feat(document-records): make persistence retries idempotent - #312
feat(document-records): make persistence retries idempotent#312seonghobae wants to merge 70 commits into
Conversation
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review Please review the current exact head, especially the transaction-scoped idempotency serialization, replay digest binding, tenant-qualified receipt FK/RLS, and the real-concurrency PostgreSQL contract. Do not treat predecessor #107 evidence as current-head acceptance. |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== PR metadata and exact head =='
gh pr view 312 --repo ContextualWisdomLab/Orgmetra \
--json number,state,isDraft,baseRefName,baseRefOid,headRefName,headRefOid,mergeStateStatus,statusCheckRollup \
--jq '{number,state,isDraft,baseRefName,baseRefOid,headRefName,headRefOid,mergeStateStatus,statusCheckRollup}'
echo '== Changed files at the PR head =='
gh pr diff 312 --repo ContextualWisdomLab/Orgmetra --name-only
echo '== Repository head =='
git rev-parse HEAD
git status --short
echo '== Locate relevant artifacts =='
fd -a -i '0024.*document.*record.*idempotent.*persistence.*\.sql|0309.*|test_document_record_idempotency_postgres\.sh' . || true
echo '== SQL migration outline and content =='
sql_file="$(fd -a -i '0024.*document.*record.*idempotent.*persistence.*\.sql' . | head -n1)"
if [ -n "$sql_file" ]; then
ast-grep outline "$sql_file" --items all || true
nl -ba "$sql_file"
fi
echo '== PostgreSQL contract content =='
test_file="$(fd -a -i 'test_document_record_idempotency_postgres\.sh' . | head -n1)"
if [ -n "$test_file" ]; then
nl -ba "$test_file"
fi
echo '== ADR content =='
adr_file="$(fd -a -i '0309.*' . | head -n1)"
if [ -n "$adr_file" ]; then
nl -ba "$adr_file"
fi
echo '== Related table definitions, policies, and persistence callers =='
rg -n -i -C 4 \
'document_records?|idempotency|replay.*receipt|persist_document_record_once|row level security|create policy|force row level' \
--glob '*.sql' --glob '*.sh' --glob '*.md' .Length of output: 202018 🏁 Script executed: #!/bin/bash
set -euo pipefail
sql=database/migrations/0024_document_record_idempotent_persistence.sql
test=tests/test_document_record_idempotency_postgres.sh
echo '== Exact PR head and changed files =='
gh pr view 312 --repo ContextualWisdomLab/Orgmetra \
--json headRefOid,baseRefOid,isDraft,state,mergeStateStatus,statusCheckRollup \
--jq '{headRefOid,baseRefOid,isDraft,state,mergeStateStatus,checks:[.statusCheckRollup[]? | {name,conclusion,status,workflowName}]}'
gh pr diff 312 --repo ContextualWisdomLab/Orgmetra --name-only
echo '== Exact repository head =='
git rev-parse HEAD
echo '== Migration: complete function and privilege metadata =='
nl -ba "$sql" | sed -n '74,325p'
rg -n -C 3 'GRANT|REVOKE|ALTER FUNCTION|SECURITY DEFINER|persist_document_record_once' \
database/migrations
echo '== Parent document relation and its RLS policy =='
nl -ba database/migrations/0021_document_record_persistence.sql | sed -n '1,130p;315,345p'
echo '== Test: setup, helper functions, and sequential replay/conflict assertions =='
nl -ba "$test" | sed -n '1,172p'
echo '== Test: concurrency, tenant RLS, and append-only assertions =='
nl -ba "$test" | sed -n '173,280p'
echo '== Test registry state on this head =='
rg -n -C 2 'test_document_record_idempotency_postgres|document-record.*idempot' \
README.md docs .github tests 2>/dev/null || true
echo '== Migration ordering and application mechanism =='
rg -n -C 3 'migrations/|database/migrations|0024_document_record' \
tests .github README.md docs 2>/dev/null || trueLength of output: 84875
I found two issues.
