fix(planning): serialize PostgreSQL transaction queries

[seonghobae]

Root cause

Planning data-rights export and erasure treat PostgreSQL results as durable dependency evidence. The preserved repair lineage serializes admitted SQL on one node-postgres transaction connection, revokes retained callback SQL authority, snapshots parameters at admission, drains admitted work before transaction control, preserves transaction-fatal query failures, keeps pool shutdown one-shot, and fails closed for malformed temporal/integer/digest/Today/UUID evidence.

RED → repair lineage

• 7531367700dfdc5cfe9a3459bdda3c1b07e763de → 532774dc61f9defabb81d50773c6265dddff4b6e: serialize concurrent application queries on one connection.
• 75ada4e8b8711ba0c8da64a6746844f342badf5c → d1b640f867001afe1230d218850ed6353925d6c2: transaction control waits for every admitted query.
• 437c8389f0f7c3e113103e8f128ea6fced637c1b → 125b7b6b56d7ff46e2acb65b1cf3a14f2652169e: revoke retained callback SQL capability before drain/control.
• 8819340e78688617712b7b0b7171cb9a72f39ac6 → b5bc9ef6837af5338c21245861e638f2caa9f6b8: snapshot admitted query parameters.
• cca915e51f329d3c4ab215839fb6d55eaaea46c4 → d8fd491e57333c6a864c0b142d12f5d3360a824f: preserve one-shot Pool.end() authority, including failure.
• d1361e22e412b01d7ece51e581d3934a017b1297 → 1bde59441c767c59614abeb8a71330a010df839d: any admitted query failure prevents COMMIT and causes rollback.
• f762bb16697c10d9eb5aade153c6f15e1c94a19e → 4969afcf324703990e8836a4968578a2eb5d1ec0: reject impossible temporal evidence.
• 90b2aaf320dde57fd841ec6d78f91c4e40e9c863 → a47fd221b07cd1d1eeee9944e7c3ba84c3ef6340: reject string-coerced persisted counts.
• 2136255266ad004eeccd3a10952af8be23199697 → cc96fe925026254d64f6ea8cad422a59e30c431e: reject recanonicalized durable SHA-256 evidence.
• 8990fda1e7b10547a506c2a49d701e857dad4fcf / 22a26d2f61b10ad83362bcf1327b4662f25abb7f → 952ace9ba38f370a014e19282de704f13e13f705: require persisted Today payloads to already satisfy domain invariants.
• ea74805353c4011c1002507efc0f85850e82e943 → 98b031ff0d32b881b77174ebdf67b358b93cbdde: accept only persisted created/updated Today result kinds.
• 4e8fe8e992739340e8e8d6ad1bf6dc0a687c466e → 9f2baf96e5e963e3c8794a7abf985eb347f03557: require durable PostgreSQL UUID evidence to already be canonical lowercase while retaining request-boundary normalization.
• Receipt-binding RED 9a3b2e5d15a5159a207e02572c4166f7d32cbfa1 proves a syntactically valid lowercase 64-hex receipt digest can be replayed even when it does not bind the exact durable receipt fields. Causal repair d5a10327243b87494c4f401a032cca137af72041 centralizes the canonical receipt digest over contributor, workspace, requesting user, request, idempotency key and erased-record count, and recomputes it before replay authority is returned. CHANGELOG descendant 2ab280d0e9b0f84a13611c34a87533dd7ac2270f records the contract.

The bounded predecessor control accepts an arbitrary canonical-looking lowercase digest; repaired semantics reject it and accept only the exact fixture digest. This is focused RED/GREEN evidence, not repository-wide GREEN.

Current protected-main adoption

Protected base remains main@193a87ef54c3fe6dcda4755bce4d6bc81e3a0297. Current exact head is 2ab280d0e9b0f84a13611c34a87533dd7ac2270f, open/mergeable and a non-force descendant. This lane remains Draft until unchanged-head repository/security checks, independent approval/thread state, and live-base compatibility are terminal and valid.

Exact-head hosted runs are CI 34057676548, Commercial Readiness 34057676684, Security Scan 34057676568, CodeQL PR 34057676547, AppGuardrail 34057676582, and SAST Semgrep 34057676566; current reads are queued/pending. No predecessor workflow evidence transfers to this head.

Do not duplicate #247's formatter/source repair or #246's package graph repair here; consume protected foundations by normal merge/non-force restack. No schema, SQL text, isolation level, HTTP/event contract, pool sizing, credentials, self-approval, administrator bypass, force-push, destructive rebase, stale evidence reuse, or gate weakening is introduced.

Refs #211, #212, #219, #245, #246, #247; ContextualWisdomLab/.github#712; ContextualWisdomLab/appguardrail#1106.

[seonghobae]

@coderabbitai review

[coderabbitai]

Warning

Review limit reached

Next included review available in 52 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 2c7838f0-3857-4a8a-95ed-b271ed8acf58

📥 Commits

Reviewing files that changed from the base of the PR and between 193a87e and 2ab280d.

📒 Files selected for processing (13)

• CHANGELOG.md
• apps/planning-service/src/planning-data-rights-digest-evidence.test.ts
• apps/planning-service/src/planning-data-rights-integer-evidence.test.ts
• apps/planning-service/src/planning-data-rights-query-failure-serialization.test.ts
• apps/planning-service/src/planning-data-rights-query-serialization.test.ts
• apps/planning-service/src/planning-data-rights-result-kind-evidence.test.ts
• apps/planning-service/src/planning-data-rights-temporal-evidence.test.ts
• apps/planning-service/src/planning-data-rights-today-payload-evidence.test.ts
• apps/planning-service/src/planning-data-rights-uuid-evidence.test.ts
• apps/planning-service/src/planning-data-rights.ts
• apps/planning-service/src/planning-runtime-shutdown.test.ts
• apps/planning-service/src/planning-runtime.ts
• apps/planning-service/src/planning-transaction-capability-lifetime.test.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}