terra
TERRA-286
vUserGroups role gate uses a bare toAt IS NULL, so a future-end grant confers no app role while still conferring clinical write
In progress high
dtdb-terra-ca
Measured 2026-10-06 (coder-terra-cc, pg_get_viewdef, full WHERE on TERRA-267 as MKR-267-vug). vUserGroups uses a BARE toAt IS NULL. auth.ts:69-74 getUserRoles reads it and auth.ts:17 states every gate including auth/callback resolves through it; no app code reads userGroups directly, so vUserGroups IS terra's live role gate. Consequence: a grant with a FUTURE toAt - live by every temporal reading - confers NO role anywhere in the app, so a legitimately time-bounded role is a silent lockout. The same grant IS live to the corrected one-arg clinical-write core, so the two readers disagree by construction and each is correct against its own spec: one person can hold clinical-write capability while having no app role at all. Fails closed, so it is an availability and capability-split defect rather than a hole. Scope: ONE shared definition of a live grant, read by the role gate and the write guards alike - do not fix it inside terra_238, which only needs its own membership predicate rebased onto the core. Same shape as ENAMEL-81 from the other direction (there the write guards were narrower than the corrected read; here the read gate is narrower than the write core).
Activity
-
DB-seat SELECT-only live count on shared project eprpywqwzsvrjeaforei, 2026-10-06: SELECT count(*) FROM public."userGroups" WHERE "appKey"=\x27terra\x27 AND "toAt" IS NOT NULL AND "toAt">now() returned 0. This is the requested underlying-table future-end Terra grant count, without further live/deleted/active filters. Therefore no current Terra grant row can be prematurely dropped solely by vUserGroups bare toAt IS NULL in this snapshot; a future scheduled-end grant would still expose the predicate split. No names to list, no DML, no fix applied.
-
Correction to my immediately prior note: the shell rendered the SQL string literal as backslash-x text. Actual executed predicate was appKey = 'terra' AND toAt IS NOT NULL AND toAt > now(). Result remains 0.
-
db-terra-ca / db
-
PM GO muwr01zrhuvq. Live SELECT-only eprpywqwzsvrjeaforei 2026-10-06: 0 userGroups rows globally with toAt IS NOT NULL AND toAt > now(); 170 eligible current Terra grants for rollback fixture source. Claimed immutable stem terra_242 via migration-claim/terra_242. Unpushed source draft SHA256 00a6f72f682ff2e20e8cb3327eb294010351d647ea6a127547e845b05e54627b; rollback-only fixture script SHA256 e5ac5a98291147da444b4038b3b321cc3fc7c27d82fac15c6ba96b4871c31dee. Not rehearsed or applied. Shared-view Enamel review, coder review and Class-A audit diff required before push.
-
terra_242 source and rollback fixture drafted; exact-byte Class-A audit, coder and shared-object reviews requested before push. No DDL run.
-
Enamel shared-object write scope: current live userGroups INSERT path has only three BEFORE row triggers; future-toAt fixture skips deleted-user/inactive-group WHEN clauses and appKey mismatch check is SELECT-only. Fixture sets explicit UUID, so no sequence advance; no outbound or NOTIFY call found. Rollback mechanism is technically residue-safe. Probe e5ac5a98 HELD: row lacks named consenting human actor-of-record, archive context, and exact post-rollback removal verification; script copies grantedBy from another grant and may falsely attribute fixture. Do not run until manifest and truthful actor are recorded. Enamel exact-source BLOCK on migration 00a6f72f also stands separately.
-
Enamel db-seat recovery declaration before any probe DML: exact fixture userGroups.id 7870b189-e407-478f-ab42-157ee407f6bf, one INSERT inside a single explicit BEGIN with terminal ROLLBACK. After the call, perform a separate SELECT-only count by that exact id and require zero; also read vUserGroups for the id and require zero. No committed fixture or cleanup DELETE. Archive context: none on this INSERT path; no archive trigger fires. PM ruled this rollback fixture does not inherit ENAMEL-86 committed-actor consent gate. Enamel db seat technical clearance to be sent separately after live catalog read.
-
Source-only coder-terra PASS:00a6f72f (muwrwhtl2joh). Probe e5ac5a98 was BLOCKED because old retyped predicate had only a trivial zero. Revised rollback-only probe SHA256 af136e3f2531fde8f470d9368b15757721e59b41fbf233fe51314624c91f04a2, immutable Git blob cd9c89260224277bf927245b50d4b95f9304c41a: same retyped predicate must return 1 for the open source grant before returning 0 for minted future-end fixture; new view returns 1. Rehearsal uses SERIALIZABLE from first statement, SET CONSTRAINTS ALL IMMEDIATE (current userGroups has 0 deferrable constraints), terminal ROLLBACK. Shared userGroups INSERT remains NOT RUN pending Enamel-owner scope clearance, exact probe review, and apply authority.
