_catalog.pg_operator o
+      JOIN pg_catalog.pg_namespace n ON n.oid = o.oprnamespace
+     WHERE n.nspname = 'fabric_bridge'
+    UNION ALL
+    SELECT 1
+      FROM pg_catalog.pg_opclass o
+      JOIN pg_catalog.pg_namespace n ON n.oid = o.opcnamespace
+     WHERE n.nspname = 'fabric_bridge'
+    UNION ALL
+    SELECT 1
+      FROM pg_catalog.pg_opfamily o
+      JOIN pg_catalog.pg_namespace n ON n.oid = o.opfnamespace
+     WHERE n.nspname = 'fabric_bridge'
+    UNION ALL
+    SELECT 1
+      FROM pg_catalog.pg_statistic_ext s
+      JOIN pg_catalog.pg_namespace n ON n.oid = s.stxnamespace
+     WHERE n.nspname = 'fabric_bridge'
+    UNION ALL
+    SELECT 1
+      FROM pg_catalog.pg_ts_config t
+      JOIN pg_catalog.pg_namespace n ON n.oid = t.cfgnamespace
+     WHERE n.nspname = 'fabric_bridge'
+    UNION ALL
+    SELECT 1
+      FROM pg_catalog.pg_ts_dict t
+      JOIN pg_catalog.pg_namespace n ON n.oid = t.dictnamespace
+     WHERE n.nspname = 'fabric_bridge'
+    UNION ALL
+    SELECT 1
+      FROM pg_catalog.pg_ts_parser t
+      JOIN pg_catalog.pg_namespace n ON n.oid = t.prsnamespace
+     WHERE n.nspname = 'fabric_bridge'
+    UNION ALL
+    SELECT 1
+      FROM pg_catalog.pg_ts_template t
+      JOIN pg_catalog.pg_namespace n ON n.oid = t.tmplnamespace
+     WHERE n.nspname = 'fabric_bridge'
+    UNION ALL
+    SELECT 1
+      FROM pg_catalog.pg_constraint c
+      JOIN pg_catalog.pg_namespace n ON n.oid = c.connamespace
+     WHERE n.nspname = 'fabric_bridge'
+    UNION ALL
+    SELECT 1
+      FROM pg_catalog.pg_extension e
+      JOIN pg_catalog.pg_namespace n ON n.oid = e.extnamespace
+     WHERE n.nspname = 'fabric_bridge'
+  ) INTO v_unexpected_objects;
+
+  SELECT count(*)
+    INTO v_function_count
+    FROM pg_catalog.pg_proc p
+    JOIN pg_catalog.pg_namespace n ON n.oid = p.pronamespace
+   WHERE n.nspname = 'fabric_bridge';
+
+  SELECT p.oid
+    INTO v_resolver_oid
+    FROM pg_catalog.pg_proc p
+   WHERE p.pronamespace = v_schema_oid
+     AND p.proname = 'resolve_principal'
+     AND p.prokind = 'f'
+     AND p.pronargs = 1
+     AND p.proargtypes = '25'::pg_catalog.oidvector
+     AND p.proretset
+     AND p.prorettype = 2249
+     AND p.proallargtypes = ARRAY[25, 2950, 25, 25, 25]::oid[]
+     AND p.proargmodes = ARRAY['i', 't', 't', 't', 't']::"char"[]
+     AND p.proargnames = ARRAY[
+       'p_token_hash',
+       'credential_id',
+       'credential_kind',
+       'actor_id',
+       'principal_id'
+     ]::text[]
+     AND p.proowner = v_owner_oid
+     AND p.prosecdef
+     AND p.proconfig = ARRAY['search_path=pg_catalog']::text[];
+
+  SELECT
+      count(*),
+      count(*) FILTER (
+        WHERE acl.grantee = v_owner_oid
+          AND acl.grantor = v_owner_oid
+          AND acl.privilege_type = 'CREATE'
+          AND NOT acl.is_grantable
+      ),
+      count(*) FILTER (
+        WHERE acl.grantee = v_owner_oid
+          AND acl.grantor = v_owner_oid
+          AND acl.privilege_type = 'USAGE'
+          AND NOT acl.is_grantable
+      ),
+      count(*) FILTER (
+        WHERE acl.grantee = v_bridge_oid
+          AND acl.grantor = v_owner_oid
