test(rls): cover public.data_gap_events in the RLS coverage gate by PetrefiedThunder · Pull Request #3589 · regengine/RegEngine

PetrefiedThunder · 2026-10-25T04:20:13Z

Adds data_gap_events (created by #3572, alembic v135) to PUBLIC_TENANT_SCOPED_TABLES in tests/migrations/test_rls_coverage.py, so the gate checks it like the other curated public tenant tables.

Matches what the migration does (alembic/versions/20261024_41f96588d87c_v135_data_gap_time_to_fix.py):

tenant_id uuid not null
enable row level security and force row level security
tenant_isolation_data_gap_events for all, USING and WITH CHECK on tenant_id = (select public.get_tenant_context()) with the sysadmin arm first

Local: the suite skipped because the disposable testcontainers Postgres did not start on this machine; CI runs it against the service Postgres.

Note

Low Risk
Test-only change to the migration RLS regression suite; no runtime or schema behavior is modified.

Overview
Extends the public-schema RLS coverage gate (#2828) so public.data_gap_events (from #3572 / alembic v135) is checked like other curated tenant tables.

Adding it to PUBLIC_TENANT_SCOPED_TABLES makes CI assert NOT NULL tenant_id, FORCE ROW LEVEL SECURITY, and a policy that references get_tenant_context()—matching the migration’s posture and preventing ENABLE-without-FORCE or empty-policy regressions on this table.

^{Reviewed by Cursor Bugbot for commit 153011f. Bugbot is set up for automated code reviews on this repo. Configure here.}

Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com>

vercel · 2026-10-25T04:20:15Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
regengine	Ready	Preview	Oct 28, 2026 11:32am UTC

chatgpt-codex-connector · 2026-10-25T04:20:22Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T04:20:59.152362Z	`153011f`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

coderabbitai · 2026-10-25T04:20:35Z

No actionable comments were generated in the recent review.

Recent review info

Run configuration

Source mode: Auto
Repository: regengine/RegEngine
Branch: claude/rls-data-gap-events
File: .coderabbit.yaml
Commit: af880ec
Layers: Repository YAML
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 8e58a334-f9cb-4578-a1a8-cd31cec58330

Commits

Reviewing files that changed from the base of the PR and between 58ad189 and af880ec.

Files selected for processing: 1

tests/migrations/test_rls_coverage.py

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 0 remain after this review.

Walkthrough

The curated PUBLIC_TENANT_SCOPED_TABLES set now includes data_gap_events. A comment records its expected non-null tenant ID, forced RLS, and get_tenant_context() predicate.

Priority: Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: Minimal · up to af880

No actionable merge-blocking risk was identified.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Description check		The description explains the change, its RLS requirements, and the test limitation. It does not follow the repository template because it omits the required Type of Change, Checklist, and Related Issu…	Update the description to include the template sections: Summary, Type of Change with applicable options selected, Test Plan with applicable options selected, Checklist with each item addressed, and Related Issues or an explicit statement t…

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly identifies the test change and the specific table added to the RLS coverage gate.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 1 files.

Full details: Description check

Explanation

The description explains the change, its RLS requirements, and the test limitation. It does not follow the repository template because it omits the required Type of Change, Checklist, and Related Issues sections, and it does not provide the required checkbox selections.

Resolution

Update the description to include the template sections: Summary, Type of Change with applicable options selected, Test Plan with applicable options selected, Checklist with each item addressed, and Related Issues or an explicit statement that none apply. Retain the existing migration and test-environment details under the relevant sections.

Finishing Touches

📝 Generate docstrings

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-10-25T04:35:34Z

Vercel preview access note removed (A-2177 secret-hygiene cleanup).
Access is via Vercel login (Deployment Protection).

github-actions · 2026-10-25T04:36:43Z

PR Blocker Checklist

Head SHA: af880ecd52692ed4fda4e50ebada104fb8890b7c

Status: Ready

All review threads resolved
No reviews requesting changes
No blocked review engines

PetrefiedThunder

Review of 153011f.

The change is correct. v135 (20261024_41f96588d87c) creates data_gap_events with tenant_id uuid not null. It runs ENABLE and FORCE row level security and creates policy tenant_isolation_data_gap_events on get_tenant_context(), with the sysadmin CASE arm. Listing the table in PUBLIC_TENANT_SCOPED_TABLES matches that.

