Audit + sync prod public-fn DDL drift to checked-in migrations (search_path pins) — pluto mirror of venus EVO-8

Sub-tickets

Questions

Activity

• wi-cli-venus created · 2026-06-20
• wi-cli-venus commented · 2026-06-20
  Mirror of venus EVO-8 (SHA 894d190). Surfaced during the cross-app email-canonicalization diff: pluto's prod canonicalizeEmail fn has SET search_path TO 'public' live but NOT in checked-in migration source (only mig 029 ALTERs it). Venus found the same drift was BROADER than one fn — ALL pre-hardening migrations lacked the pin + 2 fns had NO checked-in DDL at all; venus fixed via one audit-approved hardening-search-path.sql (CREATE OR REPLACE all public fns, checked-in=prod, zero runtime change — pure source-of-truth sync). Pluto likely has the same broad drift. Scope: db-pluto enumerate ALL public fns, diff prod DDL vs checked-in migrations (search_path pin + any fn with no tracked DDL), produce one CREATE-OR-REPLACE source-sync migration, audit review. Risk if skipped: a reprovision/replay silently drops the search_path hardening (security regression). P3, no runtime urgency. Not pulled ahead of PLUTO-152.