feat(recovery): derive packaged PostgreSQL schema evidence

[seonghobae]

Bounded resilience slice for #204

Starts directly from protected main d0a4b30be1f46536e352443309f3a35533156767 on explicit non-default branch feat/postgres-schema-evidence-d0a4b30. Current exact contributor head is deb8b9a46672e74070f64397ba0b338161d82a61; the PR is Ready/mergeable, directly based on that protected main, and changes exactly:

• pg_llm_batch/postgres_schema_evidence.py
• tests/test_postgres_schema_evidence.py

Test-first history

• RED 4597c35b5aaa7b5a2a4488d1e926989779e9b0a0 defines the absent packaged-schema evidence contract.
• GREEN 424dc2bc9612f1aed59a95fe233c9930e80b1295 adds the narrow package-owned implementation.
• RED 1de1eb4194f4a09c0d5775823eb0b60bdfc25e10 plus GREEN 33fefc37ff21b6ba290b21e3f686178cd3626eb8 normalize ordinary resource-loader/read/cleanup failures while preserving process-control BaseException flow.
• RED dbc7d94a9c78ae656b0e4fd19b053d7d200d1c9c plus GREEN b35dee78e9ab52b2771ff18b5831b25cda7bf80d reject hostile bytes subclasses before truthiness, length accounting, or hashing.
• Exact-head SAST then reported the Python-3.7 importlib.resources compatibility rule. That rule is inapplicable because protected pyproject.toml requires Python >=3.10 and CI covers 3.10/3.12/3.14. Commit 8e587c7b5b8cfc52557f98df174623a2b245f0f2 uses one rule-specific nosemgrep suppression with that supported-runtime rationale immediately adjacent; the finding thread was answered and resolved without adding an unsupported-runtime backport dependency.
• A later work-budget audit found the stream could request a full chunk after only a smaller budget remained. RED 72b7cc9cf09d0a84cd3feda1fed40294b4f56cc3 requires every read request to remain within the remaining package budget. Current GREEN deb8b9a46672e74070f64397ba0b338161d82a61 caps each request and reaches final validation without an extra read after budget exhaustion.

Product / recovery boundary

inspect_postgres_schema() streams the exact distributed pg_llm_batch/schema.sql resource through SHA-256 with a finite 16 MiB package-owned work budget and returns only sha256 plus size_bytes. It rejects missing, unreadable, empty, oversized, malformed-chunk, hostile-subclass, or cleanup-failing resources and maps ordinary lower-layer failures to fixed content-free package diagnostics. Cleanup failure cannot mask an already-selected bounded read/validation error.

This gives #205's schema_sha256 field a deterministic package-owned derivation seam without caller paths, SQL execution, database mutation, credentials, DSNs, prompts/results, ciphertext, or reflected lower-layer diagnostics. It does not prove live-cluster schema parity, migration currency, isolated restore success, RLS/constraint/extension acceptance, PITR, RPO/RTO, HA/DR, or certification. #204 remains open.

No existing schema SQL, Docker, workflow, package metadata, root public API, provider/database client, or canonical documentation is modified. Canonical documentation remains owned by #192.

Current exact-head evidence

The current exact head has 31 published check runs. CodeQL, Scorecard, OSV, Trivy and other completed security contexts are successful; repository coverage/CI and organization review workflows are still queued or incomplete. No failure is currently published, but queued/pending/skipped-required/absent evidence is not acceptance. Predecessor checks and reviews do not transfer.

Protection-bound squash auto-merge is armed. Merge only the unchanged exact head after Python 3.10/3.12/3.14, exact 100% owned production statement/branch coverage, public docstrings, lint/package/container, security/SAST/SBOM/provenance/release and every organization-required workflow are terminal-success, all valid findings are resolved, authenticated formal review is current and successful, and the live qualifying independent non-author last-push approval exists.

The authenticated formal-review path is currently blocked in read-only central .github: protected central main remains c47afc2dc68488292c1db7c9d6f82dcd5360f181; central PR #1009 at 4b3cdb77599a3c67817bccf0e45a2058da52a122 contains the causal repository_dispatch.client_payload property-count repair but is still open/unmerged. Do not churn this source, copy the central workaround, weaken governance, self-approve, or transfer predecessor evidence.

Refs #204.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 46 minutes

Limit details: You’ve used all 1 included review currently available under your plan.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c057ca0a-ef3f-4251-84d1-51f43837ddbe

📥 Commits

Reviewing files that changed from the base of the PR and between d0a4b30 and deb8b9a.

📒 Files selected for processing (2)

• pg_llm_batch/postgres_schema_evidence.py
• tests/test_postgres_schema_evidence.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}