-
PM muwrx08a88ns ruled Terra GO does NOT cover public.userGroups INSERT; shared Enamel owner must clear exact rollback fixture first. Revised probe SHA256 e4a74d6fb308701d6059a6b9eded9828f3bb0e27105b3b2e1eaf114f7b8ff6dd, immutable blob e6a662f100c1d63131c0cf17ab3c7fa653286f42: positive old-predicate source arm (1), future-end fixture old (0) vs new view (1), SERIALIZABLE first after BEGIN, terminal ROLLBACK. Removed SET CONSTRAINTS because all seven live userGroups constraints are nondeferrable. Fixture ID 7870b189-e407-478f-ab42-157ee407f6bf; proposed archive context system:terra-286-rollback-probe; live userGroups triggers are four BEFORE-row guards only, no AFTER/statement trigger, and defaults have no sequence (id gen_random_uuid). Recovery method ROLLBACK plus fresh zero-row/view/trigger residue readback. Named consenting human actor-of-record and corresponding approved_actor_uuid are NOT YET RECORDED; script refuses missing/nonhuman actor. No fixture DML or rehearsal run. Probe and shared-owner GO pending.
-
audit-terra-ca muwry5cr3f43 independently PASSed migration source 00a6f72f (old live vUserGroups MD5 b758464a, owner/options, zero future-end rows globally, six-column/ACL preservation). Its probe-logic PASS on e5ac5a98 is superseded and NOT carried: coder-terra BLOCKed e5ac5a98 for unconditional-zero old predicate. Current probe is e4a74d6f / blob e6a662f, review pending. No shared Enamel fixture GO, named consenting actor, rehearsal, residue readback, source push or apply clearance.
-
Shared-object SOURCE BLOCK on terra_242_vusergroups_future_end.sql SHA256 00a6f72f682ff2e20e8cb3327eb294010351d647ea6a127547e845b05e54627b, current exact bytes. Lines 62-65 assert zero future-end userGroups grants without locking the shared table; a concurrent INSERT can appear after the count and before CREATE OR REPLACE VIEW at line 69, invalidating the header claim that apply is behaviour-neutral at prestate across all appKeys. Lines 92-96 postflight use two substring positions and changed-from-old MD5 rather than an exact new view-definition identity; an unintended extra predicate could pass. This is a source-gate finding, not a live MD5/ACL/count measurement. Needs a writer-blocking table lock before the count and exact postflight identity or equivalent discriminating full definition check. Coder-terra and audit-terra PASSes remain scoped to their claims; this shared-object BLOCK does not transfer to a new digest.
-
db-enamel-ca BLOCK:00a6f72f/e5ac5a98 (muws97yf0k7d) accepted: global zero-future-end count needed writer exclusion, and postflight needed full expected view definition. Superseding exact drafts, NOT RUN/NOT PUSHED: migration SHA256 d265740af558aaae15d8f9876ed959492c0ff4602d9873ebd1f0858020bf90a9, blob 6dfc9f38bfde919c56843488959c180ff11cb2df; rollback probe SHA256 3ed4e3d6f73459ec28092be99ee6bf2158cf596eeb9d6e7e2f0762a3b07fe739, blob 1ce6552ae186ef1e1d190e14342b9f68d0202313. Migration acquires userGroups SHARE lock before zero count and holds through COMMIT; postflight pins full expected pg_get_viewdef MD5 dc42075cecf356c6c3f6a3478bb83a78, calculated SELECT-only by replacing only the temporal arm in the pinned old live view definition. Probe mirrors changed executable SQL, SERIALIZABLE first after BEGIN, positive old-source control and future-end contrast, terminal ROLLBACK. Exact-source/probe review, shared-write clearance and named consenting actor remain pending; no DDL/DML.
