feat(observation): define immutable PostgreSQL schema snapshot contract

[seonghobae]

Commercialization slice

Advance Issue #2 through the Source Observation bounded context before semantic inference or live source coupling. Source-access policy, immutable relational evidence, semantic inference, provider routing, persistence, and publication authority remain separate.

Current exact stack — 2026-09-06

• base: Client feat(client): add offline semantic release admission contract #5 fcf36c8a99f015b963c9f812787df127ac2e2f9e;
• exact Source Observation head: 331f8edcd7cebb1719e5cea3187f3848ce7b9e71;
• Draft/open; mergeability must be read fresh because sequential ordinary commits can transiently invalidate cached GitHub mergeability;
• predecessor/local evidence does not transfer to this exact head.

Retained Source Observation contract

The stack retains owner-computed deterministic source-content identity, strict UTC provenance, exact-schema request metadata, typed cancellation/resource failures, provider-independent awaitable Send execution, one non-resetting operation budget across local authorization and adapter execution, policy-authorized exact schema scope/resource envelope, immutable source-policy binding, canonical snapshot containment inside the authorized scope, stale-binding rejection, and binding-preserving immutable receipt provenance.

Source keys and connection-policy bindings are bounded opaque identifiers; DSNs, credentials, PostgreSQL runtime objects, provider-specific settings, foreign domain truth, and wall-clock timestamps remain outside the provider-independent port.

Single-use authorization repair

Review 5124482059 identified replay amplification at exact predecessor db209b9b11039ed77cbae246f65b3a83d7589d23: AuthorizedObservationRequest was Clone and SourceObservationPort::observe borrowed it, so one registry authorization could start multiple sequential/concurrent observations and multiply a per-operation row/byte/concurrency/source-access budget.

2a03a56a5982f9d56e880689a139597aea3ef47d changed the async port fixture first so execution consumes an authorization by value and cancellation/success controls obtain separate authorizations. Against the predecessor trait this is the committed compile-contract RED specification; it was not executed in the predecessor writer's tool environment. The handed-off local successor now executes the complete by-value fixture suite.

340ded102f18c1c4abebbcf0590e5941b61f6cba is the minimum production repair: AuthorizedObservationRequest no longer implements Clone, and SourceObservationPort::observe consumes it by value. Successor fixtures 72deb9fb..., 6a29cbe1..., cd6d999f..., 8ef12399..., and 30d253f8... preserve authorization zero-side-effect, cancellation, stale-binding, remaining-budget, and resource-envelope behavior on the linear seam.

Architecture/TRD/Security/Test Strategy/Operability/CHANGELOG and the product-gap baseline are code-current. Proposed ADR 0006 refines ADR 0004 with the single-use operation-capability decision. docs/doctoring/source-observation-authorization-replay-governance.md@e3c41560... traces the finding and exact source/test lineage to OWASP API4:2023 and MITRE CWE-770 while treating those sources as general resource-governance evidence rather than claiming they prescribe a Rust ownership design. Retry after cancellation/failure/success requires a fresh ObservationRequest::authorize decision; a concrete adapter may still borrow its owned request internally while constructing PostgresSchemaSnapshot.

UNIQUE null-comparison repair and executed verification

Review 5124531466 is source-repaired and locally tested on exact head 331f8edcd7cebb1719e5cea3187f3848ce7b9e71 (runtime e3ac294b976d35f113fe9b920060f62c4a28f57f). The owner explicitly handed off this bounded repair from e3c415600300b6c2d5b852c457ea6ab2e5222e08; base #5 is unchanged.

• bab6984: executed false/true digest-collision RED; 8b5b738: four passing and two failing collision/framing tests.
• 6c23924: existing optional-boolean encoding binds unknown, observed distinct and observed not-distinct into v2 snapshot/receipt identity; six focused tests pass. Historical v1 receipts are not rewritten and no wire-version migration is claimed.
• Baseline execution also found a missing detached-artifact documentation paragraph, formatting drift, strict Clippy failures, and missing coverage paths. Ordinary commits preserve those failures and repair the causes. Standard async test methods/no-op wakers replace wrappers; source byte admission checks remaining capacity before adding, retaining the same ceilings and typed denial.
• Final committed head: 132 tests across 42 suites including two doctests, fmt, strict Clippy, warnings-denied rustdoc, release build and unchanged coverage gate passed. Coverage: 228/228 functions, 2026/2026 normalized regions, 194/194 normalized branches. Raw LLVM: 1807/1825 lines, 2192/2206 regions, 188/194 branches, explicitly below 100%.
• Product CI contract, actionlint, three existing JSON schemas and twelve fixtures, supersession semantic controls, unchanged lockfile and cargo-deny advisory check passed locally. The advisory tool used its default configuration because this branch has no custom deny policy; this is not hosted security acceptance.

See exact-head doctoring and Gap baseline. PRD/TRD/ADR/Context Map/UL/UML/security/test/operability/CHANGELOG agree. PostgreSQL sources are cited in APA 7; the future ACL must observe the unique constraint's exact supporting-index flag.

Local success is not protected or production acceptance. Keep Draft and ADR 0004/0006 Proposed. Current-head independent review, hosted Product/security evidence, protected prerequisites and actual PostgreSQL adapter conformance remain required. No Zotero item, private paper, model route, semantic truth or publication state changed.

