amadan
Specify bounded legacy directory schema diagnostic
1 file changed,
+18
−0
implementation/legacy-schema-profile/proposal.json+18 −0
CI passed — run details
diff --git a/implementation/legacy-schema-profile/proposal.json b/implementation/legacy-schema-profile/proposal.json| new file mode 100644 |
| index 0000000..d457d3f |
| --- /dev/null |
| +++ b/implementation/legacy-schema-profile/proposal.json |
| @@ -0,0 +1,18 @@ |
| +{ |
| + "scope": "Read-only startup diagnostic for the historical Home directory schema. No compatibility exemption, operator admission, worker authority, migrations or credential changes.", |
| + "observed": "Directory8969a42 reports exactly home/0001_people, home/0002_signin_links, passkey/0001_init as known extra migrations; credential reports none. Names alone cannot establish schema compatibility or historical data custody.", |
| + "profile": "Freeze a synthetic historical-directory schema profile from original BootSchema followed by current directory Runtime.Schema, including existing migration ledger and the exact existing replication tables from the compatibility profile. Compare replay in that historical order with merged replay. Profile is internal to this diagnostic and cannot be selected by callers or passed to operator/checker. Verify exact migration IDs and original SQL checksums plus exact SQLite type/name/table/SQL objects; reject unknown/partial/modified/oversized sets.", |
| + "transaction": "Run only on the directory role during existing one-time startup inventory reporting. Acquire one connection and one read transaction with the existing two-second deadline. Execute fixed bounded SELECT statements only; do not change query_only on a pooled writer connection. Same snapshot covers ledger, schema and occupancy. No row content is read or decrypted. Failure rolls back and emits only a fixed unavailable category; never propagate database error strings.", |
| + "output": "One fixed event with versioned diagnostic profile label and result enum unavailable/mismatch/match. Only for a full exact match, emit one aggregate boolean legacy_credentials_present over fixed known people, signin_links and passkey tables using EXISTS. No per-table activity bits, counts, IDs, SQL, checksums, keys, ciphertext, addresses or arbitrary names in logs. No endpoint. Credential role keeps the existing inventory only.", |
| + "bounds": "Limit ledger and schema queries to1001 entries and reject more than1000; cap length/type of each selected string before materialization using SQL CASE, rejecting overflow/null instead of truncating. Use static identifiers and fixed compiled bounds. EXISTS reads only constant1. All context/scan/close failures produce unavailable, never match.", |
| + "implementation": "Keep existing strict operator/checker profiles unchanged. New synthetic profile lives separately from accepted compatibility profiles. New code has no operator imports/callback and cannot grant admission. Startup continues regardless of diagnostic result. Occupied historical credential tables stop future automatic adoption; preserving keys/data requires a separate design. Even empty+match is only evidence, never authorization.", |
| + "verification": [ |
| + "Reproduce BootSchema then directory migrations locally and freeze exact objects from that original sequence.", |
| + "Match historical empty; report aggregate occupancy for each known historical table independently; keep current fresh directory a mismatch and credential role silent.", |
| + "Wrong checksum, unknown/partial migration, unknown table/index/trigger, changed SQL, unexpected type, oversized name/SQL, canceled context and malformed schema all refuse exact match.", |
| + "Prove diagnostic does not change logical rows/ledger and inspect unchanged operator/checker refusing historical ledger.", |
| + "Insert address/secret canaries into unknown schema strings and row data; assert no canaries or errors emitted. Mutate match/occupancy checks to prove tests fail for the right reason.", |
| + "Full Home gate plus exact CI and Fable source review before preview diagnostic deployment. Read only bounded diagnostic logs from preview afterward." |
| + ], |
| + "dependencies": "No platform change needed for diagnostic. Native provisioning still requires isolated launch/enrollment, IAM separation, approved compatibility semantics and restoration proof." |
| +} |