-
db-enamel-ca muwsaqanhb47 technically cleared the rollback INSERT mechanism against current live catalog ONLY, not a probe GO: exactly THREE userGroups INSERT triggers, all BEFORE row, no INSERT statement trigger/outbound/sequence default/nextval; explicit UUID fixture; transactional row/locks roll back. Correction to my earlier note: the fourth userGroups trigger is UPDATE, not INSERT. Current probe d265740a-source / 3ed4e3d6-probe requires a truthful approved non-synthetic human actor for grantedBy and sets archive context system:terra-286-rollback-probe; actor NAME/consent still missing, so DO NOT RUN. Exact recovery manifest: fixture ID 7870b189-e407-478f-ab42-157ee407f6bf, terminal ROLLBACK, then fresh-connection read-only db/migrations/dryrun/2026-10-06-terra_242-postrollback-readback.sql SHA256 6cc83d27666fca9d4350675cead541952e4fdad88dd18dfaaa11475994981c66 (blob 46b3ac24), asserting fixture count 0, original vUserGroups MD5 b758464a restored, and three INSERT triggers. Shared-owner verdict and exact new source review still pending; no DDL/DML run.
-
Enamel shared-object INSERT clearance BLOCK for requested historical probe SHA256 af136e3f2531fde8f470d9368b15757721e59b41fbf233fe51314624c91f04a2 / blob cd9c8926: its line 173 copies v_source.grantedBy to a fabricated rollback fixture. PM ruled the fixture must set grantedBy NULL if nullable, and db-terra must report nullability/FK before revision; no real grantor substitute. Working path has already changed to SHA256 3ed4e3d6 and still requires approved actor / sets grantedBy=v_actor. TERRA-286 still lacks the PM-required decision event withdrawing actor-of-record for terminal-ROLLBACK nondurable rows. Existing mechanism clearance covers transactional INSERT effects only, not these bytes. No DML run.
-
PM muwsbdfffl60 revised the rolled-back fixture attribution rule: no durable row means no human actor-of-record consent gate. LIVE catalog independently read: public.userGroups.grantedBy is nullable uuid (attnotnull=false) with FK userGroups_grantedBy_fkey REFERENCES users(id); NULL is permitted. New exact rollback probe SHA256 29d30aa63b4200cc31a23f2bf22cd197bab3584474e0eeff36e18ec102a0b821 / immutable blob cd20d741eee5ce3127647dd1993b6b26c143e4a0 sets grantedBy=NULL, removes caller-claimed actor/config, retains fixed fixture ID 7870b189-e407-478f-ab42-157ee407f6bf, SERIALIZABLE first after BEGIN, SHARE lock, positive old-source control, terminal ROLLBACK. Current three INSERT guards create no archive/history row, so no archive context is needed. Recovery: terminal ROLLBACK followed by fresh-connection readback SQL 6cc83d27 checking fixture 0, old view MD5, INSERT trigger count. PostgreSQL 17 NOTIFY docs state delivery occurs only if the transaction commits; rollback sends none: https://www.postgresql.org/docs/17/sql-notify.html#SQL-NOTIFY-DESCRIPTION . Exact new migration d265740a and probe 29d30aa review pending; no DDL/DML run.
-
WITHDRAWN CONDITION, PM muwscozc6oe8: the previously recorded named consenting human actor-of-record requirement does NOT apply to this rollback-only probe. The residue rule attaches that consent gate to DURABLE rows; terminal ROLLBACK leaves no grant/history row, so the consent gate is not engaged. Current exact probe 29d30aa6 sets nullable FK-backed userGroups.grantedBy=NULL rather than copying a real grantor. BEFORE any DML, the fixed fixture ID is 7870b189-e407-478f-ab42-157ee407f6bf; recovery path is terminal ROLLBACK; post-rollback separate-connection readback 6cc83d27 must show zero fixture rows in base table/view, original viewdef MD5 and trigger inventory. Shared Enamel DB seat cleared the INSERT mechanism on current catalog (muwscpn8c3ev), not migration/probe execution. Revised migration d265740a and probe 29d30aa6 still await exact-byte verdicts. No DDL/DML run.
-
Post-rollback readback artifact refreshed to match db-enamel-ca exact clearance: db/migrations/dryrun/2026-10-06-terra_242-postrollback-readback.sql SHA256 1609407edca5923020f61003f417aa990c9a7fd4387c15c1abdfa3307192e00c, immutable blob 7a7a5226. Fresh-connection read-only check now asserts fixture ID absent in BOTH public.userGroups and public.vUserGroups, original viewdef MD5 b758464a restored, and 3 INSERT trigger inventory restored. Supersedes earlier 6cc83d27 readback artifact. No run.
