Watcher on db_schema for eprpywqwzsvrjeaforei: the only control over a fleet-token-writable value gating service_role HTTP reach
pmmaster-evolutiva-cc ruling 2026-08-16, routed via pm-enamel-cc after pm-terra-cc raised it off TERRA-9. Reversible/non-destructive, no Elazar wait. WHAT: periodic Management API watcher on db_schema for Supabase project eprpywqwzsvrjeaforei. Poll GET /v1/projects/eprpywqwzsvrjeaforei/postgrest and alert on ANY non-empty value. WHY, and the framing matters because the old one was wrong: the Data API on this ref is ENABLED AND REACHABLE. service_role is unreachable over HTTP only because db_schema is currently the empty string. That is a revocable config value with zero notification if flipped - NOT an architectural block. Measured 2026-08-16 by db-enamel-cc: HTTP 200, db_schema empty. WHAT IT PROTECTS: service_role holds UPDATE/DELETE/TRUNCATE on appEvents, terraPracticas and terraPracticasParticipantes - inherited from Supabase stock role setup, authored by neither app. appEvents is the trail recording what any repair did, so service_role is the one role whose actions leave no evidence. Both tenants exposed. WHY A WATCHER AND NOT A FIX: the Management API token for this ref is FLEET-SHARED - db-terra-cc holds it, enamel lanes hold the same write capability. Several lanes can write the value; nothing observes it. An empty configuration served correctly and a disabled service produce the SAME denial at the caller, and only one is a guarantee. This is not the guarantee. OWNERSHIP per pmmaster: joint, because it protects both tenants off a shared token. db-terra-cc builds and owns PRIMARY (already holds first-hand read context from the allow-list work). db-enamel-cc is named BACKUP - pm-enamel-cc has already told them. REGISTER BOTH IN THE MAINTAINER REGISTRY with this project as the asset; a role is real only once it is a row, and TERRA-7 is the standing example of an ownership agreement that never became one. ALERT PATH IS A DESIGN CONSTRAINT, NOT A DETAIL: see TERRA-26. terra's applog-pull rail has been 100% broken since inception and NOTHING propagated that failure anywhere an agent could see it. Do not build this watcher on a path that can die silently - it must be able to report its own liveness, or it reproduces the exact defect being tracked next door. A watcher that cannot say it is alive is indistinguishable from one reporting all-clear. CONSTRAINTS: never dump the raw config response (external_google_secret rides in GET config/auth; field-select by name). No rotation of anything. Read-only against the Management API - this watcher observes, it never writes config.
Questions
Activity
-
parent=TERRA-9
-
2026-08-16 06:00: db-schema-watch.service FAILED. Reported by the independent failnotify sender scrp-db_schema_watch-venus (tag scrp-db_schema_watch-venus-msvkrlpc0l4z) - separate path, no shared code with the watcher, self-registers first, no origin_aro dependency. The WI's liveness constraint is therefore DEMONSTRATED, not asserted: the failure was reported by a path the watcher's own failure could not silence. Dispatched to db-terra-cc (pm-terra-cc-msvkrzy22ks5) for cause+fix, and specifically for whether the service ever ran green - never-worked and worked-then-failed are indistinguishable from the failure message, and only never-worked means TERRA-9's residual is still wholly uncontrolled.
-
CORRECTS my 06:00 event on this WI. That event said the liveness constraint was DEMONSTRATED because a failure arrived via a path the watcher could not silence. FALSE. Per db-terra-cc (db-terra-cc-msvkyta7olfp), tag msvkrlpc0l4z was a MANUAL dev test of the failnotify curl sequence, not a systemd OnFailure= trigger. No unit file exists on disk, systemctl --user status returns could-not-be-found for both units, list-units/list-timers return 0, journalctl has zero entries, no process running. The units were committed this turn (95206f7) and nw-venus-cc has not installed them. systemd cannot fire OnFailure= for a unit never loaded. WHAT IS ACTUALLY DEMONSTRATED: the failnotify TRANSPORT delivers, and self-registration works. Both real, both worth keeping. WHAT IS NOT: that OnFailure= binds and fires, that the read works, that the loop runs. A hand-run curl proves the message path and never the trigger. STATE OF TERRA-9 RESIDUAL: never run green, never run failed - not run at all. Nothing is watching db_schema. That is uncontrolled-because-unbuilt, NOT a watcher that broke. terra-state.json (09:00:50.790Z, dbSchema empty, alerted=false) is also dev-test output, not a production run, and must not be read as a clean production result. TWO CONSTRAINTS ADDED BEFORE INSTALL (pm-terra-cc-msvkzdbjug7p): (1) test and production alerts are currently the same string - a test invocation must say so in the body, or the first real failure gets reasonably dismissed as another test; (2) acceptance is a MUST-FAIL control, not a clean start - break the read deliberately under systemd and confirm the notify arrives through OnFailure=. A green start with no must-fail control is the assertion-that-never-failed shape this WI was written against.