The receipt table has the requested tenant-qualified composite foreign key and No hosted PostgreSQL acceptance is available on this exact head. I did not treat predecessor
|
|
@coderabbitai review Current exact head is now |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/Orgmetra"
expected_head="00ba4ee03df7ca86bfc3ef2383e04de211532296"
echo '== PR metadata =='
gh pr view 312 --repo "$repo" \
--json number,state,isDraft,baseRefName,baseRefOid,headRefName,headRefOid,mergeStateStatus,statusCheckRollup \
--jq '{number,state,isDraft,baseRefName,baseRefOid,headRefName,headRefOid,mergeStateStatus,checks:[.statusCheckRollup[]? | {name,status,conclusion,workflowName}]}'
echo '== checked-out commit =='
git rev-parse HEAD
git status --short
echo '== changed files: PR delta =='
gh pr diff 312 --repo "$repo" --name-only
echo '== changed files: exact base-to-head delta =='
base="$(gh pr view 312 --repo "$repo" --json baseRefOid --jq .baseRefOid)"
git diff --name-status "$base" "$expected_head"
echo '== locate primary and related artifacts =='
fd -a -i '002[0-9].*document.*record.*\.sql|0309.*|test_document_record_idempotency_postgres\.sh' . || true
echo '== outlines =='
for f in \
database/migrations/0021_document_record_persistence.sql \
database/migrations/0024_document_record_idempotent_persistence.sql \
tests/test_document_record_idempotency_postgres.sh
do
if [ -f "$f" ]; then
echo "-- $f"
ast-grep outline "$f" --items all || true
fi
done
echo '== idempotency migration =='
nl -ba database/migrations/0024_document_record_idempotent_persistence.sql
echo '== predecessor document schema and RLS =='
nl -ba database/migrations/0021_document_record_persistence.sql
echo '== PostgreSQL contract =='
nl -ba tests/test_document_record_idempotency_postgres.sh
echo '== ADR 0309 =='
adr="$(fd -a -i '0309.*' . | head -n 1 || true)"
if [ -n "$adr" ]; then nl -ba "$adr"; fi
echo '== all persistence-function references and migration/test execution references =='
rg -n -C 3 \
'persist_document_record_once\s*\(|document_record_replay_receipts|test_document_record_idempotency_postgres|database/migrations' \
--glob '*.sql' --glob '*.sh' --glob '*.md' --glob '*.yml' --glob '*.yaml' .Length of output: 89733 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== exact patch =='
git diff --find-renames --find-copies 7ce73aa44f47113b2ecd42d51bb5d38a22c0367d 00ba4ee03df7ca86bfc3ef2383e04de211532296 -- \
database/migrations/0024_document_record_idempotent_persistence.sql \
docs/adr/0309-document-record-idempotent-persistence.md \
docs/traceability/document-record-idempotent-persistence.md \
tests/test_document_record_idempotency_postgres.sh
echo '== tenant-context helper, RLS patterns, and relevant grants =='
rg -n -C 8 \
'CREATE( OR REPLACE)? FUNCTION public\.current_tenant_record_id|current_tenant_record_id\(\)|GRANT .*document_record|REVOKE .*document_record|GRANT .*persist_document_record_once|REVOKE .*persist_document_record_once|ALTER TABLE .* FORCE ROW LEVEL SECURITY' \
--glob '*.sql' database/migrations
echo '== document migrations 0022 and 0023 =='
nl -ba database/migrations/0022_document_record_evidence_unique_keys.sql
nl -ba database/migrations/0023_document_record_canonical_encoding.sql
echo '== traceability =='
nl -ba docs/traceability/document-record-idempotent-persistence.md
echo '== all PostgreSQL test concurrency synchronization patterns =='
rg -n -C 10 \
'pg_advisory|pg_stat_activity|pg_sleep|mktemp|application_name|wait "\$\{|sleep [0-9]' \
--glob 'test_*postgres*.sh' tests
echo '== function volatility/isolation declarations in migrations =='
rg -n -C 5 \
'LANGUAGE plpgsql|VOLATILE|STABLE|SET TRANSACTION ISOLATION LEVEL|transaction_isolation|pg_advisory_xact_lock' \
--glob '*.sql' database/migrationsLength of output: 174249
I found two issues.
The function-local UTC setting correctly covers No hosted PostgreSQL execution or protected-base acceptance exists for this exact head. I did not use predecessor
|
|
@coderabbitai review Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/Orgmetra"
base="7ce73aa44f47113b2ecd42d51bb5d38a22c0367d"
head="45a0296f9ad513b3f73dfce24a09d26d629b447a"
echo '== Pull request metadata and exact commits =='
gh pr view 312 --repo "$repo" \
--json number,state,isDraft,baseRefName,baseRefOid,headRefName,headRefOid,mergeStateStatus,statusCheckRollup \
--jq '{number,state,isDraft,baseRefName,baseRefOid,headRefName,headRefOid,mergeStateStatus,checks:[.statusCheckRollup[]? | {name,status,conclusion,workflowName}]}'
printf 'checked_out='; git rev-parse HEAD
printf 'expected_base=%s\nexpected_head=%s\n' "$base" "$head"
echo '== Complete base-to-head changed-file list =='
git diff --name-status "$base" "$head"
echo '== Locate relevant files =='
fd -a -i \
'0021_document_record_persistence\.sql|0024_document_record_idempotent_persistence\.sql|0309.*|document-record-idempotent-persistence.*|test_document_record_idempotency(_isolation)?_postgres\.sh' \
. | sort
echo '== Migration 0024 complete content =='
nl -ba database/migrations/0024_document_record_idempotent_persistence.sql
echo '== Parent document-record schema, RLS, and ownership definitions =='
nl -ba database/migrations/0021_document_record_persistence.sql
echo '== Both real PostgreSQL acceptance contracts =='
for f in \
tests/test_document_record_idempotency_postgres.sh \
tests/test_document_record_idempotency_isolation_postgres.sh
do
if [ -f "$f" ]; then
echo "-- $f"
nl -ba "$f"
fi
done
echo '== ADR and traceability documents =='
for f in \
docs/adr/0309-document-record-idempotent-persistence.md \
docs/traceability/document-record-idempotent-persistence.md
do
if [ -f "$f" ]; then
echo "-- $f"
nl -ba "$f"