-
Enamel shared-object INSERT clearance for successor rollback probe ONLY: db/migrations/dryrun/2026-10-06-terra_242-future-end-rollback.sql SHA256 29d30aa63b4200cc31a23f2bf22cd197bab3584474e0eeff36e18ec102a0b821, immutable blob cd20d741eee5ce3127647dd1993b6b26c143e4a0. Source has fixed fixture ID 7870b189-e407-478f-ab42-157ee407f6bf, grantedBy=NULL at lines 171-177, SERIALIZABLE at line 29, terminal ROLLBACK at line 219; BWI decision at 15:00:10Z documents nullable grantedBy/FK and withdrawal of human consent for nondurable rollback rows. Existing live-catalog census showed no INSERT statement trigger/outbound call/sequence effect; transactional INSERT and view DDL roll back. This clears the Enamel tenant effect of that one rollback fixture, NOT the historical e4a74d6f or af136e3f bytes, NOT the probe logic/audit verdict, and NOT an apply GO. Run remains contingent on exact source/probe audit and fresh post-rollback zero-row/catalog readback. No DML by Enamel seat.
-
Successor source draft SHA256 902f517124e3fba9fff3c6e585eef7011895b2ce5361cad84ef19c9de66e5bec (db/migrations/draft/terra_242_vusergroups_future_end.sql), supersedes d265740a. Added SET TRANSACTION ISOLATION LEVEL SERIALIZABLE as first statement after BEGIN, before SHARE lock and prestate read. Postflight retains full expected viewdef MD5 dc42075cecf356c6c3f6a3478bb83a78, explicitly differs from old b758464a, and restores both temporal predicate substring assertions as behavioral checks. Independent SELECT-only live pg_get_viewdef computation reconfirmed old b758464a and one-arm replacement dc42075c; no DDL/DML, no source push or apply. Current probe 29d30aa6 and readback 1609407e unchanged; exact-byte reviews required on new source.
-
Rollback probe rebuilt against CURRENT source SHA256 902f517124e3fba9fff3c6e585eef7011895b2ce5361cad84ef19c9de66e5bec. New probe db/migrations/dryrun/2026-10-06-terra_242-future-end-rollback.sql SHA256 3aee5ca7a548b871c0d3e6b0a816ab9cc085f959c0329a19d529e9534a758096, immutable Git blob 1ab2cc57d8d9bcb225ce40a57514eed3dc58d4b2; supersedes 29d30aa6 and all earlier probe bytes. Contains exact 902 source executable text with production COMMIT omitted, one BEGIN, SERIALIZABLE first, SHARE lock before any SELECT, full expected viewdef MD5 plus temporal substrings, grantedBy=NULL, positive old-source control, future-end old=0/new=1 contrast, terminal ROLLBACK. Static embedded-source/transaction-order check PASS; no SQL executed. Exact probe review and fresh readback 1609407e still pending before any run/apply.
-
Current pair after PM muwt129xybi0 snapshot-order comment requirement: migration SHA256 5954549c7233166ca44f873237554f35527cae8c99cedcf1a07c17af0adb5048, immutable Git blob 980915cce5ed06777d3650c0abdece84e53c4ffd; rollback probe SHA256 35e2d71ffd96737f8f6ff0e429ff885fccd805e354c8c1bff65753666e92d250, blob 3202995eeb75865638ddaadfd044c1a145d39601. Source change vs 902f5171 is COMMENT-ONLY; normalized noncomment/nonblank executable text exactly equal. Comment beside SHARE lock in both states SERIALIZABLE first-read snapshot hazard and why lock must precede SELECT/DML. Probe embeds exact 595 source without COMMIT; static check one BEGIN, isolation then lock before DO preflight/any SELECT, no actor GUC, grantedBy=NULL, terminal ROLLBACK PASS. Supersedes 902f/3aee review targets. No SQL run, no push/apply; exact new verdicts requested.
-
Current exact pair after PM muwt1dyotfoq clarified migration isolation: migration SHA256 c5ff292350130309a95a527fc63782fd9089812d4d3e9269682e5fe309a1ac8d, immutable Git blob 32d224073e2c82319ab7fd4ba94d2c088c9a411a; probe SHA256 c32415f0abb91a1a9556c7aa39f70efaf24d012886679d0500236b450c7db634, blob 532ac74fb3f59e01972f5cd1f8b5a50ed43feff4. Migration no longer sets SERIALIZABLE; its SHARE lock is first data-touching statement after BEGIN before any SELECT/preflight, retaining full expected viewdef MD5 and two temporal substring checks. Probe embeds exact migration source sans COMMIT with probe-only SERIALIZABLE inserted immediately after BEGIN, then SHARE lock before any SELECT/DML, grantedBy=NULL, terminal ROLLBACK. Static embedded-source/order/no-actor check PASS. Actor-consent WITHDRAWAL decision already exists at 15:00:49.919Z; live nullable uuid/FK fact at 15:00:10.845Z; db-enamel exact prior-probe INSERT mechanism clearance at 15:01:25.839Z. All old digests superseded. No SQL run/push/apply; exact new review required.
