security(state): reject blank PostgreSQL DSN bootstrap

[seonghobae]

Refs #195. Draft child of exact parent #194@eeddc49170b30169bb3fd6a918ee91a74e1ce9f3.

Verified fail-closed defect

The PostgreSQL secret-bootstrap boundary treated whitespace-only DSN material as present. Environment bootstrap checked only !value.is_empty(), and the credentials-file path reused the legacy generic JSON credential conversion that also considered a whitespace-only string non-empty. A production-state successor could therefore observe postgres_dsn as configured while the material was semantically blank, deferring a missing-secret failure into a parser/connection failure.

This is Wardnet-owned secret admission only. It does not parse PostgreSQL URI/keyword syntax, open a database connection, implement migrations/RLS, or widen durable-state ownership beyond #80/#192.

Hosted hostile RED

Test-only source head c63fcbb7a445c7c982efd85af88d94f975275ec6 changed only tests/postgres_credential_boundary.rs; production source remained byte-identical to #194.

CI 34221277296, Rust job 102044716849, acquired GitHub-hosted ubuntu-24.04 runner 1001780342. The protected repository workflow executed GitHub's synthetic PR merge ref for that source/base pair, not the source SHA itself. Checkout/toolchain and cargo fmt --check succeeded, then locked workspace Test failed exactly on the new hostile cases:

• whitespace-only environment POSTGRES_DSN was returned as Some(" \t ") instead of absent;
• whitespace-only credentials-file postgres_dsn was returned as Some(" \t ") instead of absent.

The four positive/control tests passed and Clippy was skipped after the semantic failure. This is a causal behavioral RED for the source delta, but it is not an exact-source-checkout receipt; #166 owns the Wardnet workflow repair that pins and verifies PR source heads.

Minimal causal repair

Current source head is 78149209ed2c3c7443edacad423e26c4ae6c521d, linear/non-force on the executed RED. Production repair is limited to src/credentials.rs:

• credentials-file PostgreSQL DSN is admitted only when the string is not blank after trim();
• environment PostgreSQL DSN uses the same blank predicate;
• any admitted nonblank DSN is stored byte-for-byte without trimming or normalization;
• administrator CredentialSource and has_admin_auth() semantics remain unchanged;
• no DSN grammar, transport, database, RLS/migration, or foreign-owner behavior is added.

Current repository integration evidence is terminal GREEN for the synthetic merge candidate:

• CI 34221566705, Rust job 102045647544, runner 1001780437: SUCCESS through format, locked workspace tests including both hostile blank cases, and strict Clippy. Job logs prove checkout of synthetic pull/196/merge@757e44254017cc1e86e661ae93e7cde0204537e6, formed from source 78149209... and base eeddc491...;
• Fuzz 34221566709, job 102045647762, runner 1001780413: SUCCESS after all four bounded 60-second targets.

This evidence is deliberately not labeled exact-source-head GREEN. Protected main still runs the pre-#166 default-checkout workflows, so source-head identity must be reacquired after #166 reaches protected truth or another repository-owned immutable exact-head execution path becomes authoritative. No predecessor result is promoted to fill that gap.

No no-op redispatch, selector churn, force update, destructive rebase, self/model approval, routine administrator bypass, or gate weakening was used.

Stack / integration boundary

Keep Draft behind #140 -> #193 -> #194. #140 remains the Runtime Configuration foundation; #193 remains the explicit production-state-authority prerequisite; #194 remains the PostgreSQL secret-bootstrap prerequisite; #80 remains canonical for the PostgreSQL repository/transaction/migrations/RLS/recovery implementation and #192 for durable source-generation uniqueness acceptance. #166 is the Wardnet-owned evidence-integrity prerequisite for exact PR source-head checkout.

After parent/workflow movement, non-force adopt fresh protected ancestry and reacquire source-head identity, format, tests, Clippy, fuzz and every then-live repository/security/coverage/package/SBOM/provenance/review/thread/governance gate on one unchanged head. This stacked source repair plus synthetic-merge GREEN does not authorize stack collapse or protected-main merge.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}