fix(cron): decommission unsafe direct SQL provider retrieval

[seonghobae]

RCA

Protected main historically shipped an every-minute pg_cron + pgsql-http provider retriever. That path bypasses the validated Python credential/destination/response boundary, can consume only the weaker database-visible secret form, and treats a local batch UUID as a remote provider identity without a reviewed binding. The bounded remedy is fail-closed retirement rather than maintaining a second provider client in PL/pgSQL.

Cleanup is identity-safe: it unschedules only the exact legacy job and drops each helper only after matching the retired pg_proc.prosrc plus reviewed language/volatility/invoker-security metadata. The cleanup transaction uses a finite lock timeout and catalog lock so same-signature operator replacements cannot race the proof/drop boundary. Historical gateway_retrieval_logs remain intact.

Test-first evidence

Earlier RED→GREEN cycles established fresh-install retirement, exact job/helper identity, substituted-helper refusal, existing-volume recovery, and the live PostgreSQL cleanup smoke. In particular, a realistic existing-volume regression caught and then corrected the historical get_secret_value(text) source fingerprint. Pre-#88 synthetic-merge workflow results remain development provenance only.

Current exact state

• Source head: 44f4c11cbb353eb6848cb2d7160ca9e743315923.
• Independently resolved protected main: 06f88be7f7c3a3ce5e756bc3bf03f298031a0286.
• The current head non-destructively merges that protected-main tip into prior source f5f9629184d881bdc16869402497a237a1a293f3.
• Integration preserved protected-main exact-source checkout/verification in every CI job while retaining this PR's dedicated PostgreSQL cleanup smoke and its workflow contract.
• GitHub reports mergeable; this PR is being promoted from Draft because exact-source governance fix(ci): bind verification to exact source heads #88 is now on protected main.
• Current-head CI 31543246176, SAST Semgrep 31543246275, and Security Scan 31543246303 are queued. Queued evidence is not acceptance.
• Formal reviews: none at the latest refetch. Unresolved inline review threads: zero.
• Live ruleset requires central workflows and review-thread resolution; current approving-review count is 0, code-owner review is disabled, and last-push approval is not required.

Integration boundary

This PR owns retirement/cleanup of the legacy SQL provider path only. Issue #102 owns future automatic reconciliation; Issue #103 owns later removal of now-cleanup-only pg_cron/http image compatibility. Do not fold either into this branch.

Merge only if this unchanged source head receives terminal success for every then-live repository/central CI, security, package/provenance and policy gate, remains mergeable against the then-live protected base, and has zero valid unresolved findings. No predecessor, synthetic, queued, pending, cancelled, skipped, absent, status-only, author-only, infrastructure-only, rate-limited, or failed evidence transfers.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 26 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 939840e0-6e88-4dbb-b973-bbe118723bea

📥 Commits

Reviewing files that changed from the base of the PR and between 06f88be and 44f4c11.

📒 Files selected for processing (8)

• .github/workflows/ci.yml
• docker/postgres/init/01_extensions.sql
• docker/postgres/init/03_cron_batch_retrieval.sql
• docs/doctoring/legacy-pgsql-http-retrieval.md
• tests/smoke_legacy_sql_cleanup.sh
• tests/test_fresh_extension_boundary.py
• tests/test_legacy_sql_retrieval_boundary.py
• tests/test_workflow_contracts.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.