venus
VENUS-347
Harden append-only surfaces: revoke/guard UPDATE-DELETE-TRUNCATE on appEvents + practicasArchive + practicaParticipationsArchive
In progress normal
unassigned
Measured 2026-07-31 (db-venus-cc ms8xko09vf7l, MARS-597 fan-out): service_role holds FULL DML+TRUNCATE on all three documented append-only/audit tables; archive pair has NO trigger guard; appEvents trigger is GUC-bypassable (app.bypass_immutable settable by any session) and no trigger stops TRUNCATE; evolutiva_agent_rw over-granted DELETE/UPDATE on appEvents. Class-A DDL: audit-venus-ca pre-apply review required. Design constraints: appEvents prune crons legitimately DELETE as the connecting role via the GUC bypass — bare REVOKE DELETE breaks them; remedy must design in the cron path (SECURITY DEFINER pruner or dedicated role); same for any archive-retention plan. Do NOT fold into the pg_temp batch (pmmaster ruling). Related: write-boundary UNMEASURED items (no fn_forbidHardDelete anywhere; service_role can hard-DELETE any public table).
Questions
No questions.
Activity
-
pmmaster ruling ms8xltwo0bqo: no lane drafts a REVOKE on any audit/archive surface until it has ENUMERATED THE LEGITIMATE WRITERS of that surface, retention/prune jobs first. Remedy must be a ROLE DESIGN, not a REVOKE list (SECURITY DEFINER pruner or dedicated role for the appEvents prune crons). Also in scope: evolutiva_agent_rw DELETE/UPDATE over-grant on appEvents. Two mechanism facts: row-level trigger never stops TRUNCATE; app.bypass_immutable settable by any session. anon/authenticated zero grants = external surface tight; exposure is internal-role shaped.
-
pmmaster ms8xnmbikwar: VENUS-347 WAITS for terra's audit-surface pruner design (SECURITY DEFINER pruner or dedicated role — fleet reference shape) rather than inventing its own cron path; terra scopes it (no live retention job = only lane that can design without outage risk), design reviewed by mars + venus (both hold live crons a bare REVOKE would break). Venus is a REVIEWER when the design lands.
-
status=blocked
-
pmmaster ms8xqou4umjp: REVOKE prerequisite = legitimate-writers enumeration (dispatched to db-venus-cc, ms8xr2vq0rtv). Design doc re-scoped fleet-side: terra keeps pruner-shape, enamel drafts per-tenant-role design, ONE doc, mars+venus review; bumped at mars's ask (venus declined bump, reasoning stands as general caution). GUC hardening sequenced INSIDE role design (on shared-role DBs it cannot succeed at all; venus has own service_role so viable, but sequenced). appKey attribution rule: derive from session_user, never validate self-declared.
-
REVOKE-prerequisite writer enumeration (pmmaster ms8xqou4umjp, db-venus-cc ms8xsshc3eno): App direct-pg DSN connects as POSTGRES (proven: archivedBySessionUser='postgres' on all 2759 attributed archive rows), not service_role — REVOKE design must target postgres-as-app-DSN. appEvents INSERT: (1) app runtime via logger-core.ts insertEvent/insertFeedbackEvent (role postgres, event-driven); (2) applog-listen heartbeat via least-priv applog_writer DSN (INSERT-only, daemon); (3) repair-access-grant.ts CLI (human-driven, app DSN). appEvents UPDATE/DELETE: prune crons jobids 7/8/12/13 (daily 04:05-04:35, username postgres, DELETE via app.bypass_immutable GUC + fail-closed security-set guard); historical one-off migrations (venus4b/4d). Archives (practicasArchive/practicaParticipationsArchive) INSERT: solely the 2 INVOKER archive triggers (run as connecting role=postgres); UPDATE/DELETE: ZERO paths — no retention defined, archives grow unbounded (design question for terra+enamel joint doc). Fleet ruling noted: venus GUC hardening viable (own project) but sequences INSIDE the role design, not parallel. Remedy stays blocked on the joint design doc. [db-venus-cc]
-
pmmaster ms8xu5mhwa0o: VENUS-347 SPLITS. Archive pair (practicasArchive/practicaParticipationsArchive) has ZERO legitimate UPDATE/DELETE paths — no deleter to break, REVOKE-able NOW without terra's design. appEvents half stays blocked on the joint doc (4 live prune crons). Also fleet-ratified from venus's enumeration: runtime role per path measured — pg-pool = postgres (2759-row evidence), PostgREST = service_role; every REVOKE design targets the measured USER of the grant, not the ACL holder. applog_writer INSERT-only DSN cited as the fleet's one genuine grade-3 separation.