This PR does not fix the red it was opened for. The EXTRA TABLE parity failure on #3551 is stale: #3551's merge predates f973979 (#3549), which added data_gap_events to docs/schema/expected_schema.json. Main's current red is the ingest-samples test, which #3585 targets.

Blocking: CI is not green on this head.

The Repo-root security/RLS/isolation suite fails in tests/docs/test_ingest_samples_validate.py (EXPECTED_SAMPLES mismatch, inherited from main).
PR Blocker Checklist and Head SHA Check Guard are cancelled-only.
PR Gate: Backend and the Test jobs are still pending.
Engine Review Pass failed.
Re-review once #3585 lands and this branch is updated.

REVIEW: FAIL codex 153011f

PetrefiedThunder

REVIEW: PASS deepseek 58ad189

Full review (no earlier DeepSeek pass). Reviewed by hand; no dsh headless run.

tests/migrations/test_rls_coverage.py:125-127 adds "data_gap_events" to PUBLIC_TENANT_SCOPED_TABLES, with no other changes. I checked it against alembic revision 41f96588d87c (v135): tenant_id is uuid NOT NULL, RLS is ENABLE + FORCE, and policy tenant_isolation_data_gap_events uses get_tenant_context() with the sysadmin CASE arm. The entry is accurate.
Remerge-diff of the head merge is empty.
All real CI checks are green. The Postgres-backed gate test runs in CI.
CI note: the only failing checks are gates that wait on an engine review of this head (Engine Review Pass: "No passing review from a non-author engine for current head SHA", plus the PR Blocker Checklist / Head SHA Check Guard aggregates). That is circular, so I am posting per C.Lee.

PetrefiedThunder

REVIEW: PASS deepseek 58ad189

This follows up my earlier hand review. A dsh headless run on the full PR diff (merge-base..58ad189) confirmed the PASS. Excerpt:

No concrete bugs found.

The diff adds `"data_gap_events"` to `PUBLIC_TENANT_SCOPED_TABLES` at `tests/migrations/test_rls_coverage.py:124-127`. That classification is correct: alembic revision `41f96588d87c` (v135) creates `public.data_gap_events` with `tenant_id uuid not null` (`alembic/versions/20261024_41f96588d87c_v135_data_gap_time_to_fix.py:31`), enables and forces RLS (`:73,76`), and installs `tenant_isolation_data_gap_events` with the sysadmin CASE arm first and `tenant_id = (select public.get_tenant_context())` otherwise (`:85-100`). The gate is non-vacuous: `test_listed_tables_all_exist` proves the table exists, and the NOT NULL/FORCE/policy assertions then run against it.

I applied the 4-line PR change to the current tree and ran `tests/migrations/test_rls_coverage.py` against a disposable real Postgres after `alembic upgrade head`; all 8 tests passed. The scratch DB and temporary edit were removed. The diff contains no invented data and no tenant-scoping defect.

VERDICT: PASS

PetrefiedThunder

REVIEW: PASS muse 58ad189

Test-only, 4 added lines: adds data_gap_events to PUBLIC_TENANT_SCOPED_TABLES in tests/migrations/test_rls_coverage.py.

Checked against alembic v135 (20261024_41f96588d87c) at this head: tenant_id uuid not null, ENABLE + FORCE RLS, and tenant_isolation_data_gap_events with the sysadmin CASE arm first and tenant_id = (select public.get_tenant_context()) in USING/WITH CHECK. The gate assertions match what the migration does. No fixtures or data are added. The merge commit 58ad189 only brings in main.

Not run locally: the suite needs the CI Postgres. The required gates (CI Status Gate, PR Gate Backend/Frontend/Workflow Contract) were still pending at review time.

Signed-off-by: C.Lee Sellers <chris@znc.dev>

PetrefiedThunder

REVIEW: PASS — delta re-review #3589 (data_gap_events RLS coverage)

Head reviewed: af880ecd52692ed4fda4e50ebada104fb8890b7c (claude/rls-data-gap-events).
Prior FAIL: #3589 (review) (153011ff3b9aa4746301d42e94d359ec53a14392).