fi
done
echo '== Exact implementation patch =='
git diff --find-renames --find-copies "$base" "$head" -- \
database/migrations \
tests/test_document_record_idempotency_postgres.sh \
tests/test_document_record_idempotency_isolation_postgres.sh \
docs/adr/0309-document-record-idempotent-persistence.md \
docs/traceability/document-record-idempotent-persistence.md
echo '== Relevant schema helpers, grants, triggers, policies, and test discovery =='
rg -n -C 5 \
'persist_document_record_once|document_record_replay_receipts|current_tenant_record_id|pg_advisory_xact_lock|transaction_isolation|set_config|TimeZone|timezone|ROW LEVEL SECURITY|FORCE ROW LEVEL SECURITY|CREATE POLICY|GRANT|REVOKE|CREATE TRIGGER|append.only|UPDATE|DELETE|test_document_record_idempotency' \
--glob '*.sql' --glob '*.sh' --glob '*.md' --glob '*.yml' --glob '*.yaml' \
database tests docs .github 2>/dev/null || trueLength of output: 203164 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== Exact head confirmation =='
git rev-parse HEAD
git merge-base --is-ancestor 7ce73aa44f47113b2ecd42d51bb5d38a22c0367d 45a0296f9ad513b3f73dfce24a09d26d629b447a && echo 'base_is_ancestor=yes'
echo '== Migration 0024: table and full function body in focused ranges =='
nl -ba database/migrations/0024_document_record_idempotent_persistence.sql | sed -n '1,340p'
echo '== Idempotency main contract: complete file =='
nl -ba tests/test_document_record_idempotency_postgres.sh
echo '== Isolation contract: complete file =='
nl -ba tests/test_document_record_idempotency_isolation_postgres.sh
echo '== Related 0021 table definition, constraints, triggers, and RLS only =='
rg -n -A10 -B5 \
'CREATE TABLE.*document_record|ALTER TABLE.*document_record|CREATE (UNIQUE )?INDEX.*document_record|CONSTRAINT.*document_record|FOREIGN KEY|document_record.*tenant|ENABLE ROW LEVEL SECURITY|FORCE ROW LEVEL SECURITY|CREATE POLICY|append.only|TRUNCATE' \
database/migrations/0021_document_record_persistence.sql
echo '== Main contract concurrency and RLS sections with syntax context =='
rg -n -A55 -B12 \
'PGAPPNAME|application_name|concurr|pg_stat_activity|pg_locks|advisory|NOBYPASSRLS|SET ROLE|document_record_persist_receipt|append-only|TRUNCATE|OTHER_TENANT|other tenant' \
tests/test_document_record_idempotency_postgres.sh
echo '== SQL references from test: extracted heredocs around function invocation =='
rg -n -A45 -B8 \
'persist_document_record_once\(' \
tests/test_document_record_idempotency_postgres.sh
echo '== Test registration / inventory coverage at exact head =='
rg -n -C3 \
'test_document_record_idempotency_postgres\.sh|test_document_record_idempotency_isolation_postgres\.sh' \
.github tests docs README.md package.json 2>/dev/null || trueLength of output: 56917
I found two issues.
The function-local No hosted PostgreSQL execution is available for this exact head. I did not use predecessor evidence as current-head acceptance. You are interacting with an AI system. |
|
@coderabbitai review Current exact head is |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/Orgmetra"
base="7ce73aa44f47113b2ecd42d51bb5d38a22c0367d"
head="8ba15958762ed49bc33c4f6d78573b0427bec927"
echo '== Exact PR and checkout identity =='
gh pr view 312 --repo "$repo" \
--json number,state,isDraft,baseRefOid,headRefOid,mergeStateStatus,statusCheckRollup \
--jq '{number,state,isDraft,baseRefOid,headRefOid,mergeStateStatus,checks:[.statusCheckRollup[]? | {name,status,conclusion,workflowName}]}'
printf 'checked_out='
git rev-parse HEAD
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=yes'
echo '== Complete base-to-head changed files =='
git diff --name-status "$base" "$head"
echo '== Locate review artifacts =='
fd -a -i \
'002[1-4]_document_record.*\.sql|0309.*|document-record-idempotent-persistence.*|test_document_record_idempotency(_(isolation|tenant_context))?_postgres\.sh' \
. | sort
echo '== Migration 0024 outline =='
ast-grep outline database/migrations/0024_document_record_idempotent_persistence.sql --items all || true
echo '== Migration 0024 complete content =='
nl -ba database/migrations/0024_document_record_idempotent_persistence.sql
echo '== Tenant helper and document-record RLS/schema definitions =='
rg -n -A18 -B8 \
'CREATE( OR REPLACE)? FUNCTION public\.current_tenant_record_id|current_tenant_record_id\(\)|CREATE TABLE.*document_record|ALTER TABLE.*document_record|ENABLE ROW LEVEL SECURITY|FORCE ROW LEVEL SECURITY|CREATE POLICY|FOREIGN KEY|GRANT|REVOKE' \
--glob '*.sql' database/migrations
echo '== All three PostgreSQL contracts =='
for f in \
tests/test_document_record_idempotency_postgres.sh \
tests/test_document_record_idempotency_isolation_postgres.sh \
tests/test_document_record_idempotency_tenant_context_postgres.sh
do
echo "-- $f"
nl -ba "$f"
done
echo '== Every persistence-function call, tenant context assignment, and concurrency synchronization path =='
rg -n -A18 -B10 \
"persist_document_record_once\s*\(|orgmetra\.tenant_record_id|set_config\s*\(\s*'orgmetra\.tenant_record_id'|current_tenant_record_id\s*\(|pg_advisory_xact_lock|pg_stat_activity|wait_event|application_name|PGAPPNAME" \
--glob '*.sql' --glob '*.sh' database tests
echo '== Exact patch for reviewed scope =='
git diff --find-renames --find-copies "$base" "$head" -- \
database/migrations/0024_document_record_idempotent_persistence.sql \
tests/test_document_record_idempotency_postgres.sh \
tests/test_document_record_idempotency_isolation_postgres.sh \
tests/test_document_record_idempotency_tenant_context_postgres.sh \
docs/adr/0309-document-record-idempotent-persistence.md \
docs/traceability/document-record-idempotent-persistence.mdLength of output: 189664
I found one issue.
