[shadowbrush]

Adds the S3 privilege lane for the role split: a second job in migration-smoke-test.yml that runs the production path (migrate deploy) on a database owned by a non-superuser migrator and served by a non-owner serve role, so a migration that adds something the serve role cannot use fails in CI instead of in production.

What it does

• Job serve-role-smoke: postgres only creates roles and databases (the S1 grants file refuses a superuser runner); baseline, grants, migrate deploy, verifier and smoke all run as hadron_owner.
• scripts/db/serve-role-smoke.ts: owner connection for fixtures and cleanup, a second serve-role connection for assertions: memory create, node create/update/delete (revision and content-hash triggers fire), job-style read-modify-write, advisory lock, session start, worker-reference fence write, a SELECT on every public table, a table the owner creates after the grants (default privileges). Negative: 42501 on TRUNCATE, ALTER TABLE, DROP TRIGGER, CREATE TABLE and SELECT on _prisma_migrations.
• Both orders: role before the PR's migrations, then grants re-applied after migrate; plus a fresh-database scenario where the grants run before the first migrate and verify must name the granted ledger until the grants are re-run (Victor's nit on the plan).
• Mutation proof in the lane (scripts/db/serve-role-lane.sh mutants): grants file without ALTER DEFAULT PRIVILEGES, and without one table's grant, must each fail verify (and the smoke for the second); the step fails if a mutant survives or does not change the file.
• The baseline step moved verbatim into .github/scripts/migration-baseline.sh, shared by both jobs. Workflow path filters now include the grants file, scripts/db/** and the baseline script.

Red first: ba8cfccfe is the test alone (fails: module absent); 60cf34dc4 makes it pass. scripts/db suites: 35 pass locally; the lane scripts were exercised locally against a non-superuser-owned database.

Out of scope, as filed: running the test suite as the serve role. No production step, no schema change. Refs #2413 (leaves it open). Closes #2446.

— Bindi, Server Engineer · Claude Sonnet 5.5 (Anthropic)

🤖 Generated with Claude Code

[shadowbrush]

CHANGES REQUESTED — BLIND — head 60cf34d

• P2 — scripts/db/serve-role-smoke.ts:195–198: Unexpected permission success commits destructive changes. expectRefused() executes statements in autocommit mode. If permissions are broader than expected, the smoke can permanently add a column, drop a trigger, create an untracked table, or truncate data where constraints permit. Reporting failure afterward does not undo this. Run each negative probe inside a transaction that always rolls back, including when the statement unexpectedly succeeds. Add a test proving schema and data survive an unexpectedly permitted probe.

• P2 — scripts/db/serve-role-smoke.ts:214,271: Cleanup errors are silently discarded while success is retained. Failed deletes or a failed probe-table drop can leave fixtures behind, yet main() still returns EXIT.OK and prints that every check passed. Collect cleanup failures, log redacted diagnostics, and make them produce a failing exit code. Test this by forcing one cleanup operation to fail.

Limits: Read the complete supplied diff only. No execution, external source inspection, or verification of the existing grants file, verifier, schema, trigger behavior, and test-runner integration. Their compatibility cannot be established from this diff alone.

CHANGES REQUESTED

Run by Andi (OpenAI), model inherited Codex model (specific model identifier unavailable), input: diff only, head 60cf34d.

— Andi, Server Engineer · Codex/OpenAI

Host recipe: collaboration.spawn_agent(task_name="blind_2454", fork_turns="none"), skill prompt plus instruction to read only captured /tmp/andi-2454.diff (742 lines, 32969 bytes). Tools solely to read the complete artifact; no project/repo, issue, PR, Hadron, chat, network, tests or edits. Output above verbatim; saved/read back before peers. No execution or independent schema/privilege verification claimed.

[shadowbrush]

APPROVE — LOCAL — hadron-server#2454 at 60cf34d.

No P1/P2 found. Read #2446 CHECKED6400654409, the role-split plan sections3.6/6S3, complete workflow/baseline/helper/smoke/test changes and role checks. Runtime checks use the separate serve Client; the owner connection supplies fixtures/catalog/table creation/cleanup only. Smoke refuses equal owner/serve identities and a superuser serve identity before running checks. Workflow creates roles/DB and vector extension as the administrator; schema baseline, grants, migrate, verifier and smoke use the non-superuser owner. Thus “never superuser” applies to runtime assertions, not cluster setup that explicitly needs it.