-
Enamel tenant-boundary SOURCE PASS on exact terra_242 migration SHA256 902f517124e3fba9fff3c6e585eef7011895b2ce5361cad84ef19c9de66e5bec, immutable Git blob 5b2429bb1914597a5102f8f3f71edf21f884ed4c. Compared with prior d265 blob: BEGIN then SERIALIZABLE, SHARE lock on shared userGroups before first SELECT/count and held through COMMIT; global future-end zero check is writer-stable. Postflight pins full new pg_get_viewdef MD5 dc42075c, rejects equality with old b758464a, and retains both temporal substring checks. No runtime probe or apply; expected new MD5 is independently SELECT-only derived, installed server deparse remains unexercised. Enamel shared-table source scope only, not whole migration/app GO.
-
Auditor BLOCK on historical 29d30aa6 copied COMMIT header accepted and repaired in current probe. Migration remains c5ff292350130309a95a527fc63782fd9089812d4d3e9269682e5fe309a1ac8d unchanged. Probe now SHA256 d81db877ac5ef7b6d95880288a9fa887f924ac8c89ee83763f455cf0ac7faa8e, immutable Git blob 865c2f1feea45fb2bc8dc29c874c9219c9fe2aaa, superseding c324. Only comments changed vs c324: copied migration header/lock comments now correctly say terminal ROLLBACK, and explain SERIALIZABLE first-read snapshot in probe. Normalized noncomment/nonblank executable SQL identical to c324; one BEGIN, isolation then SHARE before first SELECT, grantedBy=NULL, terminal ROLLBACK static PASS. Exact new probe review and matching GO required; no SQL run.
-
Enamel exact-file SOURCE BLOCK on rollback probe SHA256 3aee5ca7a548b871c0d3e6b0a816ab9cc085f959c0329a19d529e9534a758096 / immutable blob 1ab2cc57. Executable shared INSERT/SHARE-lock mechanism remains equivalent to cleared 29d (fixture fixed ID, grantedBy=NULL, lock before first SELECT, terminal ROLLBACK), so Enamel tenant side-effect clearance carries. But copied header :20-22 and :33-35 still state lock held through COMMIT; top note :8-9 merely explains the contradiction instead of correcting it. :31 says freeze snapshot before any query but omits load-bearing warning that under SERIALIZABLE any SELECT before LOCK can establish snapshot before lock wait and miss a just-committed grant; a GUC set_config SELECT could reintroduce it. PM explicitly required both comment corrections. No probe run or DDL; exact-file BLOCK pending new digest.
-
Independent Enamel-role metadata confirmation from support-evolutiva-cc tag muwt4j69hdrs: public.userGroups.grantedBy is uuid NULLABLE (pg_attribute.attnotnull=false) and FK userGroups_grantedBy_fkey REFERENCES users(id) (pg_constraint). Confirms db-terra-ca live read at 15:00:10Z; current probe d81db877 sets grantedBy=NULL. This is column metadata only, not probe execution or apply clearance.
-
Probe comment freeze after PM muwt4u9u70y8: migration c5ff2923 unchanged; current rollback probe SHA256 4b2055dfcccd7418f5dc550c1f44a43d463969a0395502c80099f9aebd201f64, immutable Git blob 941b980bf3faa2634de7083e9d4dba881b10ba0f, supersedes d81/c324/29d. Added adjacent LOCK warning: do not add SELECT or SELECT set_config GUC before LOCK, because SERIALIZABLE snapshot can predate a writer committing during lock wait. Header already says ROLLBACK. Normalized executable identical to d81, static one-BEGIN/no-COMMIT/terminal-ROLLBACK check PASS. No SQL run. PM earlier GO names historical d265/29d and readback 6cc; exact current migration c5ff/probe 4b/readback 1609407e need digest-bound review/authorization before run.
-
Enamel exact-source split verdict on immutable new blobs. Migration SHA256 5954549c7233166ca44f873237554f35527cae8c99cedcf1a07c17af0adb5048 / blob 980915cc: scoped shared-object SOURCE PASS; diff from 902f is comment-only, replacing loose snapshot sentence with load-bearing SERIALIZABLE first-read/write before SHARE-lock warning, SQL unchanged. Probe SHA256 35e2d71ffd96737f8f6ff0e429ff885fccd805e354c8c1bff65753666e92d250 / blob 3202995e: exact-file SOURCE BLOCK remains on copied :20-22 and :34-36 COMMIT-through-lock wording despite terminal ROLLBACK :231. Top :8-9 wrapper says embedded migration comments describe production COMMIT but leaves contradictory operative instructions; source/probe executable equality does not make probe comments true. Enamel shared INSERT/lock mechanism clearance carries from 29d: fixed UUID, grantedBy=NULL, SHARE before SELECT, terminal rollback; this is not probe-logic or run/apply clearance. No SQL run.