The tenant-context boundary is correctly ordered in
The existing retry calls use I did not verify hosted PostgreSQL execution for this exact head. You are interacting with an AI system. |
|
@coderabbitai review Please review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/Orgmetra"
previous="3e7866878a628cf6e2503357d8253c984baa721d"
head="8db666f33804058b377b393406b73675bbb01a2e"
supplier="3e021ad104afe4163814ea0d2bfdaabd63ccaa7d"
echo '== Pull request and exact-head identity =='
gh pr view 312 --repo "$repo" \
--json number,state,isDraft,baseRefOid,headRefOid,mergeStateStatus,statusCheckRollup \
--jq '{number,state,isDraft,baseRefOid,headRefOid,mergeStateStatus,checks:[.statusCheckRollup[]? | {name,status,conclusion,workflowName}]}'
printf 'checked_out_head='
git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git merge-base --is-ancestor "$previous" "$head" && echo 'previous_is_ancestor=yes' || echo 'previous_is_ancestor=no'
git merge-base --is-ancestor "$supplier" "$head" && echo 'supplier_is_ancestor=yes' || echo 'supplier_is_ancestor=no'
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
echo '== Exact manifest-only repair delta =='
git diff --check "$previous" "$head"
git diff --name-status "$previous" "$head"
git diff --unified=100 "$previous" "$head" -- \
manifest.json \
tests/validate_repository.py \
scripts/foundation-contract-core.mjs \
docs/OPERABILITY.md \
docs/TEST_STRATEGY.md
tmpdir="$(mktemp -d)"
trap 'rm -rf "$tmpdir"' EXIT
git archive "$head" | tar -x -C "$tmpdir"
cd "$tmpdir"
echo '== Exact manifest structure and relevant entries =='
python3 - <<'PY'
from pathlib import Path
import json
manifest = json.loads(Path("manifest.json").read_text(encoding="utf-8"))
print(f"package={manifest.get('package')}")
print(f"version={manifest.get('version')}")
print(f"generated_for_branch={manifest.get('generated_for_branch')}")
print(f"manifest_entry_count={len(manifest.get('files', []))}")
for entry in manifest["files"]:
if (
"0024_document_record_idempotent_persistence" in entry["path"]
or "document_record_idempotency" in entry["path"]
or "0309-document-record-idempotent-persistence" in entry["path"]
or "document-record-idempotent-persistence" in entry["path"]
or entry["path"] in {
"docs/OPERABILITY.md",
"docs/TEST_STRATEGY.md",
"scripts/foundation-contract-core.mjs",
"tests/validate_repository.py",
}
):
print(json.dumps(entry, sort_keys=True))
PY
echo '== Static exact-tree verification of inventories and manifest =='
python3 - <<'PY'
from pathlib import Path
import ast
import hashlib
import json
import re
import sys
root = Path(".")
