fix(state): make foundation migrations failure-atomic

[seonghobae]

Refs #80 #192 #213. Draft child of exact #212@32b070c3ef2456efc58dc56733531f24fcbaf4f3.

Executed hostile RED

Test-only exact 284ea3c4188f8533416a6ac68cdda6325c5565d6 left production migrations byte-identical to #212 and added only tests/postgres_foundation_migration_atomicity.rs.

Hosted CI 34257768388, rust job 102167794974, acquired GitHub-hosted ubuntu-24.04, passed exact checkout/toolchain/cargo fmt --check, then failed in Test; Clippy was skipped. The parent exact head was already GREEN and the only child semantic delta was the two PostgreSQL 18.4 hostile regressions:

• 0001 injects deterministic division-by-zero after CREATE TABLE reputation_source_generation and before privilege/RLS/policy completion, then requires no generation table to survive and clean replay to succeed;
• 0002 applies clean 0001, injects deterministic division-by-zero after CREATE FUNCTION wardnet_admit_reputation_source_generation and before PUBLIC execution revocation, then requires 0001 to remain, the partial function to be absent, and clean 0002 replay to succeed.

This is semantic migration-failure RED, not runner/bootstrap/formatting noise.

Minimal causal repair and exact-current GREEN

Current exact head is 7c7b980b7a2f41e2a369a71bb32e945de7f30bfd, five commits ahead and zero behind exact parent #212. The complete child delta is five files only: the hostile PostgreSQL regression, explicit transaction bracketing in forward migrations 0001 and 0002, one Proposed ADR covering the complete 0001→0003 failure-atomic boundary, and the Unreleased CHANGELOG entry.

The production repair is PostgreSQL-native and minimal: 0001 and 0002 now each own one explicit BEGIN/COMMIT transaction, matching 0003. It does not add IF NOT EXISTS, normalize unknown partial state, create cluster roles, weaken FORCE RLS/privileges, enable StateAuthority::Postgres, or introduce foreign-owner behavior.

Hosted CI 34258628942, rust job 102170699585, is terminal SUCCESS on unchanged exact 7c7b980b...: hosted ubuntu-24.04 acquisition, exact checkout, pinned toolchain, formatting, all locked workspace tests including both PostgreSQL 18.4 injected foundation-migration rollback/replay regressions and the existing publication/recovery suites, and strict Clippy all passed.

Submitted reviews: 0. No predecessor result is promoted as current-head GREEN.

Remaining stack and recovery boundary

Keep Draft behind #212. #210 remains the next recovery-order invariant: after 0003 rollback/reapply recreates the SECURITY DEFINER publication function under the migration principal, deployment must reconverge the existing idempotent deploy/postgresql/reputation_state_roles.sql before runtime publication authority is considered restored. Do not move role creation into schema migrations to manufacture recovery GREEN.

#80/#192 still own actual deployment-principal mapping, repository/transaction wiring, pooled tenant-context checkout/reset, crash/retry, backup/restore and immutable protected release acceptance. StateAuthority::Postgres remains fail closed.

No force update, destructive rebase, predecessor evidence reuse, self/model approval, routine bypass, gate weakening, no-op workflow churn, mutable foreign dependency, source copy or cross-service SQL.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}