PostgreSQL adapter boundary

The concrete adapter remains subsequent work after unchanged-head Rust/Product verification. It must use a maintained patched Rust PostgreSQL driver, resolve least-privilege credentials only from the exact authorized key-and-binding pair, reject a stale binding before credential/source access, obtain one fresh authorization per attempted observation/retry, use one explicit REPEATABLE READ READ ONLY catalog transaction, preserve exact-schema pg_catalog evidence, and cap connect/transaction/statement/cancellation work from the policy-admitted resource envelope plus remaining_operation_budget() rather than resetting the configured duration. Row/byte/concurrency limits, cancellation, source disappearance, complete-or-fail immutable snapshot construction, and deterministic replay against a frozen anonymized GRC-shaped fixture remain required. governance-risk-compliance retains authority for its business truth; no source copy or cross-service application-table SQL.

Merge gate

Keep Draft. Local unchanged-head Rust/normalized-coverage/rustdoc evidence now exists. Obtain current-head independent review and hosted Product/security evidence, reconcile remaining raw LLVM differences, and repair only observed failures. Only then add the concrete PostgreSQL adapter and prove stale-binding plus over-budget/replay rejection against real credential/source resolution. Foundation/Client prerequisites, applicable security/SAST/dependency evidence, valid independent review and zero valid unresolved findings remain required before integration.

No self-approval, review dismissal, force push, destructive rebase, admin bypass, no-op retrigger, gate weakening, provider bypass or predecessor-evidence transfer.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Replay-amplification finding 5124482059 is source-repaired on this exact head. The canonical execution seam now treats AuthorizedObservationRequest as one operation capability: it is non-Clone, SourceObservationPort::observe consumes it by value, and cancellation/success controls obtain distinct authorizations. By-value successors preserve authorization-denial zero-side-effects, resource-envelope policy, stale-binding rejection, and remaining-operation-budget behavior. Architecture/TRD/Security/Test Strategy/Operability/CHANGELOG/product-gap baseline and Proposed ADR 0006 are aligned; doctoring traces the resource-governance rationale without claiming OWASP/CWE mandate the Rust ownership mechanism.

This is verification-pending, not GREEN. Fresh exact-head GitHub inspection returns zero pull-request workflow runs for e3c415600300b6c2d5b852c457ea6ab2e5222e08; the only combined status is CodeRabbit success with Review skipped: draft pull request. The current tool environment has no Rust toolchain, so 2a03a56... is a committed compile-contract specification rather than an observed compiler RED, and 340ded10... plus successors are statically inspected source repair rather than executed GREEN. Keep Draft/ADR Proposed until one unchanged head passes Rust 1.98 tests, strict fmt/Clippy, warnings-denied rustdoc, release build, owned 100% coverage, and applicable security/dependency gates. Concrete PostgreSQL adapter remains after that evidence.

[seonghobae]

현재 exact head e3c415600300b6c2d5b852c457ea6ab2e5222e08에서 PostgreSQL 18 UNIQUE constraint의 NULL 비교 의미가 immutable observation identity에서 소실됩니다. UniqueConstraintObservation은 현재 constraint name과 ordered column names만 보존하고, compute_snapshot_digest도 그 두 좌표만 인코딩합니다. 따라서 동일한 이름/컬럼을 가진 UNIQUE NULLS DISTINCT와 UNIQUE NULLS NOT DISTINCT가 같은 observation과 같은 source-content digest로 축약될 수 있습니다. PostgreSQL 18의 공식 pg_index 계약은 indnullsnotdistinct=false일 때 NULL을 서로 다른 값으로 취급하고, true일 때 NULL을 같은 값으로 취급한다고 명시합니다. 이는 단순 표시 차이가 아니라 허용 가능한 데이터 집합을 바꾸는 uniqueness semantics입니다: https://www.postgresql.org/docs/18/catalog-pg-index.html

이 finding은 Source Observation이 immutable relational evidence와 owner-computed deterministic source-content identity를 소유한다는 현재 TRD/aggregate 계약에 직접 걸립니다. Concrete adapter를 추가하기 전에 최소 causal contract를 먼저 닫는 편이 맞습니다. RED acceptance는 동일한 table/schema/constraint name/ordered columns에서 nulls_not_distinct=false와 true만 다른 두 snapshot이 서로 다른 canonical digest를 가져야 하고, not observed 상태도 explicit false와 동일시되지 않아야 한다는 것입니다. 최소 GREEN은 UniqueConstraintObservation에 provider-independent Option<bool> 형태의 observed NULL-distinctness evidence를 추가하고, accessor/constructor-or-builder와 snapshot digest framing에 해당 값을 포함하는 것입니다. 이후 PostgreSQL adapter는 unique constraint의 pg_constraint.conindid로 supporting index를 결합해 pg_index.indnullsnotdistinct를 읽어야 합니다. 일반 index semantics나 provider runtime type을 observation domain으로 끌어올릴 필요는 없습니다.

현재 실행 환경에는 Rust 1.98 toolchain이 없고 이 exact head의 pull-request workflow run도 0개이므로, 이 review를 실행된 RED로 부르거나 즉시 unverified source repair를 GREEN으로 승격하지 않습니다. 다음 source mutation은 이 semantic-collision regression을 실제로 실행할 수 있는 경로에서 RED를 먼저 관측한 뒤 최소 수정하고, unchanged exact head에서 tests/fmt/Clippy/rustdoc/release/owned coverage를 다시 확인해야 합니다. PostgreSQL 18의 condeferrable/condeferred/conperiod도 별도 exact source semantics이지만 이번 finding의 causal 범위는 NULL-distinctness 하나로 제한합니다.