py_source = (root / "tests/validate_repository.py").read_text(encoding="utf-8")
js_source = (root / "scripts/foundation-contract-core.mjs").read_text(encoding="utf-8")
py_match = re.search(r"REQUIRED = (\[.*?\])\n\nUNFINISHED_MARKER_LINE_PATTERN", py_source, re.S)
js_match = re.search(r"REQUIRED_FILES = Object\.freeze\(\[(.*?)\]\);", js_source, re.S)
if not py_match or not js_match:
raise SystemExit("could not parse canonical required inventories")
py_required = set(ast.literal_eval(py_match.group(1)))
js_required = set(re.findall(r"^\s*'([^']+)',?\s*$", js_match.group(1), re.M))
required_nonself = py_required - {"manifest.json"}
manifest = json.loads((root / "manifest.json").read_text(encoding="utf-8"))
entries_list = manifest["files"]
entries = {entry["path"]: entry for entry in entries_list}
entry_paths = set(entries)
missing = sorted(required_nonself - entry_paths)
extra = sorted(entry_paths - required_nonself)
duplicates = sorted(
path for path in entry_paths
if sum(1 for entry in entries_list if entry["path"] == path) != 1
)
mismatches = []
for path in sorted(required_nonself & entry_paths):
data = (root / path).read_bytes()
actual = {
"sha256": hashlib.sha256(data).hexdigest(),
"bytes": len(data),
"lines": len(data.decode("utf-8").splitlines()),
}
changed = {
key: (entries[path].get(key), value)
for key, value in actual.items()
if entries[path].get(key) != value
}
if changed:
mismatches.append((path, changed))
discovered = {
*(f"database/migrations/{p.name}" for p in (root / "database/migrations").iterdir()
if re.fullmatch(r"\d{4}_[a-z0-9_]+\.sql", p.name)),
*(f"tests/{p.name}" for p in (root / "tests").iterdir()
if re.fullmatch(r"test_[a-z0-9_]+_postgres\.sh", p.name)),
}
expected_owner_artifacts = {
"database/migrations/0024_document_record_idempotent_persistence.sql",
"docs/adr/0309-document-record-idempotent-persistence.md",
"docs/traceability/document-record-idempotent-persistence.md",
"tests/test_document_record_idempotency_postgres.sh",
"tests/test_document_record_idempotency_function_acl_postgres.sh",
"tests/test_document_record_idempotency_isolation_postgres.sh",
"tests/test_document_record_idempotency_tenant_context_postgres.sh",
"tests/document_record_idempotency_postcommit_recovery_companion.sh",
"tests/test_document_record_idempotency_postcommit_recovery_contract.py",
}
print(f"python_required_count={len(py_required)}")
print(f"node_required_count={len(js_required)}")
print(f"only_python={sorted(py_required - js_required)!r}")
print(f"only_node={sorted(js_required - py_required)!r}")
print(f"manifest_entry_count={len(entries_list)}")
print(f"manifest_unique_path_count={len(entry_paths)}")
print(f"manifest_missing_count={len(missing)}")
print(f"manifest_extra_count={len(extra)}")
print(f"manifest_duplicate_count={len(duplicates)}")
print(f"manifest_mismatch_count={len(mismatches)}")
print(f"dispatcher_discovered_count={len(discovered)}")
print(f"dispatcher_missing_python={sorted(discovered - py_required)!r}")
print(f"dispatcher_missing_node={sorted(discovered - js_required)!r}")
print(f"owner_missing_python={sorted(expected_owner_artifacts - py_required)!r}")
print(f"owner_missing_node={sorted(expected_owner_artifacts - js_required)!r}")
print(f"owner_missing_manifest={sorted(expected_owner_artifacts - entry_paths)!r}")
for path in missing:
print(f"MANIFEST_MISSING {path}")
for path in extra:
print(f"MANIFEST_EXTRA {path}")
for path in duplicates:
print(f"MANIFEST_DUPLICATE {path}")
for path, fields in mismatches:
print(f"MANIFEST_MISMATCH {path} {fields!r}")
canonical = {
"package": manifest["package"],
"version": manifest["version"],
"generated_for_branch": manifest["generated_for_branch"],
"files": [
{
"path": path,
"sha256": hashlib.sha256((root / path).read_bytes()).hexdigest(),
"bytes": len((root / path).read_bytes()),
"lines": len((root / path).read_bytes().decode("utf-8").splitlines()),
}
for path in sorted(required_nonself)
],
}
canonical_bytes = (json.dumps(canonical, indent=2) + "\n").encode()
actual_bytes = (root / "manifest.json").read_bytes()
print(f"derived_manifest_sha256={hashlib.sha256(canonical_bytes).hexdigest()}")
print(f"actual_manifest_sha256={hashlib.sha256(actual_bytes).hexdigest()}")
print(f"manifest_byte_exact={'yes' if actual_bytes == canonical_bytes else 'no'}")
PY
echo '== Checked-versus-used references for manifest validation =='
rg -n -A20 -B12 \
'REQUIRED|REQUIRED_FILES|manifest\.json|--print-manifest|sha256|dispatcher|database/migrations|test_\[a-z0-9_\]\+_postgres' \
tests/validate_repository.py scripts/foundation-contract-core.mjs tests/dispatcher-inventory.test.mjs
echo '== Static text and shell syntax checks only =='
for f in \
tests/test_document_record_idempotency_postgres.sh \
tests/test_document_record_idempotency_function_acl_postgres.sh \
tests/test_document_record_idempotency_isolation_postgres.sh \
tests/test_document_record_idempotency_tenant_context_postgres.sh \
tests/document_record_idempotency_postcommit_recovery_companion.sh
do
bash -n "$f"
done
echo 'shell_syntax=valid'
echo 'Repository executables were not run.'Length of output: 69266
I found one blocking manifest issue.