+          AND acl.privilege_type = 'USAGE'
+          AND NOT acl.is_grantable
+      )
+    INTO
+      v_schema_acl_count,
+      v_schema_owner_create,
+      v_schema_owner_usage,
+      v_schema_bridge_usage
+    FROM pg_catalog.pg_namespace n
+    CROSS JOIN LATERAL pg_catalog.aclexplode(
+      COALESCE(n.nspacl, pg_catalog.acldefault('n', n.nspowner))
+    ) acl
+   WHERE n.oid = v_schema_oid;
+
+  SELECT
+      count(*),
+      count(*) FILTER (
+        WHERE acl.grantee = v_owner_oid
+          AND acl.grantor = v_owner_oid
+          AND acl.privilege_type = 'EXECUTE'
+          AND NOT acl.is_grantable
+      ),
+      count(*) FILTER (
+        WHERE acl.grantee = v_bridge_oid
+          AND acl.grantor = v_owner_oid
+          AND acl.privilege_type = 'EXECUTE'
+          AND NOT acl.is_grantable
+      )
+    INTO
+      v_function_acl_count,
+      v_function_owner_execute,
+      v_function_bridge_execute
+    FROM pg_catalog.pg_proc p
+    CROSS JOIN LATERAL pg_catalog.aclexplode(
+      COALESCE(p.proacl, pg_catalog.acldefault('f', p.proowner))
+    ) acl
+   WHERE p.oid = v_resolver_oid;
+
+  SELECT EXISTS (
+    SELECT 1
+      FROM pg_catalog.pg_default_acl d
+      CROSS JOIN LATERAL pg_catalog.aclexplode(d.defaclacl) acl
+     WHERE d.defaclrole = v_owner_oid
+       AND d.defaclobjtype = 'f'
+       AND (
+         d.defaclnamespace = 0
+         OR d.defaclnamespace = v_schema_oid
+       )
+       AND NOT (
+         acl.grantee = v_owner_oid
+         AND acl.grantor = v_owner_oid
+         AND acl.privilege_type = 'EXECUTE'
+         AND NOT acl.is_grantable
+       )
+  ) INTO v_unsafe_default_acl;
+
+  SELECT
+      count(*),
+      count(*) FILTER (
+        WHERE acl.grantee = v_owner_oid
+          AND acl.grantor = v_owner_oid
+          AND acl.privilege_type = 'EXECUTE'
+          AND NOT acl.is_grantable
+      )
+    INTO
+      v_global_default_acl_count,
+      v_global_owner_execute
+    FROM pg_catalog.pg_default_acl d
+    CROSS JOIN LATERAL pg_catalog.aclexplode(d.defaclacl) acl
+   WHERE d.defaclrole = v_owner_oid
+     AND d.defaclobjtype = 'f'
+     AND d.defaclnamespace = 0;
+
+  IF v_schema_oid IS NULL
+     OR v_resolver_oid IS NULL
+     OR v_unexpected_objects
+     OR v_function_count <> 1
+     OR v_schema_acl_count <> 3
+     OR v_schema_owner_create <> 1
+     OR v_schema_owner_usage <> 1
+     OR v_schema_bridge_usage <> 1
+     OR v_function_acl_count <> 2
+     OR v_function_owner_execute <> 1
+     OR v_function_bridge_execute <> 1
+     OR v_unsafe_default_acl
+     OR v_global_default_acl_count <> 1
+     OR v_global_owner_execute <> 1
+     OR EXISTS (
+       SELECT 1
+         FROM pg_catalog.pg_auth_members m
+        WHERE m.roleid IN (v_owner_oid, v_bridge_oid)
+           OR m.member IN (v_owner_oid, v_bridge_oid)
+     ) THEN
+    RAISE EXCEPTION 'fabric bridge postcondition rejected';
+  END IF;
+END $$;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-semicolon/semicolony-cli",
-  "version": "4.18.56",
+  "version": "4.18.57",
   "description": "SemiColony CLI - AI operations and agent orchestration installer",
   "main": "dist/bundle.js",
   "bin": {