oficina / home Public

Address legacy diagnostic design review and historical provenance

Paul Campbell pushed by paul@keymail.dev 1 month ago dd5ee8dd06a9831e7bfd5951f7e8276cd612bd2d parent a442f66

1 file changed, +10 −6

implementation/legacy-schema-profile/proposal.json +10 −6

CI passed — run details

diff --git a/implementation/legacy-schema-profile/proposal.json b/implementation/legacy-schema-profile/proposal.json

index d457d3f..0c8e604 100644

--- a/implementation/legacy-schema-profile/proposal.json

+++ b/implementation/legacy-schema-profile/proposal.json

@@ -1,18 +1,22 @@

{

"scope": "Read-only startup diagnostic for the historical Home directory schema. No compatibility exemption, operator admission, worker authority, migrations or credential changes.",

"observed": "Directory8969a42 reports exactly home/0001_people, home/0002_signin_links, passkey/0001_init as known extra migrations; credential reports none. Names alone cannot establish schema compatibility or historical data custody.",

- "profile": "Freeze a synthetic historical-directory schema profile from original BootSchema followed by current directory Runtime.Schema, including existing migration ledger and the exact existing replication tables from the compatibility profile. Compare replay in that historical order with merged replay. Profile is internal to this diagnostic and cannot be selected by callers or passed to operator/checker. Verify exact migration IDs and original SQL checksums plus exact SQLite type/name/table/SQL objects; reject unknown/partial/modified/oversized sets.",

- "transaction": "Run only on the directory role during existing one-time startup inventory reporting. Acquire one connection and one read transaction with the existing two-second deadline. Execute fixed bounded SELECT statements only; do not change query_only on a pooled writer connection. Same snapshot covers ledger, schema and occupancy. No row content is read or decrypted. Failure rolls back and emits only a fixed unavailable category; never propagate database error strings.",

+ "profile": "Build historical ordering as BootSchema first, then current directory Runtime.Schema additions. migrate.Merge concatenates and does not deduplicate; explicitly union IDs preserving first occurrence, require duplicate IDs to have identical original SQL/checksum, reject Go migrations/conflicts, and compare historical sequential apply with the resulting unique replay. Freeze exact historical objects and original checksums under diagnostic_profiles/ with a separate embed variable in the new generic diagnostic file. Never place them under compatibility_profiles/. Explicitly add migration ledger plus _litestream_lock/_litestream_seq DDL copied byte-for-byte from the existing frozen directory profile. Exact live ledger/schema equality remains mandatory. No caller-selectable profile.",

+ "transaction": "Directory-only one-time startup diagnostic: acquire one writer connection, execute deferred BEGIN, then fixed bounded SELECT statements in the same snapshot under a two-second deadline. ReadOnly is not enforcement in this driver; issuing only SELECTs inside BEGIN is the constraint. Close/drain every rows result before the next statement. ROLLBACK using context.WithoutCancel after success/failure; if rollback fails, evict with conn.Raw returning driver.ErrBadConn before Close, and report unavailable. No connection PRAGMA changes. Existing inventory query may remain separate; the occupancy boolean is gated only by this in-transaction exact ledger/schema proof. No row content or ciphertext read.",

"output": "One fixed event with versioned diagnostic profile label and result enum unavailable/mismatch/match. Only for a full exact match, emit one aggregate boolean legacy_credentials_present over fixed known people, signin_links and passkey tables using EXISTS. No per-table activity bits, counts, IDs, SQL, checksums, keys, ciphertext, addresses or arbitrary names in logs. No endpoint. Credential role keeps the existing inventory only.",

- "bounds": "Limit ledger and schema queries to1001 entries and reject more than1000; cap length/type of each selected string before materialization using SQL CASE, rejecting overflow/null instead of truncating. Use static identifiers and fixed compiled bounds. EXISTS reads only constant1. All context/scan/close failures produce unavailable, never match.",