The The checked-in manifest has SHA-256: The statically derived replacement manifest has SHA-256: The inventories have no remaining divergence:
You are interacting with an AI system. |
Exact-head RED after reseal — 2026-09-12Direct materialization of
Here Please regenerate from this exact tree and rerun full |
|
Exact-head repair evidence for The prior manifest-only head remained RED: CHANGELOG still carried the parent seal, two newly registered paths were out of deterministic order, and Exact-tree verification:
This repairs provenance only; PostgreSQL runtime acceptance, hosted exact-head Checks, prerequisite integration, and qualifying independent approval remain required. Draft status is preserved. |
|
Fresh exact-head audit on |
|
@coderabbitai review Please review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/Orgmetra"
head="8e86c42d5545b9025341dca9afc220666ab56c93"
migration="database/migrations/0024_document_record_idempotent_persistence.sql"
acl_root="tests/test_document_record_idempotency_function_acl_postgres.sh"
main_root="tests/test_document_record_idempotency_postgres.sh"
isolation_root="tests/test_document_record_idempotency_isolation_postgres.sh"
tenant_root="tests/test_document_record_idempotency_tenant_context_postgres.sh"
echo '== Exact PR/head identity =='
gh pr view 312 --repo "$repo" \
--json number,state,isDraft,baseRefOid,headRefOid,mergeStateStatus,statusCheckRollup \
--jq '{number,state,isDraft,baseRefOid,headRefOid,mergeStateStatus,checks:[.statusCheckRollup[]? | {name,status,conclusion,workflowName}]}'
printf 'checked_out_head='; git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
echo '== Complete exact PR delta and whitespace validation =='
base="$(gh pr view 312 --repo "$repo" --json baseRefOid --jq .baseRefOid)"
git diff --check "$base" "$head"
git diff --name-status "$base" "$head"
echo '== Current ownership-handoff delta =='
parent="$(git show -s --format=%P "$head" | awk '{print $1}')"
git diff --check "$parent" "$head"
git diff --unified=140 "$parent" "$head" -- \
"$migration" "$acl_root" \
docs/adr/0309-document-record-idempotent-persistence.md \
docs/SECURITY.md docs/THREAT_MODEL.md docs/OPERABILITY.md docs/TEST_STRATEGY.md \
manifest.json
echo '== Migration outline and complete relevant implementation =='
ast-grep outline "$migration" --items all || true
nl -ba "$migration"
echo '== Parent table, receipt relation, policies, triggers, and helper dependencies =='
rg -n -A100 -B25 \
'CREATE TABLE.*document_record|CREATE TABLE.*document_record_persist_receipt|CREATE POLICY|FORCE ROW LEVEL SECURITY|ENABLE ROW LEVEL SECURITY|CREATE TRIGGER|CREATE FUNCTION|current_tenant_record_id|audit|outbox|document_record' \
--glob '*.sql' database/migrations
echo '== All grants/revokes/ownership/security-definer references =='
rg -n -A20 -B12 \
'orgmetra_document_persistence_(owner|executor)|SECURITY DEFINER|ALTER FUNCTION|ALTER TABLE.*OWNER|GRANT|REVOKE|PUBLIC|search_path|BYPASSRLS|NOBYPASSRLS|CREATE ROLE|DROP ROLE' \
--glob '*.sql' database/migrations
echo '== Full behavioral ACL root =='
nl -ba "$acl_root"
echo '== ACL root lifecycle, permissions, direct-DML probes, and function invocation =='
rg -n -A75 -B25 \
'CREATE ROLE|DROP ROLE|DROP OWNED|cleanup|trap|SET ROLE|has_table_privilege|has_function_privilege|information_schema|document_record|document_record_persist_receipt|INSERT|SELECT|UPDATE|DELETE|persist_document_record_once|permission denied|owner|executor|PUBLIC|NOBYPASSRLS' \
"$acl_root"
echo '== Function caller paths and all direct document/receipt DML sources =='
rg -n -A20 -B12 \
'persist_document_record_once\s*\(|(?:INSERT INTO|UPDATE|DELETE FROM|SELECT .*FROM)\s+(?:public\.)?(?:document_record|document_record_persist_receipt)\b' \
--glob '*.sql' --glob '*.sh' --glob '*.py' database tests scripts
echo '== Test root registration and executor-role references =='
rg -n -A12 -B8 \
'test_document_record_idempotency_function_acl_postgres|test_document_record_idempotency_postgres|test_document_record_idempotency_isolation_postgres|test_document_record_idempotency_tenant_context_postgres|orgmetra_document_persistence_(owner|executor)' \
tests docs .github README.md scripts 2>/dev/null || true
echo '== Static syntax checks only =='
for f in "$acl_root" "$main_root" "$isolation_root" "$tenant_root"; do
bash -n "$f"
done
echo 'shell_syntax=valid'
echo 'Repository executable tests were not run.'Length of output: 204268 🏁 Script executed: #!/bin/bash
set -euo pipefail
migration="database/migrations/0024_document_record_idempotent_persistence.sql"
acl_root="tests/test_document_record_idempotency_function_acl_postgres.sh"