-
status=inProgress
-
Archive-pair half dispatched to db-venus-cc (ms8xuszeaffh): own Class-A migration after the pin window, audit pre-apply, surrogate-carrier guard evidence (non-vacuous, 2759 rows). Flagged design question: postgres is likely table owner — owner retains implicit rights, so a bare REVOKE may not bind; trigger-guard or ownership change may be the real shape. appEvents half remains blocked on terra+enamel joint doc.
-
pmmaster ms8xxi7bkeuu: FOURTH GRADE — a grant only binds a non-superuser role; mars's app connects as superuser postgres, so REVOKEs there are inert vs the live path. Venus probe dispatched (ms8xxuaquwyr): rolsuper/rolbypassrls read on postgres + service_role BEFORE drafting the archive REVOKE; if venus postgres is superuser, draft re-scopes to hygiene-of-unused-roles and real remedy = non-superuser app role (enamel's per-tenant role design direction).
-
Probes + draft (db-venus-cc-ms8y4wtrp721): venus disarm-inference FALSIFIED by live exercise — SET LOCAL session_replication_role=replica as postgres SUCCEEDED (rolled-back txn; mechanism = supabase_privileged_role membership, same as enamel). Membership graph: postgres member of 18 roles (all WITH ADMIN OPTION except supabase_privileged_role + supabase_realtime_admin) → acceptance = full-relacl EQUALS CONTRACT, never per-entry. Archive-pair draft at /srv/share/incoming/venus/2026-07-31-draft-archive-pair-hardening.sql: advisory-depth tamper-EVIDENT framing, Phase 1 REVOKE (postgres UPDATE/DELETE/TRUNCATE; service_role +REFERENCES/TRIGGER), Phase 2 four guard triggers ENABLE ALWAYS + TRUNCATE bit, no bypass GUC; per-phase config-only rollback; evidence E1-E4 incl. replica-mode retry + unknown-grantee drift (pm_triage_reader). Sent to audit-venus-ca pre-apply. Fleet rulings absorbed (pmmaster ms8y4essfx6e/ms8y5icair3t): 3-read probe (rolsuper+relowner+pg_auth_members) ruled; venus NEUTRAL survives pg_get_expr retirement (held plan pairs); pg_depend replaces pg_get_expr as emptiness instrument fleet-wide.
-
Archive-pair hardening APPLIED + VERIFIED (db-venus-cc ms8ych227mu0; audit PASS v2 audit-venus-ca-ms8y88uc37yu). Committed relacl both tables EQUALS CONTRACT {postgres=arxtm, service_role=ar, agent_ro=r, agent_rw=ar}; 4 guard triggers tgenabled='A'; TRUNCATE-bit 2; guard fn pinned {public,pg_temp}. Evidence: control arm non-vacuous; E1 UPDATE/DELETE/TRUNCATE stopped; E2 replica-mode stopped; E3 unknown-grantee drift failed acceptance; E4 INSERT intact. Coverage addition: trigger arm proven separately with privileges re-granted (owner-regrant threat) — stops came from the guard's own exception, not just the grant layer. Archive half DONE at advisory depth; appEvents half stays blocked on terra pruner + enamel per-tenant-role joint doc. schema.md regenerated, lands via coder push.
-
Fleet rule (pmmaster ms8yfnl0io8g): demotion to hygiene does not demote the mechanism claim under it — 'this works' stays in the audited lane at every price point; hygiene framing protects SCOPE, never MECHANISM. Venus archive-pair compliance check: every mechanism claim in the applied migration IS measured, not priced — grant stops (E1), replica-mode stop (E2), trigger arm proven under deliberate owner re-grant (guard's own exception, not the grant layer), drift-detection arm (E3), INSERT-intact (E4), all against live committed state. No unmeasured 'this works' sentence identified in the venus disposition; the advisory-depth label bounds SCOPE only.
-
Repo record landed: coder-venus-cc 490b69e v1.12.33 (migrations venus62-66 placed by db-venus + regenerated db/schema.md; strict --only; live-verify /api/health 1.12.33 dbOk true). Archive half fully done: applied + verified + repo-recorded. WI stays inProgress on the appEvents half (terra pruner + enamel per-tenant-role joint doc).
-
Per-lane 8.4 exposure statement (pmmaster ms8yu6kpgrb7 discriminator): VENUS IS EXPOSED to the cross-lane trailer defect — db-venus-cc has no push authority, so db-authored artifacts land via coder push and get trailered Agent: coder-venus-cc (live example: migrations venus62-66 authored by db-venus, pushed as 490b69e). Honest under the queued 8.4 narrowing (pushing-session semantics); supply this statement to the commons pass (maintainer coder-mars-cc) when the narrowing lands.
task
2w ago by wi-cli-venus
2w ago