diff --git a/docker/catalog/database-topology/judge.yaml b/docker/catalog/database-topology/judge.yaml index dc65e3c28e..c2e984f592 100644 --- a/docker/catalog/database-topology/judge.yaml +++ b/docker/catalog/database-topology/judge.yaml @@ -70,19 +70,15 @@ databases: schema: omninode_internal - object_type: TABLE objects: - - agent_routing_decisions - baselines_breakdown - baselines_comparisons - baselines_quality_snapshots - baselines_roi_snapshots - baselines_snapshots - baselines_trend - - capability_scores - capsule_store - - context_roi_scores - contract_registry - cost_by_repo_snapshots - - dep_health_findings - deployment_evidence_projection - deployment_readiness_projection - event_chain @@ -92,11 +88,9 @@ databases: - gate_activity - gate_metrics - generation_events - - instruction_eval_aggregate_snapshots - intent_classification_events - live_events - llm_call_metrics - - llm_cost_aggregates - llm_delegation_daily_projection - llm_routing_decisions - mcp_tools @@ -106,7 +100,6 @@ databases: - node_service_registry - overnight_session_phases - overnight_sessions - - pattern_learning_artifacts - pr_lifecycle_ledger_entries - pr_merged_events - receipt_gate_rows @@ -114,7 +107,6 @@ databases: - sandbox_decisions - session_outcomes - session_replay_snapshots - - skill_execution_snapshots - swarm_runs - traces - voice_sessions @@ -123,6 +115,12 @@ databases: - SELECT - UPDATE schema: omninode_internal + - object_type: TABLE + objects: + - nightly_loop_configs + privileges: + - SELECT + schema: omninode_internal login: true onex_api: bypass_rls: false @@ -163,11 +161,20 @@ databases: schema: public - object_type: TABLE objects: + - agent_routing_decisions + - capability_scores + - context_roi_scores - delegation_budget_state - delegation_events + - delegation_judge_verdict_events - delegation_shadow_comparisons + - dep_health_findings + - instruction_eval_aggregate_snapshots + - llm_cost_aggregates + - pattern_learning_artifacts - projection_delegation_inference_response_text - savings_estimates + - skill_execution_snapshots privileges: - INSERT - SELECT @@ -241,5 +248,5 @@ source: profile_catalog_path: src/omnibase_infra/topology/application_database_profiles.yaml profile_catalog_sha256: 759f32da77ad41b874fbb05d2824c44f9de4c64e9d269d99da21445225a90ca1 repository: OmniNode-ai/omnibase_infra - sha256: ed129fcd59c186a05acbc6926ba68d3a4905976898949a4ce09027427087a52d + sha256: d4fb2428f289a417ee7a385fa73f08f10de3c141270f44c2d237c18558b9f227 topology_instance: local diff --git a/docker/catalog/database-topology/local.yaml b/docker/catalog/database-topology/local.yaml index a98581bca7..637b5d5875 100644 --- a/docker/catalog/database-topology/local.yaml +++ b/docker/catalog/database-topology/local.yaml @@ -70,19 +70,15 @@ databases: schema: omninode_internal - object_type: TABLE objects: - - agent_routing_decisions - baselines_breakdown - baselines_comparisons - baselines_quality_snapshots - baselines_roi_snapshots - baselines_snapshots - baselines_trend - - capability_scores - capsule_store - - context_roi_scores - contract_registry - cost_by_repo_snapshots - - dep_health_findings - deployment_evidence_projection - deployment_readiness_projection - event_chain @@ -92,11 +88,9 @@ databases: - gate_activity - gate_metrics - generation_events - - instruction_eval_aggregate_snapshots - intent_classification_events - live_events - llm_call_metrics - - llm_cost_aggregates - llm_delegation_daily_projection - llm_routing_decisions - mcp_tools @@ -106,7 +100,6 @@ databases: - node_service_registry - overnight_session_phases - overnight_sessions - - pattern_learning_artifacts - pr_lifecycle_ledger_entries - pr_merged_events - receipt_gate_rows @@ -114,7 +107,6 @@ databases: - sandbox_decisions - session_outcomes - session_replay_snapshots - - skill_execution_snapshots - swarm_runs - traces - voice_sessions @@ -123,6 +115,12 @@ databases: - SELECT - UPDATE schema: omninode_internal + - object_type: TABLE + objects: + - nightly_loop_configs + privileges: + - SELECT + schema: omninode_internal login: true onex_api: bypass_rls: false @@ -163,11 +161,20 @@ databases: schema: public - object_type: TABLE objects: + - agent_routing_decisions + - capability_scores + - context_roi_scores - delegation_budget_state - delegation_events + - delegation_judge_verdict_events - delegation_shadow_comparisons + - dep_health_findings + - instruction_eval_aggregate_snapshots + - llm_cost_aggregates + - pattern_learning_artifacts - projection_delegation_inference_response_text - savings_estimates + - skill_execution_snapshots privileges: - INSERT - SELECT @@ -241,5 +248,5 @@ source: profile_catalog_path: src/omnibase_infra/topology/application_database_profiles.yaml profile_catalog_sha256: 759f32da77ad41b874fbb05d2824c44f9de4c64e9d269d99da21445225a90ca1 repository: OmniNode-ai/omnibase_infra - sha256: ed129fcd59c186a05acbc6926ba68d3a4905976898949a4ce09027427087a52d + sha256: d4fb2428f289a417ee7a385fa73f08f10de3c141270f44c2d237c18558b9f227 topology_instance: local diff --git a/docker/catalog/database-topology/onex-dev.yaml b/docker/catalog/database-topology/onex-dev.yaml index ccc12da8dd..9048bbe6ad 100644 --- a/docker/catalog/database-topology/onex-dev.yaml +++ b/docker/catalog/database-topology/onex-dev.yaml @@ -70,19 +70,15 @@ databases: schema: omninode_internal - object_type: TABLE objects: - - agent_routing_decisions - baselines_breakdown - baselines_comparisons - baselines_quality_snapshots - baselines_roi_snapshots - baselines_snapshots - baselines_trend - - capability_scores - capsule_store - - context_roi_scores - contract_registry - cost_by_repo_snapshots - - dep_health_findings - deployment_evidence_projection - deployment_readiness_projection - event_chain @@ -92,11 +88,9 @@ databases: - gate_activity - gate_metrics - generation_events - - instruction_eval_aggregate_snapshots - intent_classification_events - live_events - llm_call_metrics - - llm_cost_aggregates - llm_delegation_daily_projection - llm_routing_decisions - mcp_tools @@ -106,7 +100,6 @@ databases: - node_service_registry - overnight_session_phases - overnight_sessions - - pattern_learning_artifacts - pr_lifecycle_ledger_entries - pr_merged_events - receipt_gate_rows @@ -114,7 +107,6 @@ databases: - sandbox_decisions - session_outcomes - session_replay_snapshots - - skill_execution_snapshots - swarm_runs - traces - voice_sessions @@ -123,6 +115,12 @@ databases: - SELECT - UPDATE schema: omninode_internal + - object_type: TABLE + objects: + - nightly_loop_configs + privileges: + - SELECT + schema: omninode_internal login: true onex_api: bypass_rls: false @@ -163,11 +161,20 @@ databases: schema: public - object_type: TABLE objects: + - agent_routing_decisions + - capability_scores + - context_roi_scores - delegation_budget_state - delegation_events + - delegation_judge_verdict_events - delegation_shadow_comparisons + - dep_health_findings + - instruction_eval_aggregate_snapshots + - llm_cost_aggregates + - pattern_learning_artifacts - projection_delegation_inference_response_text - savings_estimates + - skill_execution_snapshots privileges: - INSERT - SELECT @@ -241,5 +248,5 @@ source: profile_catalog_path: src/omnibase_infra/topology/application_database_profiles.yaml profile_catalog_sha256: 759f32da77ad41b874fbb05d2824c44f9de4c64e9d269d99da21445225a90ca1 repository: OmniNode-ai/omnibase_infra - sha256: 7a508e9eb789b3b184edd13e639bd3aae235357aaf05c0ad085cf3f6a2ed9238 + sha256: dc8e45c263f61aa34290ca13ea2b87b9041383335a1d0635acc49ff6128e9e08 topology_instance: onex-dev diff --git a/docker/catalog/database-topology/onex-prod.yaml b/docker/catalog/database-topology/onex-prod.yaml index 9db9ddfd1b..610fa434ef 100644 --- a/docker/catalog/database-topology/onex-prod.yaml +++ b/docker/catalog/database-topology/onex-prod.yaml @@ -70,19 +70,15 @@ databases: schema: omninode_internal - object_type: TABLE objects: - - agent_routing_decisions - baselines_breakdown - baselines_comparisons - baselines_quality_snapshots - baselines_roi_snapshots - baselines_snapshots - baselines_trend - - capability_scores - capsule_store - - context_roi_scores - contract_registry - cost_by_repo_snapshots - - dep_health_findings - deployment_evidence_projection - deployment_readiness_projection - event_chain @@ -92,11 +88,9 @@ databases: - gate_activity - gate_metrics - generation_events - - instruction_eval_aggregate_snapshots - intent_classification_events - live_events - llm_call_metrics - - llm_cost_aggregates - llm_delegation_daily_projection - llm_routing_decisions - mcp_tools @@ -106,7 +100,6 @@ databases: - node_service_registry - overnight_session_phases - overnight_sessions - - pattern_learning_artifacts - pr_lifecycle_ledger_entries - pr_merged_events - receipt_gate_rows @@ -114,7 +107,6 @@ databases: - sandbox_decisions - session_outcomes - session_replay_snapshots - - skill_execution_snapshots - swarm_runs - traces - voice_sessions @@ -123,6 +115,12 @@ databases: - SELECT - UPDATE schema: omninode_internal + - object_type: TABLE + objects: + - nightly_loop_configs + privileges: + - SELECT + schema: omninode_internal login: true onex_api: bypass_rls: false @@ -163,11 +161,20 @@ databases: schema: public - object_type: TABLE objects: + - agent_routing_decisions + - capability_scores + - context_roi_scores - delegation_budget_state - delegation_events + - delegation_judge_verdict_events - delegation_shadow_comparisons + - dep_health_findings + - instruction_eval_aggregate_snapshots + - llm_cost_aggregates + - pattern_learning_artifacts - projection_delegation_inference_response_text - savings_estimates + - skill_execution_snapshots privileges: - INSERT - SELECT @@ -241,5 +248,5 @@ source: profile_catalog_path: src/omnibase_infra/topology/application_database_profiles.yaml profile_catalog_sha256: 759f32da77ad41b874fbb05d2824c44f9de4c64e9d269d99da21445225a90ca1 repository: OmniNode-ai/omnibase_infra - sha256: 7a508e9eb789b3b184edd13e639bd3aae235357aaf05c0ad085cf3f6a2ed9238 + sha256: dc8e45c263f61aa34290ca13ea2b87b9041383335a1d0635acc49ff6128e9e08 topology_instance: onex-prod diff --git a/docker/catalog/database-topology/prod.yaml b/docker/catalog/database-topology/prod.yaml index bb3ff0c2d3..81551d589f 100644 --- a/docker/catalog/database-topology/prod.yaml +++ b/docker/catalog/database-topology/prod.yaml @@ -70,19 +70,15 @@ databases: schema: omninode_internal - object_type: TABLE objects: - - agent_routing_decisions - baselines_breakdown - baselines_comparisons - baselines_quality_snapshots - baselines_roi_snapshots - baselines_snapshots - baselines_trend - - capability_scores - capsule_store - - context_roi_scores - contract_registry - cost_by_repo_snapshots - - dep_health_findings - deployment_evidence_projection - deployment_readiness_projection - event_chain @@ -92,11 +88,9 @@ databases: - gate_activity - gate_metrics - generation_events - - instruction_eval_aggregate_snapshots - intent_classification_events - live_events - llm_call_metrics - - llm_cost_aggregates - llm_delegation_daily_projection - llm_routing_decisions - mcp_tools @@ -106,7 +100,6 @@ databases: - node_service_registry - overnight_session_phases - overnight_sessions - - pattern_learning_artifacts - pr_lifecycle_ledger_entries - pr_merged_events - receipt_gate_rows @@ -114,7 +107,6 @@ databases: - sandbox_decisions - session_outcomes - session_replay_snapshots - - skill_execution_snapshots - swarm_runs - traces - voice_sessions @@ -123,6 +115,12 @@ databases: - SELECT - UPDATE schema: omninode_internal + - object_type: TABLE + objects: + - nightly_loop_configs + privileges: + - SELECT + schema: omninode_internal login: true onex_api: bypass_rls: false @@ -163,11 +161,20 @@ databases: schema: public - object_type: TABLE objects: + - agent_routing_decisions + - capability_scores + - context_roi_scores - delegation_budget_state - delegation_events + - delegation_judge_verdict_events - delegation_shadow_comparisons + - dep_health_findings + - instruction_eval_aggregate_snapshots + - llm_cost_aggregates + - pattern_learning_artifacts - projection_delegation_inference_response_text - savings_estimates + - skill_execution_snapshots privileges: - INSERT - SELECT @@ -241,5 +248,5 @@ source: profile_catalog_path: src/omnibase_infra/topology/application_database_profiles.yaml profile_catalog_sha256: 759f32da77ad41b874fbb05d2824c44f9de4c64e9d269d99da21445225a90ca1 repository: OmniNode-ai/omnibase_infra - sha256: ed129fcd59c186a05acbc6926ba68d3a4905976898949a4ce09027427087a52d + sha256: d4fb2428f289a417ee7a385fa73f08f10de3c141270f44c2d237c18558b9f227 topology_instance: local diff --git a/docker/catalog/database-topology/stability-test.yaml b/docker/catalog/database-topology/stability-test.yaml index f7b04dc04c..0795cb63ab 100644 --- a/docker/catalog/database-topology/stability-test.yaml +++ b/docker/catalog/database-topology/stability-test.yaml @@ -70,19 +70,15 @@ databases: schema: omninode_internal - object_type: TABLE objects: - - agent_routing_decisions - baselines_breakdown - baselines_comparisons - baselines_quality_snapshots - baselines_roi_snapshots - baselines_snapshots - baselines_trend - - capability_scores - capsule_store - - context_roi_scores - contract_registry - cost_by_repo_snapshots - - dep_health_findings - deployment_evidence_projection - deployment_readiness_projection - event_chain @@ -92,11 +88,9 @@ databases: - gate_activity - gate_metrics - generation_events - - instruction_eval_aggregate_snapshots - intent_classification_events - live_events - llm_call_metrics - - llm_cost_aggregates - llm_delegation_daily_projection - llm_routing_decisions - mcp_tools @@ -106,7 +100,6 @@ databases: - node_service_registry - overnight_session_phases - overnight_sessions - - pattern_learning_artifacts - pr_lifecycle_ledger_entries - pr_merged_events - receipt_gate_rows @@ -114,7 +107,6 @@ databases: - sandbox_decisions - session_outcomes - session_replay_snapshots - - skill_execution_snapshots - swarm_runs - traces - voice_sessions @@ -123,6 +115,12 @@ databases: - SELECT - UPDATE schema: omninode_internal + - object_type: TABLE + objects: + - nightly_loop_configs + privileges: + - SELECT + schema: omninode_internal login: true onex_api: bypass_rls: false @@ -163,11 +161,20 @@ databases: schema: public - object_type: TABLE objects: + - agent_routing_decisions + - capability_scores + - context_roi_scores - delegation_budget_state - delegation_events + - delegation_judge_verdict_events - delegation_shadow_comparisons + - dep_health_findings + - instruction_eval_aggregate_snapshots + - llm_cost_aggregates + - pattern_learning_artifacts - projection_delegation_inference_response_text - savings_estimates + - skill_execution_snapshots privileges: - INSERT - SELECT @@ -241,5 +248,5 @@ source: profile_catalog_path: src/omnibase_infra/topology/application_database_profiles.yaml profile_catalog_sha256: 759f32da77ad41b874fbb05d2824c44f9de4c64e9d269d99da21445225a90ca1 repository: OmniNode-ai/omnibase_infra - sha256: ed129fcd59c186a05acbc6926ba68d3a4905976898949a4ce09027427087a52d + sha256: d4fb2428f289a417ee7a385fa73f08f10de3c141270f44c2d237c18558b9f227 topology_instance: local diff --git a/docker/catalog/database-topology/test.yaml b/docker/catalog/database-topology/test.yaml index 2a5afbc5a1..4f2dac85d7 100644 --- a/docker/catalog/database-topology/test.yaml +++ b/docker/catalog/database-topology/test.yaml @@ -70,19 +70,15 @@ databases: schema: omninode_internal - object_type: TABLE objects: - - agent_routing_decisions - baselines_breakdown - baselines_comparisons - baselines_quality_snapshots - baselines_roi_snapshots - baselines_snapshots - baselines_trend - - capability_scores - capsule_store - - context_roi_scores - contract_registry - cost_by_repo_snapshots - - dep_health_findings - deployment_evidence_projection - deployment_readiness_projection - event_chain @@ -92,11 +88,9 @@ databases: - gate_activity - gate_metrics - generation_events - - instruction_eval_aggregate_snapshots - intent_classification_events - live_events - llm_call_metrics - - llm_cost_aggregates - llm_delegation_daily_projection - llm_routing_decisions - mcp_tools @@ -106,7 +100,6 @@ databases: - node_service_registry - overnight_session_phases - overnight_sessions - - pattern_learning_artifacts - pr_lifecycle_ledger_entries - pr_merged_events - receipt_gate_rows @@ -114,7 +107,6 @@ databases: - sandbox_decisions - session_outcomes - session_replay_snapshots - - skill_execution_snapshots - swarm_runs - traces - voice_sessions @@ -123,6 +115,12 @@ databases: - SELECT - UPDATE schema: omninode_internal + - object_type: TABLE + objects: + - nightly_loop_configs + privileges: + - SELECT + schema: omninode_internal login: true onex_api: bypass_rls: false @@ -163,11 +161,20 @@ databases: schema: public - object_type: TABLE objects: + - agent_routing_decisions + - capability_scores + - context_roi_scores - delegation_budget_state - delegation_events + - delegation_judge_verdict_events - delegation_shadow_comparisons + - dep_health_findings + - instruction_eval_aggregate_snapshots + - llm_cost_aggregates + - pattern_learning_artifacts - projection_delegation_inference_response_text - savings_estimates + - skill_execution_snapshots privileges: - INSERT - SELECT @@ -241,5 +248,5 @@ source: profile_catalog_path: src/omnibase_infra/topology/application_database_profiles.yaml profile_catalog_sha256: 759f32da77ad41b874fbb05d2824c44f9de4c64e9d269d99da21445225a90ca1 repository: OmniNode-ai/omnibase_infra - sha256: ed129fcd59c186a05acbc6926ba68d3a4905976898949a4ce09027427087a52d + sha256: d4fb2428f289a417ee7a385fa73f08f10de3c141270f44c2d237c18558b9f227 topology_instance: local diff --git a/src/omnibase_infra/topology/instances/local.yaml b/src/omnibase_infra/topology/instances/local.yaml index ba0a2d1786..e6694a556b 100644 --- a/src/omnibase_infra/topology/instances/local.yaml +++ b/src/omnibase_infra/topology/instances/local.yaml @@ -61,19 +61,15 @@ databases: schema: omninode_internal - object_type: TABLE objects: - - agent_routing_decisions - baselines_breakdown - baselines_comparisons - baselines_quality_snapshots - baselines_roi_snapshots - baselines_snapshots - baselines_trend - - capability_scores - capsule_store - - context_roi_scores - contract_registry - cost_by_repo_snapshots - - dep_health_findings - deployment_evidence_projection - deployment_readiness_projection - event_chain @@ -83,11 +79,9 @@ databases: - gate_activity - gate_metrics - generation_events - - instruction_eval_aggregate_snapshots - intent_classification_events - live_events - llm_call_metrics - - llm_cost_aggregates - llm_delegation_daily_projection - llm_routing_decisions - mcp_tools @@ -97,7 +91,6 @@ databases: - node_service_registry - overnight_session_phases - overnight_sessions - - pattern_learning_artifacts - pr_lifecycle_ledger_entries - pr_merged_events - receipt_gate_rows @@ -105,12 +98,16 @@ databases: - sandbox_decisions - session_outcomes - session_replay_snapshots - - skill_execution_snapshots - swarm_runs - traces - voice_sessions privileges: [INSERT, SELECT, UPDATE] schema: omninode_internal + - object_type: TABLE + objects: + - nightly_loop_configs + privileges: [SELECT] + schema: omninode_internal login: true onex_api: bypass_rls: false @@ -137,11 +134,20 @@ databases: schema: public - object_type: TABLE objects: + - agent_routing_decisions + - capability_scores + - context_roi_scores - delegation_budget_state - delegation_events + - delegation_judge_verdict_events - delegation_shadow_comparisons + - dep_health_findings + - instruction_eval_aggregate_snapshots + - llm_cost_aggregates + - pattern_learning_artifacts - projection_delegation_inference_response_text - savings_estimates + - skill_execution_snapshots privileges: [INSERT, SELECT, UPDATE] schema: public login: true diff --git a/src/omnibase_infra/topology/instances/onex-dev.yaml