| 1 | { |
| 2 | "scope": "Read-only startup diagnostic for the historical Home directory schema. No compatibility exemption, operator admission, worker authority, migrations or credential changes.", |
| 3 | "observed": "Directory8969a42 reports exactly home/0001_people, home/0002_signin_links, passkey/0001_init as known extra migrations; credential reports none. Names alone cannot establish schema compatibility or historical data custody.", |
| 4 | "profile": "Build historical ordering as BootSchema first, then current directory Runtime.Schema additions. migrate.Merge concatenates and does not deduplicate; explicitly union IDs preserving first occurrence, require duplicate IDs to have identical original SQL/checksum, reject Go migrations/conflicts, and compare historical sequential apply with the resulting unique replay. Freeze exact historical objects and original checksums under diagnostic_profiles/ with a separate embed variable in the new generic diagnostic file. Never place them under compatibility_profiles/. Explicitly add migration ledger plus _litestream_lock/_litestream_seq DDL copied byte-for-byte from the existing frozen directory profile. Exact live ledger/schema equality remains mandatory. No caller-selectable profile.", |
| 5 | "transaction": "Directory-only one-time startup diagnostic: acquire one writer connection, execute deferred BEGIN, then fixed bounded SELECT statements in the same snapshot under a two-second deadline. ReadOnly is not enforcement in this driver; issuing only SELECTs inside BEGIN is the constraint. Close/drain every rows result before the next statement. ROLLBACK using context.WithoutCancel after success/failure; if rollback fails, evict with conn.Raw returning driver.ErrBadConn before Close, and report unavailable. No connection PRAGMA changes. Existing inventory query may remain separate; the occupancy boolean is gated only by this in-transaction exact ledger/schema proof. No row content or ciphertext read.", |
| 6 | "output": "One fixed event with versioned diagnostic profile label and result enum unavailable/mismatch/match. Only for a full exact match, emit one aggregate boolean legacy_credentials_present over fixed known people, signin_links and passkey tables using EXISTS. No per-table activity bits, counts, IDs, SQL, checksums, keys, ciphertext, addresses or arbitrary names in logs. No endpoint. Credential role keeps the existing inventory only.", |
| 7 | "bounds": "At most1000 ledger/schema rows (select1001 to detect overflow). Fixed constants: IDs/names/table names256bytes, object type16bytes, checksum64bytes, SQL65536bytes; enforce typeof plus length(CAST(value AS BLOB)) in SQL CASE before materialization and reject overflow/null result. For sqlite_schema.sql only, coalesce SQL NULL to empty first because autoindexes legitimately have NULL SQL. Test every frozen object fits caps. Reject unknown/missing/duplicate/partial/modified objects and migration IDs. EXISTS reads only constant1. Context/scan/rows-close/rollback failure gives unavailable.", |
| 8 | "implementation": "Accepted operator/checker schema sets and compatibility_profiles embed stay untouched. The new diagnostic source file imports no operator package and exposes no admission callback. Package home already imports operator elsewhere; do not claim package-wide absence. Exact guard test requires compatibility embed file set credential.json/directory.json only. Guard event key set exactly: message/profile/result, plus legacy_credentials_present only on match, aside from fixed logger timestamp/level fields. Startup proceeds regardless. Even empty+match grants no authority.", |
| 9 | "verification": [ |
| 10 | "Reproduce BootSchema then directory migrations locally and freeze exact objects from that original sequence.", |
| 11 | "Match historical empty; report aggregate occupancy for each known historical table independently; keep current fresh directory a mismatch and credential role silent.", |
| 12 | "Wrong checksum, unknown/partial migration, unknown table/index/trigger, changed SQL, unexpected type, oversized name/SQL, canceled context and malformed schema all refuse exact match.", |
| 13 | "Prove diagnostic does not change logical rows/ledger and inspect unchanged operator/checker refusing historical ledger.", |
| 14 | "Insert address/secret canaries into unknown schema strings and row data; assert no canaries or errors emitted. Mutate match/occupancy checks to prove tests fail for the right reason.", |
| 15 | "Full Home gate plus exact CI and Fable source review before preview diagnostic deployment. Read only bounded diagnostic logs from preview afterward.", |
| 16 | "Test NULL autoindex SQL coalescing, caps, absent replication tables mismatch versus exact tables match, duplicate migration conflict refusal and historical/replay ordering equivalence.", |
| 17 | "Test canceled-query rollback restores pooled writer use; rollback failure evicts; unknown result never emits occupancy boolean. Guard exact accepted compatibility embed members and new-file operator-import absence.", |
| 18 | "Freeze original migration provenance constants using earliest registered source; compare all20 registered sources as audit evidence, and prove changed current migration/comment fails the provenance gate." |
| 19 | ], |
| 20 | "dependencies": "No platform change needed for diagnostic. Native provisioning still requires isolated launch/enrollment, IAM separation, approved compatibility semantics and restoration proof.", |
| 21 | "historical_provenance": "Read-only CARLOS release list includes20 registered Home builds from651e5b3 (2026-09-07T22:01Z) through89d99b1. Both original Home SQL files are byte-identical in every listed release source and today. Passkey0001 SQL is byte-identical in both framework versions used by these releases (v0.22.0/v0.23.0). Freeze earliest source blobs and source/module IDs plus byte SHA256 and normalized migrate.Checksum values in diagnostic-only provenance; gate current compiled migrations against those constants. This is historical source evidence, not live ledger equality; the diagnostic must still verify actual stored checksums. Evidence: /home/paulca/.cache/oficina-provisioning-20260911/home-historical-migration-provenance.json." |
| 22 | } |
| 23 | |
amadan