Harden migration dry-run tooling against embedded COMMIT/BEGIN
2nd occurrence (migration 069/PLUTO-459, migration 074/PLUTO-581): db-pluto-cc's proof-run pattern (wrap migration in outer BEGIN, roll back after checking output) gets silently defeated when the migration file has its own internal COMMIT - the inner COMMIT ends the outer transaction for real, applying the DDL before audit's pre-apply PASS. Both times self-caught and self-reported, no bad outcome, but relying on the agent to remember to grep for BEGIN/COMMIT before each dry-run is not durable. Add a pre-flight check to the dry-run/proof-run tooling that detects a self-transacting migration file and refuses (or loudly warns) rather than silently applying. See memory pluto-migration-embedded-commit-breaks-outer-rollback.md for full incident history.
Questions
Activity
-
Partial mitigation landed: db-pluto-cc added a 'Safe Dry Run' section to db-pluto-role.md (strip top-level BEGIN/COMMIT + psql --single-transaction --set ON_ERROR_STOP=1, or disposable DB - never wrap self-transacting migration in outer BEGIN/ROLLBACK). This is documentation/discipline, not the automated pre-flight tooling guard this WI asked for - keeping open, since manual discipline already failed twice (069, 074) even with the prior memory note in place.