echo '== Exact migration sections omitted by prior capped output =='
nl -ba "$migration" | sed -n '1,140p;140,250p;340,410p'
echo '== Reserved-role preflight structure and mutation ordering =='
rg -n -A35 -B12 \
'pg_roles|orgmetra_document_persistence_owner|orgmetra_document_persistence_executor|RAISE EXCEPTION|CREATE ROLE|CREATE TABLE|CREATE FUNCTION|BEGIN;|COMMIT;' \
"$migration"
echo '== Persist function definitions, effective settings, and all referenced objects =='
rg -n -A18 -B10 \
'CREATE FUNCTION public\.persist_document_record_once|LANGUAGE|VOLATILE|SECURITY|SET search_path|SET TimeZone|current_setting|current_tenant_record_id|pg_advisory_xact_lock|digest\(|jsonb_build_object|INSERT INTO|FROM public\.|JOIN public\.' \
"$migration"
echo '== Trigger definitions for protected tables and referenced trigger function implementations =='
rg -n -A50 -B15 \
'CREATE TRIGGER.*document|ON (document_record|document_record_persist_receipt)|EXECUTE FUNCTION|CREATE FUNCTION public\.(reject|validate|protect).*document|document_record_persist_receipt' \
--glob '*.sql' database/migrations/0021_document_record_persistence.sql \
database/migrations/0022_document_record_evidence_unique_keys.sql \
database/migrations/0023_document_record_canonical_encoding.sql \
"$migration"
echo '== Required grants for every function called by the definer and any sequence use =='
rg -n -A16 -B8 \
'CREATE FUNCTION public\.(current_tenant_record_id|digest|validate_document|reject_document|protect)|GRANT EXECUTE ON FUNCTION|REVOKE EXECUTE ON FUNCTION|nextval|currval|DEFAULT.*nextval|GENERATED' \
--glob '*.sql' database/migrations/0001_foundation_schema.sql \
database/migrations/0002_sealed_evidence_digest.sql \
database/migrations/0021_document_record_persistence.sql \
database/migrations/0022_document_record_evidence_unique_keys.sql \
database/migrations/0023_document_record_canonical_encoding.sql \
"$migration"
echo '== ACL contract coverage versus all direct executor table access modes =='
rg -n -A8 -B8 \
'has_table_privilege|SELECT count|INSERT INTO public\.document_record|INSERT INTO public\.document_record_persist_receipt|UPDATE public\.document_record|DELETE FROM public\.document_record|TRUNCATE|SET ROLE' \
"$acl_root"
echo '== Relevant public schema permissions established before migration 0024 =='
rg -n -A14 -B10 \
'REVOKE (CREATE|ALL) ON SCHEMA public FROM PUBLIC|GRANT .* ON SCHEMA public TO PUBLIC|ALTER DEFAULT PRIVILEGES|GRANT .* ON (TABLE|FUNCTION).*PUBLIC|REVOKE .* ON (TABLE|FUNCTION).*PUBLIC' \
--glob '*.sql' database/migrations
echo '== Static lexical check for unqualified non-keyword function/table calls in definer body =='
python3 - <<'PY'
from pathlib import Path
import re
text = Path("database/migrations/0024_document_record_idempotent_persistence.sql").read_text()
m = re.search(r'CREATE FUNCTION public\.persist_document_record_once\(.*?\n\$\$(.*?)\n\$\$;', text, re.S)
if not m:
raise SystemExit("persist function body not found")
body = m.group(1)
for number, line in enumerate(body.splitlines(), 1):
if re.search(r'\b(?:FROM|JOIN|INSERT INTO|UPDATE|DELETE FROM)\s+(?!public\.|pg_catalog\.)[a-z_]', line):
print(f"unqualified_relation_body_line={number}:{line.strip()}")
if re.search(r'(?<![\w.])(?:digest|current_tenant_record_id|hashtextextended|current_setting|jsonb_build_object|convert_to|encode)\s*\(', line):
print(f"possibly_unqualified_function_body_line={number}:{line.strip()}")
PYLength of output: 136150 🏁 Script executed: #!/bin/bash
set -euo pipefail
expected="8e86c42d5545b9025341dca9afc220666ab56c93"
actual="$(git rev-parse HEAD)"
printf 'expected_head=%s\nactual_head=%s\nhead_matches=%s\n' \
"$expected" "$actual" "$([[ "$actual" == "$expected" ]] && echo yes || echo no)"
git show -s --format='parents=%P%nsubject=%s' "$expected"
git diff --check "${expected}^" "$expected"
echo 'static_review_evidence=complete'Length of output: 818
I found no new source-level issue. Migration 0024 rejects either pre-existing reserved role before it changes project objects. It then creates both roles in the same transaction as the persistence relation, function, grants, and ownership handoff. The owner and executor roles are The migration revokes The owner receives only schema The function is The owner grants cover the function body. The protected writes use UUID values and do not require sequence privileges. The document-record triggers have fixed search paths. No additional owner table privilege is required by the visible trigger path.
The probe-role cleanup is strict after successful assertions. The The existing replay, tenant, RLS, UTC digest, and advisory-lock behavior remains unchanged in the reviewed source.