-
After PM withdrew RUN GO on 29d30aa6, current exact probe is SHA256 7fa0c867b9387c6217026787c0682d9980cd3726ad44df6f5bdff07f1addbf3e, immutable Git blob a0a27c94765b2e7ca6734bfeb674d10d19e73cc8; source migration remains c5ff2923; readback remains 1609407e. One comment addition vs 4b2055df: adjacent LOCK note now states current correct order arose when actor-GUC SELECT was removed, not by moving LOCK, and future GUCs must follow LOCK via SET LOCAL. Previously corrected header states terminal ROLLBACK and no COMMIT. Executable SQL byte-identical after removing only comments/blank lines vs 4b; static one BEGIN, probe SERIALIZABLE then SHARE before first SELECT, terminal ROLLBACK PASS. Historical 29d whole-file BLOCK and RUN GO withdrawal stand. No SQL run; exact audit verdict and digest-bound new RUN GO needed.
-
audit pass: Enamel shared-tenant rollback probe documentation at immutable blob 3202995e / SHA256 35e2d71ffd96737f8f6ff0e429ff885fccd805e354c8c1bff65753666e92d250 only
payload
{"scope":"Enamel shared-tenant rollback probe documentation at immutable blob 3202995e / SHA256 35e2d71ffd96737f8f6ff0e429ff885fccd805e354c8c1bff65753666e92d250 only","outcome":"pass","evidence":"Withdraw earlier exact-file BLOCK on COMMIT wording for this digest: top-level lines 8-9 expressly say embedded migration comments describe production COMMIT, while probe omits it and ends in ROLLBACK. Serializable/SHARE order remains source-only; no probe run, no zero-residue readback, no migration apply. Working path has since changed and is outside this verdict.","reportRef":null} -
Correction to my scoped PASS on immutable probe 35e2d71f / blob 3202995e: PM final ruling relayed by audit-terra-ca muwtu8479yl7 requires copied COMMIT comments rewritten for terminal ROLLBACK and header naming comment-only divergences, with executable identity load-bearing. Required successor pair is HOLD pending new immutable digests and exact-byte review. No probe run or apply claimed.
-
audit fail: Exact-file documentation review of immutable rollback probe c32415f0abb91a1a9556c7aa39f70efaf24d012886679d0500236b450c7db634 / blob 532ac74f
payload
{"scope":"Exact-file documentation review of immutable rollback probe c32415f0abb91a1a9556c7aa39f70efaf24d012886679d0500236b450c7db634 / blob 532ac74f","outcome":"fail","evidence":"BLOCK: lines 20-23 and 33-38 still say SHARE held through COMMIT although probe has no COMMIT and exits ROLLBACK at 233; line 33 labels READ COMMITTED although probe sets SERIALIZABLE at 32. Top wrapper discloses copied comments, but PM final ruling relayed by audit-terra requires comments rewritten for this probe and header identifying comment-only divergences. Executable SQL not run; no rehearsal/apply authority.","reportRef":null} -
audit pass: Enamel shared-table source review of immutable migration c5ff292350130309a95a527fc63782fd9089812d4d3e9269682e5fe309a1ac8d / blob 32d22407 only
payload
{"scope":"Enamel shared-table source review of immutable migration c5ff292350130309a95a527fc63782fd9089812d4d3e9269682e5fe309a1ac8d / blob 32d22407 only","outcome":"pass","evidence":"BEGIN then SHARE lock before first SELECT and global future-end count; holds through COMMIT; full viewdef and ACL assertions retained. Delta from 5954549c removes SERIALIZABLE and documents READ COMMITTED lock ordering. Source only; no probe run or migration apply.","reportRef":null} -
Enamel clearance transfer audit on 2026-10-06: immutable probe 29d30aa6 (blob cd20d741) versus current 7fa0c867 (blob a0a27c94) is NOT comment-only. Exact diff includes executable postflight additions: explicit installed-viewdef MD5 distinct from old b758464a, plus separate temporal substring behavior assertion. A normalized noncomment/nonblank comparison is false. Therefore db-enamel-ca conditional 29d shared INSERT/SHARE clearance does not automatically transfer to 7fa; exact current digest review is requested. No DML/DDL/rehearsal run; current fresh readback SHA 1609407e.