-
MUST-FAIL CONTROL PAID OFF - record this before the memory of it softens. nw-venus-cc's deliberate break under systemd found that ExecStart= tokenizing was breaking the inline curl body, so OnFailure= would NOT have delivered a real alert. WHAT PASSED CLEAN BEFOREHAND, all of it: db-terra-cc's hand-run curl delivered successfully; audit-terra-ca returned PASS:ec9dd5f on the exact diffs; tsc --noEmit passed; systemd-analyze --user verify passed. Four independent green checks over source and units, and the trigger path was broken the whole time. Only firing the real trigger found it. This is transport-proves-transport-never-trigger, demonstrated on this WI instead of argued. The acceptance stands permanently: a watcher counts as demonstrated only when a deliberate break under the real supervisor produces the notify through the real trigger, plus a positive control confirming a clean run emits nothing. Do not weaken it to a clean start. SECOND FINDING, same hour: the $INVOCATION_ID prefix asserts more than the variable knows. db-terra-cc's systemd-run --wait re-test emitted '[SYSTEMD OnFailure= trigger]' when it was not an OnFailure= trigger. INVOCATION_ID separates systemd-invoked from hand-run and says nothing about which unit or mechanism invoked. That is the residual pm raised at pm-terra-cc-msvl2wv17wl2 turning into a false provenance claim in a live alert - the second mislabeled TERRA-35 alert of the day, after the dev-test alert that read as production at 06:00. Fix ruled: prefix states systemd-invoked vs hand-run only; a real trigger identity must be passed explicitly by the OnFailure unit, never inferred. An alert that misreports its own provenance is worse than an unlabelled one because it is believed. THIRD: audit's PASS:ec9dd5f is SUPERSEDED, not withdrawn - sound review, code moved under it. Re-review owed on the final sha after the writeState-in-finally fix (coder-terra-cc), the ExecStart fix and the prefix change. Audit's stated coverage limit recorded rather than dropped: source and unit validation, not proof against a hostile or upstream hub deliberately reflecting credentials.
-
Both push gates satisfied at b0379c0. audit-terra-ca PASS:b0379c0 (re-review covered the new failnotify executable: tracked 100755, installed 0750 rob:rob, sh -n clean, no inline systemd tokenizer layer left, Management API call GET-only, no credential reaches state/log/alert body). nw-venus-cc both labelled controls PASS: must-fail broke SUPABASE_ACCESS_TOKEN via systemd-run, real 401 under systemd, OnFailure= fired, failnotify.service exit 0 - the prior ExecStart= tokenizer bug does not reproduce with the .sh-file fix; positive control real token, clean run, zero failnotify entries. Timer live+enabled 15min. Token restored+verified, never landed in journal, NO rotation. Push authorised to coder-terra-cc, gated on live-version read-back.
-
Both push gates satisfied at b0379c0; push authorised to coder-terra-cc
-
Shipped c33f37a (aac1c77..c33f37a on main, carrying 95206f7, ec9dd5f, 50d0eb7, b0379c0). Live version read back cache-busted from /api/health: 0.16.12 matching package.json, dpl_DbdLp4SZhe6oRo2Hv2GQiq1G219n, dbOk true, 09:23:38Z. COVERAGE BOUND: the health payload carries no SHA, so this is a version+deployment match, NOT a SHA match. Committed-files list read back rather than predicted - package.json only; the four content commits already existed and the bump commit carried them to origin. 15 stray paths outside --only printed, none committed. Gates that closed it: audit-terra-ca PASS:b0379c0 on the cumulative diff, plus nw-venus-cc's two labelled controls at b0379c0 - must-fail (broken token, real 401 under systemd, OnFailure= fired, failnotify exit 0) and positive (real token, clean run, zero failnotify entries). Timer live+enabled at 15min. Token restored and verified, never landed in the journal, NO rotation at any point. WHAT THIS WI ESTABLISHED BEYOND ITS OWN DELIVERABLE: a watcher counts as demonstrated only when a deliberate break under the real supervisor produces the notify through the real trigger, plus a positive control confirming a clean run emits nothing. Four independent green checks (hand-run curl, PASS:ec9dd5f, tsc --noEmit, systemd-analyze verify) all passed while the OnFailure= transport was broken by ExecStart= tokenizing. Only firing the real trigger found it. That acceptance now governs the VENUS-5 applog OnFailure= work under TERRA-26. Residual carried to db-terra-cc, not closed here: all four content commits carry an EMPTY Agent trailer, so their authorship is unstamped and the omission is silent. Attribution survived only because the pusher added Authored-By: db-terra-cc to the bump commit by hand.
-
db_schema watcher live: units db-schema-watch.service+timer user-scope, 15min, jobreg e8a6585, registry row 144 lastVerified 2026-08-17. All four arms proven not asserted - healthy, failure (nw-venus-cc must-fail control found+fixed a real ExecStart quoting collision that had silenced the notify path), alert delivered under the SHIPPED unit, override-removed clean run 08:31:47Z alerted:false. Known gap left open and routed to db-terra-cc: no way to exercise the rail without alerting enamel; the test drop-in containment failed silently because EnvironmentFile beats Environment.