schema SSOT export carries no RLS policy quals or metadata, so no revert can ever be proven against git
Measured 2026-10-06 during the VENUS-93 incident: db/schema.md, the venus SSOT produced by db/export-db.py, carries NO pg_policy content at all - only a boolean 'RLS disabled' flag at lines 14 and 1583. No commit of the export at any SHA contains policy qual texts or per-policy metadata (polcmd, polroles, polwithcheck, polpermissive). Consequence: when an unapproved ALTER POLICY landed on prod and was reverted, there was no committed byte source anywhere in the repo to verify the pre-incident quals against, so the baseline gap on VENUS-93 is permanent and recorded as unverifiable-by-construction. The live catalog gives today's state and nothing else. Wanted: export pg_policy per table - policy name, command, roles, permissive, USING and WITH CHECK expression text via pg_get_expr - plus relrowsecurity and relforcerowsecurity, so a future revert can be proven byte-identical from git. An SSOT that silently omits an entire object class is the same failure class as building an inventory from information_schema: it does not go stale loudly.
Activity
-
db/export-db.py: added query_rls_flags/query_policies, pg_get_expr-rendered USING/WITH CHECK per policy, relrowsecurity/relforcerowsecurity per table, counts.policies (live=24). Summary RLS sentence and Patterns bullet now derived live, no hardcoded prose. Mechanism proof: self-issued BEGIN; ALTER POLICY alumnos ... ROLLBACK; via DATABASE_URL_DIRECT showed pg_get_expr text differing inside the txn, reverted cleanly per fresh PGURI session after. Regenerated schema.md diff (116 lines) contains only the new sections + policies=24 count, zero trace of the test mutation. Committed 0bf0e98c268c604f7c3482d72828a6bfa3acc4b8 (db/export-db.py + db/schema.md only, Local-Author: db-venus-cc, NOT pushed - coder lane to push). Closing: nothing here asserts or reconstructs past state; this is a forward-looking live witness only, per the two constraints given at GO.
-
completed
-
VERBATIM mechanism proof, re-run live 2026-10-06 ~14:0x UTC (DATABASE_URL_DIRECT session, self-authored, nothing pre-written): BEGIN; SELECT pg_get_expr(polqual,polrelid) FROM pg_policy WHERE polrelid='public.alumnos'::regclass AND polname='admin full-access'; -> fn_isadmin() ALTER POLICY "admin full-access" ON public."alumnos" USING ((SELECT public.fn_isadmin()) AND true); SELECT pg_get_expr(polqual,polrelid) FROM pg_policy WHERE polrelid='public.alumnos'::regclass AND polname='admin full-access'; -> (( SELECT fn_isadmin() AS fn_isadmin) AND true) ROLLBACK; Then, SEPARATE fresh connection (PGURI, read-only role, not the same session): SELECT pg_get_expr(polqual,polrelid) FROM pg_policy WHERE polrelid='public.alumnos'::regclass AND polname='admin full-access'; -> fn_isadmin() Qual differed inside the transaction, reverted to the exact pre-mutation text on a fresh connection post-ROLLBACK. This is the control forced red, not a green line asserted from a single post-hoc read.