@team-semicolon/semicolony-cli 4.18.73 → 4.18.75
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/migrations/181_db_authoritative_common_skills.sql +0 -1
- package/migrations/182_skill_governance_gateway_runtime_grants.sql +46 -0
- package/migrations/183_db_authoritative_common_skill_constraints.sql +16 -0
- package/migrations/183_db_native_skill_release_constraints.sql +30 -0
- package/package.json +1 -1
|
@@ -0,0 +1,46 @@
|
|
|
1
|
+
-- 182_skill_governance_gateway_runtime_grants.sql
|
|
2
|
+
--
|
|
3
|
+
-- Migration 161 originally created the governed skill tables. Its sc_app
|
|
4
|
+
-- grants were strengthened later, after some environments had already marked
|
|
5
|
+
-- that migration as applied. Re-assert the runtime contract in a new additive
|
|
6
|
+
-- migration so kb-gateway can stage, activate, and project immutable releases
|
|
7
|
+
-- without receiving lease-administration authority.
|
|
8
|
+
|
|
9
|
+
REVOKE ALL ON TABLE
|
|
10
|
+
semicolony.skill_capability_leases,
|
|
11
|
+
semicolony.skill_capability_lease_revocations
|
|
12
|
+
FROM PUBLIC, sc_app;
|
|
13
|
+
|
|
14
|
+
REVOKE ALL ON TABLE
|
|
15
|
+
semicolony.skill_releases,
|
|
16
|
+
semicolony.skill_release_files,
|
|
17
|
+
semicolony.skill_release_activations,
|
|
18
|
+
semicolony.skill_change_proposals,
|
|
19
|
+
semicolony.project_skill_releases,
|
|
20
|
+
semicolony.v_current_skill_capability_leases,
|
|
21
|
+
semicolony.v_current_skill_release_activations
|
|
22
|
+
FROM PUBLIC, sc_app;
|
|
23
|
+
|
|
24
|
+
GRANT SELECT, INSERT ON TABLE
|
|
25
|
+
semicolony.skill_releases,
|
|
26
|
+
semicolony.skill_release_files,
|
|
27
|
+
semicolony.skill_release_activations
|
|
28
|
+
TO sc_app;
|
|
29
|
+
|
|
30
|
+
GRANT INSERT ON TABLE
|
|
31
|
+
semicolony.skill_change_proposals,
|
|
32
|
+
semicolony.project_skill_releases
|
|
33
|
+
TO sc_app;
|
|
34
|
+
|
|
35
|
+
GRANT SELECT (proposal_id, recorded_at) ON TABLE
|
|
36
|
+
semicolony.skill_change_proposals
|
|
37
|
+
TO sc_app;
|
|
38
|
+
|
|
39
|
+
GRANT SELECT (project_release_id, recorded_at) ON TABLE
|
|
40
|
+
semicolony.project_skill_releases
|
|
41
|
+
TO sc_app;
|
|
42
|
+
|
|
43
|
+
GRANT SELECT ON TABLE
|
|
44
|
+
semicolony.v_current_skill_capability_leases,
|
|
45
|
+
semicolony.v_current_skill_release_activations
|
|
46
|
+
TO sc_app;
|
|
@@ -0,0 +1,16 @@
|
|
|
1
|
+
-- Migration 181 made source_repository nullable for DB-native common-skill
|
|
2
|
+
-- releases, but migration 161 also created a separate non-empty CHECK. A
|
|
3
|
+
-- PostgreSQL CHECK containing `IS NOT NULL` rejects the intended NULL even
|
|
4
|
+
-- after the column-level NOT NULL constraint is removed.
|
|
5
|
+
--
|
|
6
|
+
-- The composite skill_releases_provenance_check remains authoritative: it
|
|
7
|
+
-- requires NULL Git provenance for source_kind='db' and non-empty repository
|
|
8
|
+
-- provenance for source_kind='git-legacy'. Hash format checks remain in place;
|
|
9
|
+
-- they naturally accept NULL for DB-native rows and validate legacy values.
|
|
10
|
+
|
|
11
|
+
ALTER TABLE semicolony.skill_releases
|
|
12
|
+
DROP CONSTRAINT IF EXISTS skill_releases_source_repository_check;
|
|
13
|
+
|
|
14
|
+
COMMENT ON CONSTRAINT skill_releases_provenance_check
|
|
15
|
+
ON semicolony.skill_releases IS
|
|
16
|
+
'Source-specific provenance contract: DB releases have task/base lineage; legacy releases retain complete Git lineage.';
|
|
@@ -0,0 +1,30 @@
|
|
|
1
|
+
-- 183_db_native_skill_release_constraints.sql
|
|
2
|
+
--
|
|
3
|
+
-- Migration 181 made Git provenance nullable for DB-native authoring, but the
|
|
4
|
+
-- inline checks created by migration 161 still reject NULL before the new
|
|
5
|
+
-- source-kind provenance check can accept it. Replace those legacy checks with
|
|
6
|
+
-- nullable format checks; skill_releases_provenance_check continues to require
|
|
7
|
+
-- all three values for git-legacy rows.
|
|
8
|
+
|
|
9
|
+
ALTER TABLE semicolony.skill_releases
|
|
10
|
+
DROP CONSTRAINT IF EXISTS skill_releases_source_repository_check,
|
|
11
|
+
DROP CONSTRAINT IF EXISTS skill_releases_git_commit_sha_check,
|
|
12
|
+
DROP CONSTRAINT IF EXISTS skill_releases_git_tree_oid_check;
|
|
13
|
+
|
|
14
|
+
ALTER TABLE semicolony.skill_releases
|
|
15
|
+
ADD CONSTRAINT skill_releases_source_repository_format_check
|
|
16
|
+
CHECK (
|
|
17
|
+
source_repository IS NULL
|
|
18
|
+
OR NULLIF(btrim(source_repository), '') IS NOT NULL
|
|
19
|
+
),
|
|
20
|
+
ADD CONSTRAINT skill_releases_git_commit_sha_format_check
|
|
21
|
+
CHECK (
|
|
22
|
+
git_commit_sha IS NULL
|
|
23
|
+
OR git_commit_sha ~ '^[0-9a-f]{40}$'
|
|
24
|
+
),
|
|
25
|
+
ADD CONSTRAINT skill_releases_git_tree_oid_format_check
|
|
26
|
+
CHECK (
|
|
27
|
+
git_tree_oid IS NULL
|
|
28
|
+
OR git_tree_oid ~ '^[0-9a-f]{40}$'
|
|
29
|
+
);
|
|
30
|
+
|