Datenschutz
JARVIS — 0.68E-B ROW-LOCK PRIVILEGE FIX FINAL REVIEW + COMMIT
BASELINE
Repository:
gorandioso-cmd/jarvis-core
Branch:
main
Require:
HEAD:
7c2762e1db9a18157d0115b2f265dccce8984aaf
origin/main:
same
CURRENT LOCAL FIX
Expected new migration:
20260904100000_jarvis_authorization_row_lock_privilege_0_68_e_b.sql
Expected changed files only:
- supabase/migrations/20260904100000_jarvis_authorization_row_lock_privilege_0_68_e_b.sql
- supabase/tests/database/authorization_aware_execution_test.sql
- supabase/tests/database/execution_authorization_test.sql
- scripts/run-authorization-aware-execution-upgrade-test.mjs
- docs/AUTHORIZATION_AWARE_EXECUTION_0.68E_B.md
- docs/JARVIS_BUILD_JOURNAL.md
PRODUCTION SAFE STATE
Require read-only verification:
durable claiming_enabled=false
Netlify:
JARVIS_WORKER_CONTROL_CLAIM=disabled
Target WorkerRun:
56859806-ab8d-4dae-9e9d-16708b6432f1
must remain:
QUEUED
attempt=1
fence=1
unclaimed
Latest authorization:
EXPIRED
unconsumed
unrevoked
No lease/result/retry/attempt 2.
GOAL
Perform final security review of the row-lock privilege correction.
If and only if every review gate passes:
- create exactly one commit
- push to origin/main
Do NOT:
- apply migration remotely
- open gates
- CLAIM
- start GCE
- execute Worker/Codex
- create fresh authorization
- mutate production
A. LEAST PRIVILEGE
Review exact migration.
Require:
REVOKE UPDATE ON public.worker_execution_authorizations FROM service_role;
GRANT UPDATE(id)
ON public.worker_execution_authorizations
TO service_role;
or equivalent exact least-privilege semantics.
Require:
- no table-level UPDATE
- no DELETE grant
- no browser grants
- no SECURITY DEFINER broadening
- no claim logic changes
- no RLS weakening
B. ROW-LOCK PROOF
As actual service_role prove:
SELECT ... FOR UPDATE
on worker_execution_authorizations succeeds.
Require no SQLSTATE 42501.
C. APPEND-ONLY PROOF
As service_role prove:
- UPDATE id=id fails through append-only protection
- UPDATE non-id column fails
- DELETE fails
Authorization history remains immutable.
D. CLAIM REGRESSION
As actual service_role prove the authorization-aware claim path can now:
AUTHORIZED
+
gates logically enabled in local fixture
→ CONSUMED
→ lease
→ STARTING
atomically.
No owner/postgres masking.
E. NEGATIVE REGRESSIONS
Reprove:
- expired auth cannot claim
- revoked auth cannot claim
- missing auth cannot claim
- wrong attempt/fence/digest/project cannot claim
- unknown provenance cannot claim
- durable gate closed prevents claim
- anon/authenticated cannot access authorization rows or claim functions
F. ATOMICITY
Require rollback leaves:
no CONSUMED
no lease
no STARTING
no claim audit
for failing cases.
G. RACE SAFETY
Reprove revoke-versus-claim single-winner behavior.
No change to lock order.
H. UPGRADE PATH
Run:
E-A
→ E-B
→ row-lock privilege fix
Require:
- no data backfill
- historical grants unchanged
- historical queued work unchanged
- historical leases/results unchanged
- row-lock privilege corrected only after new migration
I. DATABASE VALIDATION
Run:
- clean local Supabase rebuild
- upgrade regression
- focused privilege/claim pgTAP
- full pgTAP
- database lint
J. APPLICATION VALIDATION
Run:
- Worker Control
- authorization-aware execution
- execution authorization
- GCE runner tests
- full runtime
- persistence integration
- private routes
- lint
- typecheck
- production webpack build
- diff checks
- staged secret scan
No provider calls.
K. DOCUMENTATION
Require docs truthfully record:
- first E-B claim attempt reached authorization row lock
- SQLSTATE 42501
- complete rollback
- service_role privilege mismatch
- UPDATE(id)-only least-privilege fix
- E-B remains NOT LIVE
L. PRODUCTION READ-ONLY
Reverify:
remote migration head:
20260901183000
new migration not applied
both gates closed
WorkerRun still QUEUED/unclaimed
authorization expired/unconsumed
leases=0
results=0
retries=0
attempt 2 absent
No production mutation.
M. COMMIT
If all gates pass:
create exactly one commit:
Fix E-B authorization row-lock privilege
Push to origin/main.
Do not manually deploy.
If Netlify auto-deploys the application commit:
report it truthfully, but do not trigger another deployment.
N. POST-COMMIT
Require:
main=origin/main
worktree clean
Exactly one pending remote migration:
20260904100000
Production DB still unchanged.
O. REPORT
Return:
1. Final review result
2. Exact privilege delta
3. Row-lock proof
4. Append-only proof
5. service_role claim proof
6. Negative regressions
7. Atomicity
8. Race safety
9. Upgrade-path result
10. pgTAP totals
11. Application validation
12. Documentation
13. Commit SHA
14. Git status
15. Remote migration state
16. Netlify state if auto-deployed
17. Production safety state
18. Recommended remote migration apply sequence
End exactly:
0.68E-B ROW-LOCK PRIVILEGE FIX BASELINE COMPLETE