-
audit pass: Enamel shared-table exact-file SOURCE review of immutable rollback probe d81db877ac5ef7b6d95880288a9fa887f924ac8c89ee83763f455cf0ac7faa8e / blob 865c2f1f
payload
{"scope":"Enamel shared-table exact-file SOURCE review of immutable rollback probe d81db877ac5ef7b6d95880288a9fa887f924ac8c89ee83763f455cf0ac7faa8e / blob 865c2f1f","outcome":"pass","evidence":"Diff from blocked c32415f0 is comments only; 184 noncomment/nonblank executable lines identical. Header and lock comments now consistently say terminal ROLLBACK and probe SERIALIZABLE first-read ordering. One BEGIN, SHARE before first SELECT, grantedBy NULL, no COMMIT, terminal ROLLBACK. Source only: no run, viewdef pin result, or zero-residue readback; PM current-digest run GO required.","reportRef":null} -
audit pass: Enamel shared-table exact-file SOURCE review of immutable rollback probe 4b2055dfcccd7418f5dc550c1f44a43d463969a0395502c80099f9aebd201f64 / blob 941b980b paired with migration c5ff2923
payload
{"scope":"Enamel shared-table exact-file SOURCE review of immutable rollback probe 4b2055dfcccd7418f5dc550c1f44a43d463969a0395502c80099f9aebd201f64 / blob 941b980b paired with migration c5ff2923","outcome":"pass","evidence":"Independent rehash and diff vs d81db877: only two lock-adjacent comment lines added, forbidding SELECT/set_config before SHARE under SERIALIZABLE. All 184 noncomment/nonblank executable lines identical: one BEGIN, SHARE before first SELECT, grantedBy NULL fixture, no COMMIT, terminal ROLLBACK. Enamel shared INSERT/SHARE-lock mechanism clearance carries on executable equality. No SQL run, pin result, zero-residue readback or apply; fresh PM GO must name current bytes.","reportRef":null} -
PM muwts6tcibc3 final comment ruling implemented on current 242 pair. Migration SHA256 5744b151fe7629fa6f76141e9d86ce2b69635d3649517de7153b9636371e5818, immutable Git blob f97e4d6a3e2afd1699c957b9406610492efd3a5c; probe SHA256 fcacc56c11838066870415a3156b19e19d96ca71c3e8f02878cb89e72c0ab88e, immutable blob b08a08a4f283e458e7fa25d4ffa08ba95fd9617c. Both lock comments now say LOCK is first data-touching statement and why no SELECT/set_config may precede it under SERIALIZABLE. Migration COMMIT wording stays true; probe states terminal ROLLBACK. Probe header names source comment lines 11-13 vs probe 21-23 and source 22-27 vs probe 33-41 as deliberate divergence. Static extraction up to DO $fixture$: 114 executable migration lines equal 114 embedded probe lines after omitting migration COMMIT and probe-only SET TRANSACTION; probe has zero COMMIT and terminal ROLLBACK. Fresh readback unchanged SHA1609407e. This is source preparation only; exact-byte review, Enamel shared-write clearance on current executable bytes, new digest-bound GO and live rollback/readback still pending. No DML/DDL run.
-
Digest ordering hold: PM later FINAL GO muwu12ffzccq named c5ff2923/4b2055df and barred further comment-only iterations. db-terra then proposed 7fa0c867/blob a0a27c94 citing earlier muwtbfnaboh3; independent diff shows only two comments added vs 4b, executable SQL identical. Enamel mechanism assessment unchanged, but clearance/run GO remains exact-bound to 4b pending PM explicit replacement ruling. Older directive cannot silently supersede later FINAL GO; no 7fa run reported.
-
PM muwtt3lw0mpv superseded comment-divergence ruling in favor of full embedded-source byte identity. Current migration SHA256 5744b151fe7629fa6f76141e9d86ce2b69635d3649517de7153b9636371e5818 / Git blob f97e4d6a unchanged; rebuilt rollback probe SHA256 41377208dfb991296a9e9839dbce0c450198eeffd90375098657188ba73a427e / retrievable blob 2c6c64bfdfcb1faf1cb0ffe79b2046fd435e4be5. Static check: all 147 source lines before final COMMIT, including comments, byte-identical to probe embedded span after deleting only its probe-only SET TRANSACTION SERIALIZABLE; header outside span explains production COMMIT-duration comments, probe terminal ROLLBACK and pre-lock SELECT/set_config snapshot hazard. Probe one BEGIN, zero COMMIT, one terminal ROLLBACK. Fresh readback remains SHA 1609407e. Historical 5954549c/35e2d71f are not restored because their migration included SERIALIZABLE, removed in the later current source. Exact current reviews, Enamel clearance and a new GO pending; no SQL run.
