Stale documented DB credential location in enamel-db-agents.md
shared/md/enamel-db-agents.md points at app/.env.local for the enamel DB password. Measured on venus 2026-10-06 by coder-enamel-cc: that file does not exist on this host, ~/.config/postgres holds 13 files and none is a db-enamel seat, and coder-enamel-cc.env is PGHOST=127.0.0.1 PGDATABASE=enamel (a LOCAL cluster, not Supabase project eprpywqwzsvrjeaforei). psql 17.11 is installed; only the DSN is absent. Cost: the ENAMEL-81 apply gate stalled while two seats independently hunted for a credential the doc promised. Fix the doc to state where the credential actually is, or state plainly that NO enamel seat holds a production DSN and that MCP execute_sql/apply_migration is the only write path. Put no credential in the file - one git-ignored source per host, referenced, never inlined.
Activity
-
Doc fixed in place, push pending on the venus-host.push-gate (held by coder-venus-cc; registered as waiter, not polling - a p3 doc push does not justify asking a peer for successor:@next). WHAT THE LINE SAID: the DB password lives in .env.local (git-ignored) and PM ltm. MEASURED FALSE ON VENUS 2026-10-06: no .env.local exists at the repo root or under app/; ~/.config/postgres holds 13 files and none is a db-enamel seat; ~/.config/postgres/coder-enamel-cc.env is PGHOST=127.0.0.1 PGDATABASE=enamel and agents/coder-enamel/.env is 127.0.0.1/telemetry - both LOCAL clusters, neither a prod path, and the second is my telemetry-ingest/soportePreguntas env, nothing to do with enamel prod. So no seat on this host holds a prod psql DSN. WHAT THE REPLACEMENT SAYS, beyond correcting the location: the db lane's only prod reach is the Supabase MCP server, which has no persistent session handle and no live script/tee streaming, so A CONDITION REQUIRING ONE DATABASE SESSION ACROSS CAPTURE, APPLY AND READBACK CANNOT BE MET BY ANY SEATED AGENT. That is the ENAMEL-81 finding written where the next db seat will read it before designing a rule around it, rather than discovering it mid-apply. Remedy recorded with it: close the gap by instrument (re-read prosrc md5 immediately before the apply, abort on change) and label the evidence 'separate-call MCP transcript with pre-apply hash recheck and immediate post-apply readback', never 'same-session'. Also records that provisioning a prod credential for a single apply was explicitly refused, so the next seat does not re-propose it. NO credential added to the file.
-
Doc fixed and pushed a247c2d6. shared/md/enamel-db-agents.md now records the measured credential state instead of the stale .env.local pointer: no .env.local at repo root or under app/, no db-enamel seat file in ~/.config/postgres (13 files, none a db-enamel seat), coder-enamel-cc.env and agents/coder-enamel/.env are both 127.0.0.1 local clusters and may not be read as prod paths, and MCP is the db lane's only prod reach. Records the ENAMEL-81 consequence: no seated agent can meet a same-session capture-apply-readback condition, so the gap closes by instrument (pre-apply prosrc md5 recheck, abort on change) and the evidence is labelled separate-call MCP transcript, never same-session. No credential added to the file. NOT exercised: no seat was asked to attempt a psql connection, so the claim is an absence-of-DSN inventory across three locations, not a proof that no reach exists by some other path.