m/Assistant
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix: grant development gate owner access #174

Merged
m merged 1 commits from codex/wp-701-durable-development-gate into main 2026-08-23 00:49:00 +00:00
Conversation 0 Commits 1 Files Changed 2
+9 -3
2 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
database/migrations/038_work_development_gates_privileges.sql
+6
View File
@@ -0,0 +1,6 @@
BEGIN;
ALTER TABLE work.development_gates OWNER TO work_role;
GRANT SELECT, INSERT, UPDATE ON work.development_gates TO work_role;
COMMIT;
dev/tasks/DEV-000197-durable-development-gate.json
+3 -3
View File
@@ -6,7 +6,7 @@
"risk_tier": "E",
"intent": "Persist the governed self-development gate as a Work-owned revisioned state machine with optimistic concurrency, without executing code or granting promotion authority.",
"requirement_ids": ["WP-701", "durable governed self-development provenance", "CAS stage transitions"],
"allowed_change_scope": {"modules": ["work", "postgres persistence"], "paths": ["contracts/work/self_development.go", "modules/work/ports/development.go", "adapters/postgres/work_repository.go", "database/migrations/037_work_development_gates.sql", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000197-durable-development-gate.json"]},
"allowed_change_scope": {"modules": ["work", "postgres persistence"], "paths": ["contracts/work/self_development.go", "modules/work/ports/development.go", "adapters/postgres/work_repository.go", "database/migrations/037_work_development_gates.sql", "database/migrations/038_work_development_gates_privileges.sql", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000197-durable-development-gate.json"]},
"forbidden_change_scope": {"paths": ["architecture/**", "security/**", "deploy/**", "cmd/**", "modules/identity/**", "contracts/authority/**", ".gitea/**"]},
"allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 1},
"contracts": {"consume": ["existing DevelopmentGate state machine", "Work-owned persistence boundary"], "may_change": ["revision metadata on DevelopmentGate"]},
@@ -14,10 +14,10 @@
"canonical_state": ["work.development_gates"],
"state_transitions": ["persist initial evidence gate", "advance only through caller-validated stage with expected revision", "reject stale revision"],
"side_effects_and_privileges": ["database persistence only; no worktree, provider, source, deployment or promotion mutation"],
"persistence_and_migrations": ["037_work_development_gates.sql"],
"persistence_and_migrations": ["037_work_development_gates.sql", "038_work_development_gates_privileges.sql"],
"failure_retry_restart": ["CAS conflict is explicit and retry requires reloading the gate; restart reloads durable provenance"],
"assumptions": ["domain AdvanceDevelopmentGate remains the sole stage transition validator", "external bridge is a later independently operated capability"],
"acceptance_scenarios": ["initial gate persists at revision 1", "update with expected revision succeeds", "stale revision is rejected", "all provenance fields round-trip without secrets"],
"acceptance_scenarios": ["initial gate persists at revision 1", "update with expected revision succeeds", "stale revision is rejected", "all provenance fields round-trip without secrets", "work_role can read and write the table"],
"required_tests": ["go test ./...", "go vet ./...", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "go run ./cmd/devctl/independent -task dev/tasks/DEV-000197-durable-development-gate.json", "git diff --check", "CI", "production migration and health check"],
"terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "REQUIRES_MIGRATION_DECISION"]
}