-
PM muwtuawd0xm9 rehearsal GO names retired migration/probe SHA256 5954549c/35e2d71f. Current frozen source/probe are 5744b151/41377208 after later READ COMMITTED source and full-byte-identity wrapper changes. Old source sets SERIALIZABLE and its rehearsal would not validate the current migration; no authority transfer to current digest. db-terra-ca process also lacks a Terra psql connection URL/service for the earlier mandated one-connection psql -X -v ON_ERROR_STOP=1 -f route. PM notified for exact current-digest reviews/GO and connection primitive. No DML/DDL/probe run; no viewdef pin result or residue claim.
-
PM muwtuq66uzkh GO on PASSED old 5954549c/35e2d71f paused for exact source drift report. Immutable-blobs-versus-current diff measured: current migration 5744b151 intentionally removes SET TRANSACTION ISOLATION LEVEL SERIALIZABLE after BEGIN and revises lock comment for READ COMMITTED; therefore executable migration bytes differ from reviewed 595. Current probe 41377208 changes header/embedded comments only versus passed 35e; normalized noncomment/nonblank executable text is identical and still sets probe-only SERIALIZABLE. Newer current source is not untracked drift and was not reset. Running old 35e could rehearse old 595, not current 574 apply target. This process also lacks Terra psql URL/service for earlier mandated one-connection psql route. PM asked to rule intended apply source and execution route. No SQL run; no pin/residue claim.
-
PM muwtwobft2eg GO names retired c5ff2923/c32415f0, old 595/35 GO void. This GO is held: current authored pair is 5744b151/41377208; additionally db-enamel-ca already filed exact-file BLOCK:c32415f0 at 2026-10-06T15:35:07.130Z for copied COMMIT/READ COMMITTED comments contradicting terminal ROLLBACK/probe SERIALIZABLE (TERRA-286 audited fail event, blob 532ac74f). PM condition to hold on Enamel BLOCK is satisfied. No Terra psql connection route exists in this process for mandated -X ON_ERROR_STOP -f. PM notified; no SQL, readback, pin or apply result.
-
Post-GO digest conflict: PM FINAL RUN GO muwueu7w0r3v froze c5ff2923/blob 32d22407 + 4b2055df/blob 941b980b with readback 1609407e and retired earlier GOs. db-terra-ca muwujw209r5x now proposes 5744b151/fcacc56c citing older PM muwts6tcibc3 and reports no SQL run. Enamel clearance and GO do not transfer. Hold new pair pending PM explicit retain-or-revoke ruling before any SQL; no fresh exact-file verdict issued by Enamel.
-
2026-10-06 live rollback rehearsal under PM RUN GO muwueu7w0r3v: exact on-disk SHA256 migration c5ff292350130309a95a527fc63782fd9089812d4d3e9269682e5fe309a1ac8d, probe 4b2055dfcccd7418f5dc550c1f44a43d463969a0395502c80099f9aebd201f64, readback 1609407edca5923020f61003f417aa990c9a7fd4387c15c1abdfa3307192e00c. Supabase execute_sql submitted the complete probe as ONE query string (BEGIN through terminal ROLLBACK), returned isError=false and [] (notices not surfaced). Earlier explicit multi-statement error-propagation control raised P0001 through this connector, so a failed preflight/postflight/fixture assertion would have surfaced. Thus the full viewdef identity postflight at probe :114-119 passed for derived dc42075cecf356c6c3f6a3478bb83a78; positive old-source=1 and contrast old=0/new=1 assertions at :207/:226 passed. Separate fresh execute_sql call of exact readback returned fixture_rows=0, fixture_view_rows=0, viewdef_md5=b758464ab426f33fd82af4b566db3d59, insert_trigger_count=3. No migration applied; registry/apply GO still separate.
-
Audit-terra-ca muwvbrqjxni3 independently verified rollback rehearsal on frozen c5ff2923/4b2055df: successful full BEGIN...ROLLBACK assertion path; error-propagation P0001 control; fresh live SELECT confirms fixture base/view rows 0/0, old viewdef MD5 b758464ab426f33fd82af4b566db3d59, INSERT triggers 3. Full new viewdef pin dc42075c, positive old source=1, old fixture=0/new view=1 were assertion-backed despite suppressed NOTICE output. This is audit-reported runtime proof and independent poststate read, not my own live query. Migration remains unapplied; no apply GO.
bug
1w ago by pmmaster-evolutiva-cc
1w ago