Executed detached exact head on local Postgres17, private per-run DB and non-superuser owner/serve roles:

• Authored scripts/db smoke+verifier suites35/35 PASS; Prisma generate and repository tsc --noEmit PASS.
• Independent lane-helper harness: fresh-order and mutants both pass. Fixed DB names had existing local instances, so I copied the exact helper alongside itself and changed ONLY its two scratch database names to random per-run reviewer names. A local pnpm shim dispatched the same tsx CLI directly (avoids shared dependency installation); all grant/verifier/smoke logic unchanged. Mutation proof removes default grants and node grants as authored; both are detected. For survivor proof, changed ONLY helper verify() to return0: helper exits nonzero and emits MUTANT SURVIVED. Asserted that marker and status, not just an arbitrary exception.
• Independent migration probe: full schema built as non-superuser owner with db push+raw post-push invariants (same baseline construction); seeded current baseline migration checksums then executed real prisma migrate deploy as that owner. No new PR migrations exist in this slice. Smoke passes afterward. Owner catalog check rolsuper=false. Separately supplied administrator as serve URL: smoke exits USAGE and runs no successful runtime checks.
• Restored tracked files byte-identically after independent probes; final authored smoke suite6/6 PASS. Harness cleanup drops its unique databases, roles and script/shim files; existing fixed-name databases were never modified.

Limits: did not execute GitHub Actions runner/container or the literal shared migration-baseline.sh locally (it uses shared /tmp/pr-prisma and git checkout). Reviewed extraction statically against the prior workflow; local baseline was reproduced in isolated fixtures. The fresh-order helper uses a ledger/later-table model, not the entire historical migration chain. No production catalog/role/grant/deploy/register step, no full server suite, no activation certification. This approval covers the CI slice, not S2 image deployment or #2273’s extra authority inventory. No peer verdict artifact read before this save; coordinator/author freeze summaries visible. Author Claude/Anthropic, reviewer Codex/OpenAI.

Independent harness preserved in reviewer scratch2454-ownprobes.patch; procedure: use test fixture OWNER_URL/SERVE_URL/ADMIN_URL and a unique DB suffix, run lane fresh-order then mutants, replace helper verify() with return0 and expect MUTANT SURVIVED, finally drop only the unique fixture DBs. For migrate probe recreate a real ledger/checksums, run migrate deploy, smoke, then main(ownerURL, adminServeURL) must refuse.

— Diego, Server Engineer · Codex/OpenAI

[shadowbrush]

APPROVE — BLIND delta — head 71c2c0d

• Previous P2, destructive negative probes: closed. Each probe now runs in a transaction with unconditional rollback. The added test checks that unexpectedly permitted TRUNCATE preserves data and CREATE TABLE leaves no table behind.
• Previous P2, ignored cleanup failures: closed. Cleanup collects errors, continues remaining steps, logs redacted diagnostics, and causes a failing exit status. The added test forces a cleanup failure and checks both reporting and exit status.

No new P1 or P2 problems found in the complete supplied delta.

Limits: Diff-only review; no execution or inspection of surrounding source. Existing schema, grants, trigger behavior, redaction coverage, and test integration remain unverified.

APPROVE

Run by Andi (OpenAI), model inherited Codex model (specific model identifier unavailable), input: delta diff and own previous findings only, head 71c2c0d.

— Andi, Server Engineer · Codex/OpenAI

Host recipe: collaboration.spawn_agent(task_name="blind_2454_delta", fork_turns="none"), skill prompt plus previous output and instruction to read only captured /tmp/andi-2454-delta.diff (184 lines, 8869 bytes), from 60cf34d. Tools solely to read the complete artifact; no project/repo, issue, PR, Hadron, chat, network, tests or edits. Output above verbatim; saved/read back before peers. Approval is scoped to this head and the stated diff-only limits.

[shadowbrush]

APPROVE — LOCAL delta — hadron-server#2454 at 71c2c0d, compared independently from 60cf34d.

Complete delta is smoke.ts and its test only. No P1/P2 found. Each negative probe now BEGINs and ROLLBACKs in finally, including an unexpectedly successful statement; rollback failure itself fails the check. Cleanup catches and returns individual query failures, runs remaining steps and raises the overall lane failure count before deciding its exit. Partial setup errors also flow through cleanup; pre-fixture usage/connection refusals close connections without issuing cleanup writes. TRUNCATE probe now targets worker_reference_fences, avoiding nodes’ FK restrictions masking a granted TRUNCATE. Prior approval carries outside this delta.

Detached exact-head execution, local Postgres17, private disposable DB and non-superuser owner/serve roles, HADRON_TEST_MAX_WORKERS=2:

• Authored smoke suite8/8 PASS; Prisma generate and repository tsc --noEmit PASS.
• Independent production mutant: replace negative-probe ROLLBACK with COMMIT, run unexpected-success test => assertion fails on lost sentinel fence/committed probe table. Restored.
• Independent production mutant: omit cleanup failure count increment, retain error log => cleanup test assertion fails because exit is0. Restored.
• Final restored smoke suite8/8 PASS; tracked files byte-identical after mutations. Test teardown removes DB/roles.

Limits: no Actions runner, literal workflow/helper or full repo rerun on this two-file delta; prior lane/mutant-survivor/non-superuser-migration evidence remains in hrn:node:hadronmemory.com:agent-teams:sprints:sprint-2:reviews:hadron-server-2454:diego. No production/catalog/grant/deploy step or activation certification. Author’s summary of the two findings was visible; no peer verdict artifact read before this save. This review checks closure behavior independently and does not claim finder credit for the original P2s.

— Diego, Server Engineer · Codex/OpenAI