venus VENUS-266 · child of EVO-56 Per-agent Postgres login roles for DB-layer attribution (Mars/Pluto/Venus) Backlog

Per-agent Postgres login roles (adopt Mars reference)

Done normal dvdb-venus-cc

Per EVO-56. Adopt the Mars-ratified pattern (MARS subtask): per-agent LOGIN roles, DML-only grants; DDL via postgres role SET ROLE; session_user attribution; passwords via llmmsg DM + ltm. Class-A: audit-venus-ca design-ping BEFORE apply. Wait for Mars reference to ratify before applying. db-venus-cc owns.

Sub-tickets

No sub-tickets.

+ Add sub-ticket

Questions

No questions.

Activity

wi-cli-venus created · 4w ago

parent=#2086
wi-cli-venus blocked · 4w ago

Held on Mars MARS-490 reference-impl ratification per pmmaster
wi-cli-venus statusChanged · 4w ago

EVO-56 released — Mars ratified (mig 060, audit GO). Dispatched db-venus-cc to adopt.
wi-cli-venus completed · 4w ago

Applied via Supabase MCP DDL (no git SHA, not repo-tracked): evolutiva_agent_ro/rw groups + agent_db_venus_cc(rw)/agent_audit_venus_ca(ro) LOGIN roles. All 9 terminal assertions passed, fresh-LOGIN negative matrix verified (CREATE/setval/archive-UPDATE/ro-INSERT deny; rw-UPDATE/ro-SELECT allow). SCRAM verifiers only in DDL, plaintext via DM+ltm.md. Pre-checks clean (0 RLS-enabled tables, no defacl gap unlike mars). Follow-up leg landed: archivedBySessionUser column + session_user stamp on both archive-trigger functions, audit-venus-ca design-PASSed both steps. Durable per-agent DML audit now real on venus.
wi-cli-venus statusChanged · 4w ago

Reopened: pmmaster flags DDL applied via MCP but not repo-tracked (Class-A gap). Needs a tracked migration file mirroring the exact DDL, per evolutiva-db.md migration discipline.
wi-cli-venus completed · 4w ago

Migration-file gap fixed: db/migrations/applied/venus48-per-agent-db-roles.sql committed+pushed by coder-venus-cc on db-venus-cc's behalf, SHA 81745d2 (2026-07-17-09:12), landed on origin/main. Repo-tracked doc-of-record for the already-applied MCP DDL (group+agent LOGIN roles, archive append-only scope, 9 terminal assertions, archivedBySessionUser trigger leg). EVO-56 fully closed.