- "implementation": "Keep existing strict operator/checker profiles unchanged. New synthetic profile lives separately from accepted compatibility profiles. New code has no operator imports/callback and cannot grant admission. Startup continues regardless of diagnostic result. Occupied historical credential tables stop future automatic adoption; preserving keys/data requires a separate design. Even empty+match is only evidence, never authorization.",

+ "bounds": "At most1000 ledger/schema rows (select1001 to detect overflow). Fixed constants: IDs/names/table names256bytes, object type16bytes, checksum64bytes, SQL65536bytes; enforce typeof plus length(CAST(value AS BLOB)) in SQL CASE before materialization and reject overflow/null result. For sqlite_schema.sql only, coalesce SQL NULL to empty first because autoindexes legitimately have NULL SQL. Test every frozen object fits caps. Reject unknown/missing/duplicate/partial/modified objects and migration IDs. EXISTS reads only constant1. Context/scan/rows-close/rollback failure gives unavailable.",

+ "implementation": "Accepted operator/checker schema sets and compatibility_profiles embed stay untouched. The new diagnostic source file imports no operator package and exposes no admission callback. Package home already imports operator elsewhere; do not claim package-wide absence. Exact guard test requires compatibility embed file set credential.json/directory.json only. Guard event key set exactly: message/profile/result, plus legacy_credentials_present only on match, aside from fixed logger timestamp/level fields. Startup proceeds regardless. Even empty+match grants no authority.",

"verification": [

"Reproduce BootSchema then directory migrations locally and freeze exact objects from that original sequence.",

"Match historical empty; report aggregate occupancy for each known historical table independently; keep current fresh directory a mismatch and credential role silent.",

"Wrong checksum, unknown/partial migration, unknown table/index/trigger, changed SQL, unexpected type, oversized name/SQL, canceled context and malformed schema all refuse exact match.",

"Prove diagnostic does not change logical rows/ledger and inspect unchanged operator/checker refusing historical ledger.",

"Insert address/secret canaries into unknown schema strings and row data; assert no canaries or errors emitted. Mutate match/occupancy checks to prove tests fail for the right reason.",

- "Full Home gate plus exact CI and Fable source review before preview diagnostic deployment. Read only bounded diagnostic logs from preview afterward."

+ "Full Home gate plus exact CI and Fable source review before preview diagnostic deployment. Read only bounded diagnostic logs from preview afterward.",

+ "Test NULL autoindex SQL coalescing, caps, absent replication tables mismatch versus exact tables match, duplicate migration conflict refusal and historical/replay ordering equivalence.",

+ "Test canceled-query rollback restores pooled writer use; rollback failure evicts; unknown result never emits occupancy boolean. Guard exact accepted compatibility embed members and new-file operator-import absence.",

+ "Freeze original migration provenance constants using earliest registered source; compare all20 registered sources as audit evidence, and prove changed current migration/comment fails the provenance gate."

- "dependencies": "No platform change needed for diagnostic. Native provisioning still requires isolated launch/enrollment, IAM separation, approved compatibility semantics and restoration proof."

+ "dependencies": "No platform change needed for diagnostic. Native provisioning still requires isolated launch/enrollment, IAM separation, approved compatibility semantics and restoration proof.",

+ "historical_provenance": "Read-only CARLOS release list includes20 registered Home builds from651e5b3 (2026-09-07T22:01Z) through89d99b1. Both original Home SQL files are byte-identical in every listed release source and today. Passkey0001 SQL is byte-identical in both framework versions used by these releases (v0.22.0/v0.23.0). Freeze earliest source blobs and source/module IDs plus byte SHA256 and normalized migrate.Checksum values in diagnostic-only provenance; gate current compiled migrations against those constants. This is historical source evidence, not live ledger equality; the diagnostic must still verify actual stored checksums. Evidence: /home/paulca/.cache/oficina-provisioning-20260911/home-historical-migration-provenance.json."

}