Prior FAIL findings — status

Finding	Status
Code change correct (v135 tenant_id / ENABLE+FORCE / tenant_isolation policy)	Still holds
CI red: `tests/docs/test_ingest_samples_validate.py` EXPECTED_SAMPLES (from main)	Fixed — #3585 (`2eaad7532`) on main; this head merges it; `EXPECTED_SAMPLES` gone
PR Blocker / Head SHA cancelled-only; backend pending; Engine Review Pass failed	Process/CI timing on that head — not a code defect; re-reviewed after main merge

Delta verification

Range / net patch origin/main...HEAD: +4 / −0 in tests/migrations/test_rls_coverage.py only — adds data_gap_events to PUBLIC_TENANT_SCOPED_TABLES (comment + entry). Matches Lead’s claim.
Remerge-diff: merge origin/main into 153011ff → tree matches current HEAD for the PR file (empty remerge-diff). Blob for test_rls_coverage.py identical across 153011ff / 58ad189a / af880ecd (420694e4…). Clean merge; no patch drift.
Tenant scope confirmed at this head:
- Alembic v135 20261024_41f96588d87c: tenant_id uuid NOT NULL; ENABLE + FORCE RLS; tenant_isolation_data_gap_events with sysadmin CASE arm + get_tenant_context().
- Matching Supabase 20261025033803_data_gap_time_to_fix.sql: same shape.
Listed once in PUBLIC_TENANT_SCOPED_TABLES; not in PUBLIC_TABLES_SCOPED_VIA_PARENT. No synthetic data in the delta.

Verdict

PASS on the delta against the prior FAIL. Does not merge or request reviews; required checks / different-engine policy remain Lead’s.

REVIEW: PASS codex af880ec

test(rls): cover public.data_gap_events in the RLS coverage gate

153011f

Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com>

vercel Bot deployed to Preview October 25, 2026 04:21

View deployment

github-actions Bot added the database label Oct 25, 2026

PetrefiedThunder commented Oct 25, 2026

View reviewed changes

Merge branch 'main' into claude/rls-data-gap-events

58ad189

vercel Bot deployed to Preview October 25, 2026 05:30

View deployment

PetrefiedThunder commented Oct 25, 2026

View reviewed changes

PetrefiedThunder commented Oct 26, 2026

View reviewed changes

Merge branch 'main' into claude/rls-data-gap-events

af880ec

Signed-off-by: C.Lee Sellers <chris@znc.dev>

vercel Bot deployed to Preview October 28, 2026 11:32

View deployment

PetrefiedThunder commented Oct 28, 2026

View reviewed changes

PetrefiedThunder merged commit 886a2b7 into main Oct 28, 2026
91 of 94 checks passed

PetrefiedThunder deleted the claude/rls-data-gap-events branch October 28, 2026 14:07

Navigation Menu

Repository navigation

test(rls): cover public.data_gap_events in the RLS coverage gate - #3589

test(rls): cover public.data_gap_events in the RLS coverage gate#3589
PetrefiedThunder merged 3 commits into
mainfrom
claude/rls-data-gap-events

PetrefiedThunder commented Oct 25, 2026 •

edited by cursor Bot

Loading

Uh oh!

vercel Bot commented Oct 25, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 25, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 25, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 25, 2026 •

edited by PetrefiedThunder

Loading

Uh oh!

github-actions Bot commented Oct 25, 2026 •

edited

Loading

Uh oh!

PetrefiedThunder left a comment

Uh oh!

PetrefiedThunder left a comment

Uh oh!

PetrefiedThunder left a comment

Uh oh!

PetrefiedThunder left a comment

Uh oh!

PetrefiedThunder left a comment

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

PetrefiedThunder commented Oct 25, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vercel Bot commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

coderabbitai Bot commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 25, 2026 • edited by PetrefiedThunder Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Blocker Checklist

Status: Ready

Uh oh!

PetrefiedThunder left a comment

Choose a reason for hiding this comment

Uh oh!

PetrefiedThunder left a comment

Choose a reason for hiding this comment

Uh oh!

PetrefiedThunder left a comment

Choose a reason for hiding this comment

Uh oh!

PetrefiedThunder left a comment

Choose a reason for hiding this comment

Uh oh!

PetrefiedThunder left a comment

Choose a reason for hiding this comment

REVIEW: PASS — delta re-review #3589 (data_gap_events RLS coverage)

Prior FAIL findings — status

Delta verification

Verdict

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

PetrefiedThunder commented Oct 25, 2026 •

edited by cursor Bot

Loading

vercel Bot commented Oct 25, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 25, 2026 •

edited

Loading

coderabbitai Bot commented Oct 25, 2026 •

edited

Loading

github-actions Bot commented Oct 25, 2026 •

edited by PetrefiedThunder

Loading

github-actions Bot commented Oct 25, 2026 •

edited

Loading