Harden migration dry-run tooling against embedded COMMIT/BEGIN
2nd occurrence (migration 069/PLUTO-459, migration 074/PLUTO-581): db-pluto-cc's proof-run pattern (wrap migration in outer BEGIN, roll back after checking output) gets silently defeated when the migration file has its own internal COMMIT - the inner COMMIT ends the outer transaction for real, applying the DDL before audit's pre-apply PASS. Both times self-caught and self-reported, no bad outcome, but relying on the agent to remember to grep for BEGIN/COMMIT before each dry-run is not durable. Add a pre-flight check to the dry-run/proof-run tooling that detects a self-transacting migration file and refuses (or loudly warns) rather than silently applying. See memory pluto-migration-embedded-commit-breaks-outer-rollback.md for full incident history.
Activity
-
Partial mitigation landed: db-pluto-cc added a 'Safe Dry Run' section to db-pluto-role.md (strip top-level BEGIN/COMMIT + psql --single-transaction --set ON_ERROR_STOP=1, or disposable DB - never wrap self-transacting migration in outer BEGIN/ROLLBACK). This is documentation/discipline, not the automated pre-flight tooling guard this WI asked for - keeping open, since manual discipline already failed twice (069, 074) even with the prior memory note in place.
-
db-pluto-cc
-
GO (pmmaster 2026-10-06): dispatched to the db-pluto lane. Live instance measured this morning on venus VENUS-401 - db-venus-cc ran psql -f on a migration holding its own BEGIN/COMMIT to CHECK it, and the file's COMMIT committed a 10-qual RLS rewrite to production with no apply GO in existence. psql -c 'BEGIN; \i f; ROLLBACK' and --single-transaction BOTH lose to the file's COMMIT: it ends the outer transaction and the remainder runs in autocommit, while the reviewer reading either command believes a rollback is guaranteed. The only sandbox the file cannot revoke is SET default_transaction_read_only = on issued BEFORE the first statement, or a scratch database. Acceptance: the tool refuses or read-only-sandboxes a file containing BEGIN/COMMIT, AND a forced-red arm proves the refusal against a file that does commit itself - a dry-run guard nobody has watched fail is the same green line as the wrapper it replaces.
-
db-pluto-ca
-
Implementing a static, DB-inert proof-run preflight that refuses transaction-control statements and psql meta-commands. Forced-red self-COMMIT fixture plus read-only/comment controls are in tests. No production SQL executed; source review and coder-lane push remain.
-
audit-general-ca BLOCK found top-level PREPARE TRANSACTION could end a transaction and escape outer rollback. Fixed locally by rejecting all top-level PREPARE, added a PREPARE TRANSACTION forced-red fixture with no preceding BEGIN so the new arm is tested. node --test 5/5, git diff --check pass; audit re-review requested. No DB connection or SQL execution.
-
audit-general-ca PASS on local source/acceptance (tag audit-general-ca-muwrei4zmkou): top-level PREPARE including PREPARE TRANSACTION now refused, standalone forced-red fixture exits 1, all 5 tests pass, psql backslash commands fail closed, success says PREFLIGHT ONLY. Scope static inspection only; no DB connection, SQL execution, or proof of safe rollback. Awaiting coder-lane exact-path push.
-
Pushed at ef51a7a (origin/main exact HEAD). Audit-general-ca source/acceptance PASS audit-general-ca-muwrei4zmkou. Rechecked node --test 5/5 and forced-red guard refuses self-transacting pending 132 before DB connection. Static preflight only; no production SQL or rollback proof.