test(state): require recoverable publication migration rollback

[seonghobae]

Refs #80 #192. Draft child of exact #208@5a4c510aad6a63c738fcf69656fa385e8343521b.

Recovery defect and executed RED

The PostgreSQL reputation publication stack had forward migrations 0001..0003 but no executable rollback from publication schema to the preceding source-generation admission boundary. #80 requires migration upgrade/rollback/recovery acceptance before PostgreSQL can become production state authority.

Test-first 71ef3240ef150ba117b77d0492cb1cdd24eb8691 added the real PostgreSQL 18.4 recovery contract while production remained unchanged. Formatting-only 7765a7d60e99dcde93bf7deb0044d3984aa0918f made that contract executable. Hosted CI 34250189871, rust job 102142339076, acquired GitHub-hosted ubuntu-24.04, passed checkout/toolchain/cargo fmt --check, then failed in Test while the required migrations/0003_reputation_source_publication.down.sql artifact was absent; Clippy was skipped. This is the causal semantic RED rather than a runner or formatting failure.

The regression applies 0001..0003, publishes generation 1, rolls only migration 0003 back, proves publication function/history/head are gone while 0001 generation history plus the 0002 admission capability survive, requires rollback replay to be safe, reapplies 0003, republishes the preserved generation and proves the generation binding is not duplicated.

Minimal causal repair and exact-current GREEN

Current exact head is b191c98ec539dbee92700b32f3fbe0c42c8b77d9. It adds only migrations/0003_reputation_source_publication.down.sql on top of the test-first lineage. The down migration owns one explicit transaction, drops the outer publication capability before its backing tables, drops last-known-good head before immutable publication history, and intentionally preserves migrations 0001..0002 and their admitted generation identities. It creates no roles, credentials, repository wiring or foreign-owner behavior.

Hosted CI 34250487750, rust job 102143370052, is terminal SUCCESS on unchanged exact b191c98e...: hosted ubuntu-24.04 acquisition, exact checkout, toolchain, formatting, all locked workspace tests including the PostgreSQL 18.4 rollback/reapply regression, and strict Clippy all passed.

Fresh exact parent comparison is ahead_by=3, behind_by=0, merge base exactly 5a4c510aad6a63c738fcf69656fa385e8343521b; the complete parent-relative delta is exactly the rollback migration plus its integration test. Submitted reviews: 0. Inline review threads: 0. No predecessor result is promoted as current-head GREEN.

Remaining recovery boundary

This slice proves schema rollback/reapply only. It does not enable StateAuthority::Postgres, map production principals, prove pool checkout/reset hygiene, crash/retry, backup/restore or immutable protected release readiness.

Migration 0003 deliberately does not own cluster-role lifecycle. After a rollback drops the SECURITY DEFINER publication function, reapplying 0003 recreates that function under the migration principal; recovery therefore must reconverge the existing #208 deployment-role installer before runtime publication authority is restored. A follow-on #80 recovery acceptance must prove the recreated function is again owned by wardnet_state_owner, PUBLIC execution remains revoked, wardnet_runtime receives only outer publication EXECUTE/read authority, direct mutation/inner admission remain denied, temporary schema CREATE is absent, and recovery replay remains idempotent. Do not move role creation into the migration to manufacture GREEN.

Keep Draft behind #208. No force update, destructive rebase, predecessor evidence reuse, self/model approval, routine bypass, gate weakening, no-op workflow churn, mutable foreign dependency, source copy or cross-service SQL.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}