Automated verification
The implementation must cover these cases:
- The local probe requires a TTY and masks pasted credential values.
- The local probe rejects secret arguments, environment values, and local environment files.
- The local probe rejects evidence paths inside the repository.
- The local probe creates mode-
0700 directories and mode-0600 files.
- The local probe removes temporary plaintext after confirmation, errors, and handled signals.
- Local report cleanup requires the exact path and SHA-256 hash.
- Local report cleanup rejects directories, symlinks, repository paths, and recursive removal.
- The inventory excludes all four MySQL system databases.
- The inventory returns a stable sorted list.
- A forged database selection is rejected.
- An empty selection is rejected.
- One selected database runs without unrelated database work.
- Multiple selected databases run sequentially.
- Each database uses a separate temporary directory.
- Drizzle runs without
--init.
- No Rackspace table or migration ledger changes.
- Exact DDL includes tables, views, triggers, routines, functions, and events.
- A failed database does not stop later selections.
- A failed database keeps its prior snapshot and registry entry.
- A failed new database does not enter the registry.
- An unselected database remains unchanged.
- The registry uses stable ordering and maps each safe name to the correct generated files.
- An unknown name fails before the runtime package opens a connection.
- A literal name gives the exact generated schema type.
- A runtime name gives a discriminated union that callers can narrow by name.
- Each Drizzle client uses the selected database and its matching relations.
- The connection verifier rejects a session without an active TLS cipher.
- The connection verifier rejects a
SELECT DATABASE() mismatch.
- Every generated table and view accepts its generated columns in a zero-row query.
- A zero-row query does not return application rows.
- A repeated database selection reuses its pool and Drizzle handle.
- The factory can close one selected pool and all pools.
- The runtime account can complete permitted data reads and writes.
- The runtime account cannot complete DDL or grant changes.
- The snapshot account cannot complete data writes, base-table reads, or table DDL.
- All registered generated schemas pass the package type check.
- Client-side code cannot import the server-only package.
- Candidate snapshot metadata produces the complete object and column list for zero-row queries.
- Candidate verification never loads or executes candidate TypeScript.
- A candidate verification failure occurs before encrypted artifact storage.
- A candidate verification failure keeps the prior merged package entry.
- The administrator verifier selects databases from the merged registry, not live inventory.
- An impersonated or non-administrator session cannot start deployed verification.
- Multiple administrator selections run sequentially and continue after one failure.
- A second administrator verification cannot start during an active verification or refresh.
- A deployed verification result contains stage statuses, object counts, timings, and safe errors.
- Production connection verification does not run data-write statements.
- No-change output does not create a pull request.
- Multiple changed databases enter one commit and one pull request.
- A second refresh cannot start while the first pull request remains open.
- The secret-pattern scan blocks a pull request that contains a match.
- Repeated starts reconcile one operation instead of starting duplicate workflows.
- Step retries do not duplicate Turso, Blob, hook, Git, or pull-request writes.
- An approval and expiry race produces one immutable decision.
- A private artifact download requires a fresh administrator session.
- A downloaded artifact has
no-store and content-type protection headers.
- Expiry blocks decisions and publication without removing the artifact.
- An expired artifact remains available to a fresh administrator.
- Persistent artifact and branch cleanup never starts automatically.
- Cleanup authorization is hashed, operation-scoped, single-use, and valid for five minutes.
- Cleanup rejects an active, unexpired review artifact.
- Cleanup rejects every non-terminal operation, including active publication.
- Blob cleanup keeps immutable metadata, decisions, and audit events.
- Orphan branch cleanup requires a terminal operation and an unchanged exact head.
- Branch cleanup uses an explicit force-with-lease expected commit.
- A changed branch head causes no deletion.
- The administrator page shows retained bytes, age, state, and cleanup eligibility.
- Artifact authentication fails after a ciphertext, manifest, or tag change.
- The current default root tree is the
base_tree for every publication.
- Unrelated default-branch files remain in the publication tree.
- A different existing branch hash stops publication without force.
- Manual lease clearing cannot remove a live or different operation.
- The application proxy excludes
/.well-known/workflow/.
- The package compiles and rejects every name with an empty registry.
- Fixture-module drift against fresh Drizzle Kit output fails the test suite.
- Secrets and raw connection errors do not enter logs or pull-request text.
Use local MySQL fixtures for database behavior. The fixtures must include two databases with
different schemas. They must also include foreign keys, views, triggers, procedures, functions,
and events.
Use @workflow/vitest for durable retries, hooks, expiry, and final status. Use mocked GitHub
responses for safe tree construction and publication reconciliation.
Deployment prerequisites
The status record is the source of current prerequisite evidence. Step 1 starts only
after every applicable hard gate is complete.
The gate requires:
- Static IP allowlist proof for both
iad1 addresses.
- Public-CA TLS with hostname validation.
- An exact server version and compatible metadata plan.
- Separate, proven snapshot and runtime accounts.
- Production Workflow and private Blob availability.
- No Blob lifecycle or schedule that removes review artifacts.
- A Connect installation restricted to
conveyal/concourse.
- A
main ruleset that requires one approval and CI / verify.
- Ruleset protection against force pushes and branch deletion.
- Disabled GitHub automatic head-branch deletion.
- An approved local evidence report and safe status index.
- An approved generated boundary at
packages/rsdb/generated/.
Deployment checks
The implementation is ready for its first production inventory only when all these checks pass:
- The local package integration suite passes with both database fixtures.
- Rackspace accepts traffic from the configured Vercel Static IP addresses.
- TLS hostname and certificate validation succeed.
- The snapshot account can read every required object type.
- The snapshot account cannot read base-table rows or change table data.
- The snapshot account grants match the documented minimum-grant table.
- The runtime account can complete the required data operations.
- The runtime account cannot change schema objects or grants.
- Vercel Connect returns an app token for the correct repository.
- The token can create Git blobs, trees, commits, branches, and pull requests.
- The deployed function bundle contains Drizzle Kit and remains within Vercel limits.
- The deployed application bundle keeps
@concourse/rsdb server-only and remains within Vercel
limits with all registered schemas.
- Candidate metadata verification fits within the database-step limits.
- One representative database fits within the function time, memory, and
/tmp limits.
- The deployed administrator action verifies one registered non-critical database.
- The deployed administrator action verifies a small sequential selection and reports one injected
failure without stopping later checks.
pnpm verify passes with the new generated-artifact boundary.
Final acceptance
The implementation is complete only when:
- Every Step 0 fact has current evidence.
main has the required active ruleset.- GitHub automatic head-branch deletion is disabled.
- Private Blob has no automatic review-artifact cleanup.
- Production uses separate snapshot and runtime accounts.
- Every connection uses normal TLS validation and Static IP egress.
- Inventory matches the authoritative database list.
- The runtime package passes local and CI MySQL tests.
- Every candidate passes generation, scan, and live verification.
- Every published DDL artifact receives human review.
- Workflow retries create no duplicate external writes.
- Every Git tree preserves unrelated default-branch files.
- One operation creates at most one branch, commit, and pull request.
- No workflow removes a persistent artifact or Git branch automatically.
- Manual cleanup preserves immutable application-database and audit records.
- Retained resources and missed cleanup targets are visible to administrators.
- Failed databases retain their prior snapshots.
- New failed databases remain unregistered.
- Deployed verification passes for all merged target databases.
- The full browser-to-Workflow-to-MySQL-to-review-to-GitHub path has recorded proof.
pnpm verify passes.