From 22b84ead9c239d51308cc8ebbb48595b439ed2b9 Mon Sep 17 00:00:00 2001 From: Mikhail Date: Sun, 23 Aug 2026 03:40:33 +0300 Subject: [PATCH] fix: grant development gate owner access --- .../migrations/038_work_development_gates_privileges.sql | 6 ++++++ dev/tasks/DEV-000197-durable-development-gate.json | 6 +++--- 2 files changed, 9 insertions(+), 3 deletions(-) create mode 100644 database/migrations/038_work_development_gates_privileges.sql diff --git a/database/migrations/038_work_development_gates_privileges.sql b/database/migrations/038_work_development_gates_privileges.sql new file mode 100644 index 0000000..9442d03 --- /dev/null +++ b/database/migrations/038_work_development_gates_privileges.sql @@ -0,0 +1,6 @@ +BEGIN; + +ALTER TABLE work.development_gates OWNER TO work_role; +GRANT SELECT, INSERT, UPDATE ON work.development_gates TO work_role; + +COMMIT; diff --git a/dev/tasks/DEV-000197-durable-development-gate.json b/dev/tasks/DEV-000197-durable-development-gate.json index cbaa310..9107218 100644 --- a/dev/tasks/DEV-000197-durable-development-gate.json +++ b/dev/tasks/DEV-000197-durable-development-gate.json @@ -6,7 +6,7 @@ "risk_tier": "E", "intent": "Persist the governed self-development gate as a Work-owned revisioned state machine with optimistic concurrency, without executing code or granting promotion authority.", "requirement_ids": ["WP-701", "durable governed self-development provenance", "CAS stage transitions"], - "allowed_change_scope": {"modules": ["work", "postgres persistence"], "paths": ["contracts/work/self_development.go", "modules/work/ports/development.go", "adapters/postgres/work_repository.go", "database/migrations/037_work_development_gates.sql", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000197-durable-development-gate.json"]}, + "allowed_change_scope": {"modules": ["work", "postgres persistence"], "paths": ["contracts/work/self_development.go", "modules/work/ports/development.go", "adapters/postgres/work_repository.go", "database/migrations/037_work_development_gates.sql", "database/migrations/038_work_development_gates_privileges.sql", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000197-durable-development-gate.json"]}, "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "deploy/**", "cmd/**", "modules/identity/**", "contracts/authority/**", ".gitea/**"]}, "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 1}, "contracts": {"consume": ["existing DevelopmentGate state machine", "Work-owned persistence boundary"], "may_change": ["revision metadata on DevelopmentGate"]}, @@ -14,10 +14,10 @@ "canonical_state": ["work.development_gates"], "state_transitions": ["persist initial evidence gate", "advance only through caller-validated stage with expected revision", "reject stale revision"], "side_effects_and_privileges": ["database persistence only; no worktree, provider, source, deployment or promotion mutation"], - "persistence_and_migrations": ["037_work_development_gates.sql"], + "persistence_and_migrations": ["037_work_development_gates.sql", "038_work_development_gates_privileges.sql"], "failure_retry_restart": ["CAS conflict is explicit and retry requires reloading the gate; restart reloads durable provenance"], "assumptions": ["domain AdvanceDevelopmentGate remains the sole stage transition validator", "external bridge is a later independently operated capability"], - "acceptance_scenarios": ["initial gate persists at revision 1", "update with expected revision succeeds", "stale revision is rejected", "all provenance fields round-trip without secrets"], + "acceptance_scenarios": ["initial gate persists at revision 1", "update with expected revision succeeds", "stale revision is rejected", "all provenance fields round-trip without secrets", "work_role can read and write the table"], "required_tests": ["go test ./...", "go vet ./...", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "go run ./cmd/devctl/independent -task dev/tasks/DEV-000197-durable-development-gate.json", "git diff --check", "CI", "production migration and health check"], "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "REQUIRES_MIGRATION_DECISION"] } -- 2.54.0