You are interacting with an AI system. |
|
2026-09-12 exact-head Foundation repair Current writer head Ordinary non-force child Fresh exact-tree verification: |
|
Independent exact-head revalidation at
This COMMENT confirms complete ordinary-forward carryover and deterministic Foundation truth only; it is not hosted-check transfer or merge authorization. |
1 participant
Finding
#107 makes document metadata immutable and tenant-scoped, and #312 adds authoritative uncertain-retry receipts. The production persistence boundary is now an execute-only database capability:
persist_document_record_once(...)is owned by a deny-defaultSECURITY DEFINERrole, the executor receives function EXECUTE but no direct document/receipt DML,PUBLICEXECUTE is revoked, and function-local tenant-before-lock, Read Committed, UTC digest, advisory-serialization, FORCE-RLS and replay/conflict controls remain fail closed.A fresh DDD/data-model audit then found a separate canonical-truth gap tracked by #313: migration 0024 created
document_record_persist_receipt, but the canonical Data Model, ERD, and migration-backed object inventory did not all register that relation. The first ERD repair also overstated total cardinality as mandatory one-to-one even though migration 0024 does not backfill pre-existingdocument_recordrows. Both defects are now repaired ordinary-forward.Current exact authority
feat/document-record-persistence@3e021ad104afe4163814ea0d2bfdaabd63ccaa7db996e19090e5cc38ef0a4d41a8b4de6d561b89d8document_recordscreation/retry persistence only; feat(document-records): 반환·파기 완료 receipt 권위 계약과 복구 불가능성 evidence #308 separately owns return/destruction completion evidencedocs/ERD.mdis sealed as SHA-2562fef217f1b7789685dcd7cc37fef25782c2bb48268b5e39001293a9cbb52f755, 8,217 bytes / 75 linesCurrent RED → causal repair
Database-capability lineage:
12b474b5fd4218d6d9d94e5c2869b9c503035b71added real-PostgreSQL ACL RED;50c0259a24089cba7e848ab97887cbf0f581746eimplemented the deny-default owner/executorSECURITY DEFINERboundary. ADR 0309, traceability, OPERABILITY, SECURITY, THREAT_MODEL, and TEST_STRATEGY describe the same capability boundary.Canonical-model lineage for #313:
1b714de0050276832e5e656a9065e65b89580b4a: registersdocument_recordanddocument_record_persist_receiptpurpose, tenant/idempotency identity, receipt digest/database time, PII exclusion, replay semantics, and lifecycle boundary indocs/DATA_MODEL.md.792a9060807cf225eeec4e7a9d90346a978ec64f: adds receipt relationship/cardinality todocs/ERD.md.ce7a5807fcf109fe2588d94f3eeef62f18f995f0: addsdocument_record_persist_receiptto canonical and migration-backed database object inventories.f8d035c2e65401149612023a18d99bba370ea425: adds a focused regression proving comments/string/dollar-quoted fakeCREATE TABLEtext cannot satisfy receipt migration identity.1ba3a15ef3e0c9f60e3b5f36526271382610cc95: reseals the 96-artifact Foundation manifest after the above repair.0bdf9012d4f46e52b482694e6c0272b38d18d816: corrects the ERD from mandatory one-to-one to dataset-level zero-or-one receipt per document; the idempotent write port still creates exactly one receipt for each first committed command, while historical/pre-port document rows need no synthetic backfill.b996e19090e5cc38ef0a4d41a8b4de6d561b89d8: reseals the corrected ERD bytes inmanifest.json.The existing database function semantics are unchanged by the #313 repair.
Executable acceptance
The owner-neutral PostgreSQL roots remain:
tests/test_document_record_idempotency_postgres.shtests/test_document_record_idempotency_function_acl_postgres.shtests/test_document_record_idempotency_isolation_postgres.shtests/test_document_record_idempotency_tenant_context_postgres.shtests/document_record_idempotency_postcommit_recovery_companion.shremains the reviewed companion of the main idempotency root and must not become a filename-specific Foundation switch.For #313, the deterministic Foundation contract now requires
document_record_persist_receiptin both canonical object inventories and requires executable migration DDL after PostgreSQL comments and literal bodies are masked. At1ba3a15..., exact-treenpm run validatepassed all 56 Node tests plus Python/Foundation/OpenAPI/dispatcher validation and the generated manifest candidate matched committed bytes. The later0bdf901...change only corrects ERD cardinality andb996e190...reseals that exact ERD; protected-base PostgreSQL acceptance remains separately pending.Evidence boundary and integration
This PR targets #107 while #310/#311 own PostgreSQL Foundation admission on a separate prerequisite stack. Do not create a feature-local workflow, temporarily retarget to
develop, synthesize statuses, self-approve, transfer predecessor GREEN, or weaken protected gates.Keep Draft until #107 and the Foundation prerequisite stack (#258/#259 → #310/#311 or verified successors) integrate or this branch is ordinary-forward reconciled onto then-current protected truth. After reconciliation, Foundation must discover all four roots plus the reviewed recovery companion from the immutable exact-candidate tree, execute them in isolated PostgreSQL containers, and reacquire exact-head Foundation/SAST/Security/CodeQL/OpenCode/Noema/Strix plus qualifying independent review evidence before normal merge.
Refs #309, #313.