b/src/omnibase_infra/topology/instances/onex-dev.yaml index cb46f4e300..cdbd11cc7c 100644 --- a/src/omnibase_infra/topology/instances/onex-dev.yaml +++ b/src/omnibase_infra/topology/instances/onex-dev.yaml @@ -61,19 +61,15 @@ databases: schema: omninode_internal - object_type: TABLE objects: - - agent_routing_decisions - baselines_breakdown - baselines_comparisons - baselines_quality_snapshots - baselines_roi_snapshots - baselines_snapshots - baselines_trend - - capability_scores - capsule_store - - context_roi_scores - contract_registry - cost_by_repo_snapshots - - dep_health_findings - deployment_evidence_projection - deployment_readiness_projection - event_chain @@ -83,11 +79,9 @@ databases: - gate_activity - gate_metrics - generation_events - - instruction_eval_aggregate_snapshots - intent_classification_events - live_events - llm_call_metrics - - llm_cost_aggregates - llm_delegation_daily_projection - llm_routing_decisions - mcp_tools @@ -97,7 +91,6 @@ databases: - node_service_registry - overnight_session_phases - overnight_sessions - - pattern_learning_artifacts - pr_lifecycle_ledger_entries - pr_merged_events - receipt_gate_rows @@ -105,12 +98,16 @@ databases: - sandbox_decisions - session_outcomes - session_replay_snapshots - - skill_execution_snapshots - swarm_runs - traces - voice_sessions privileges: [INSERT, SELECT, UPDATE] schema: omninode_internal + - object_type: TABLE + objects: + - nightly_loop_configs + privileges: [SELECT] + schema: omninode_internal login: true onex_api: bypass_rls: false @@ -137,11 +134,20 @@ databases: schema: public - object_type: TABLE objects: + - agent_routing_decisions + - capability_scores + - context_roi_scores - delegation_budget_state - delegation_events + - delegation_judge_verdict_events - delegation_shadow_comparisons + - dep_health_findings + - instruction_eval_aggregate_snapshots + - llm_cost_aggregates + - pattern_learning_artifacts - projection_delegation_inference_response_text - savings_estimates + - skill_execution_snapshots privileges: [INSERT, SELECT, UPDATE] schema: public login: true diff --git a/src/omnibase_infra/topology/instances/onex-prod.yaml b/src/omnibase_infra/topology/instances/onex-prod.yaml index cb46f4e300..cdbd11cc7c 100644 --- a/src/omnibase_infra/topology/instances/onex-prod.yaml +++ b/src/omnibase_infra/topology/instances/onex-prod.yaml @@ -61,19 +61,15 @@ databases: schema: omninode_internal - object_type: TABLE objects: - - agent_routing_decisions - baselines_breakdown - baselines_comparisons - baselines_quality_snapshots - baselines_roi_snapshots - baselines_snapshots - baselines_trend - - capability_scores - capsule_store - - context_roi_scores - contract_registry - cost_by_repo_snapshots - - dep_health_findings - deployment_evidence_projection - deployment_readiness_projection - event_chain @@ -83,11 +79,9 @@ databases: - gate_activity - gate_metrics - generation_events - - instruction_eval_aggregate_snapshots - intent_classification_events - live_events - llm_call_metrics - - llm_cost_aggregates - llm_delegation_daily_projection - llm_routing_decisions - mcp_tools @@ -97,7 +91,6 @@ databases: - node_service_registry - overnight_session_phases - overnight_sessions - - pattern_learning_artifacts - pr_lifecycle_ledger_entries - pr_merged_events - receipt_gate_rows @@ -105,12 +98,16 @@ databases: - sandbox_decisions - session_outcomes - session_replay_snapshots - - skill_execution_snapshots - swarm_runs - traces - voice_sessions privileges: [INSERT, SELECT, UPDATE] schema: omninode_internal + - object_type: TABLE + objects: + - nightly_loop_configs + privileges: [SELECT] + schema: omninode_internal login: true onex_api: bypass_rls: false @@ -137,11 +134,20 @@ databases: schema: public - object_type: TABLE objects: + - agent_routing_decisions + - capability_scores + - context_roi_scores - delegation_budget_state - delegation_events + - delegation_judge_verdict_events - delegation_shadow_comparisons + - dep_health_findings + - instruction_eval_aggregate_snapshots + - llm_cost_aggregates + - pattern_learning_artifacts - projection_delegation_inference_response_text - savings_estimates + - skill_execution_snapshots privileges: [INSERT, SELECT, UPDATE] schema: public login: true diff --git a/tests/fixtures/omn15701/onex-dev-topology-reverted-tenant-grants.yaml.captured b/tests/fixtures/omn15701/onex-dev-topology-reverted-tenant-grants.yaml.captured new file mode 100644 index 0000000000..cb46f4e300 --- /dev/null +++ b/tests/fixtures/omn15701/onex-dev-topology-reverted-tenant-grants.yaml.captured @@ -0,0 +1,215 @@ +# SPDX-FileCopyrightText: 2025 OmniNode.ai Inc. +# SPDX-License-Identifier: MIT +active_preset: application-cloud +databases: + application: + bindings: + app_dashboard: + database_ref: application + dsn_env: DATABASE_URL + principal: app_dashboard + omninode_runtime_service: + database_ref: application + dsn_env: OMNINODE_INTERNAL_DB_URL + principal: omninode_runtime + onex_api: + database_ref: application + dsn_env: OMNINODE_CLOUD_DB_URL + principal: onex_api + tenant_projection: + database_ref: application + dsn_env: OMNIDASH_ANALYTICS_DB_URL + principal: tenant_projection_writer + checksum_ledger: canonical + checksum_ledgers: + canonical: + checksum_column: checksum + domain_column: domain + relation: schema_migrations + schema: platform_catalog + stream_column: migration_stream + version_column: version + migration_stream: omnibase_infra.application + owners: + owner_omninode_internal: + login: false + owner_onex_tenant: + login: false + owner_platform_catalog: + login: false + physical_name: omnidash_analytics + principals: + app_dashboard: + bypass_rls: false + grants: + - object_type: DATABASE + privileges: [CONNECT] + - object_type: SCHEMA + privileges: [USAGE] + schema: tenant + - object_type: SCHEMA + privileges: [USAGE] + schema: platform_catalog + login: true + omninode_runtime: + bypass_rls: false + grants: + - object_type: DATABASE + privileges: [CONNECT] + - object_type: SCHEMA + privileges: [USAGE] + schema: omninode_internal + - object_type: TABLE + objects: + - agent_routing_decisions + - baselines_breakdown + - baselines_comparisons + - baselines_quality_snapshots + - baselines_roi_snapshots + - baselines_snapshots + - baselines_trend + - capability_scores + - capsule_store + - context_roi_scores + - contract_registry + - cost_by_repo_snapshots + - dep_health_findings + - deployment_evidence_projection + - deployment_readiness_projection + - event_chain + - evidence_correlation_trace_projection + - evidence_dashboard_projection + - evidence_readiness_aggregate_projection + - gate_activity + - gate_metrics + - generation_events + - instruction_eval_aggregate_snapshots + - intent_classification_events + - live_events + - llm_call_metrics + - llm_cost_aggregates + - llm_delegation_daily_projection + - llm_routing_decisions + - mcp_tools + - merge_state_transitions + - nightly_loop_decisions + - nightly_loop_iterations + - node_service_registry + - overnight_session_phases + - overnight_sessions + - pattern_learning_artifacts + - pr_lifecycle_ledger_entries + - pr_merged_events + - receipt_gate_rows + - renderer_capability_projection + - sandbox_decisions + - session_outcomes + - session_replay_snapshots + - skill_execution_snapshots + - swarm_runs + - traces + - voice_sessions + privileges: [INSERT, SELECT, UPDATE] + schema: omninode_internal + login: true + onex_api: + bypass_rls: false + grants: + - object_type: DATABASE + privileges: [CONNECT] + - object_type: SCHEMA + privileges: [USAGE] + schema: tenant + - object_type: SCHEMA + privileges: [USAGE] + schema: platform_catalog + login: true + tenant_projection_writer: + bypass_rls: false + grants: + - object_type: DATABASE + privileges: [CONNECT] + - object_type: SCHEMA + privileges: [USAGE] + schema: tenant + - object_type: SCHEMA + privileges: [USAGE] + schema: public + - object_type: TABLE + objects: + - delegation_budget_state + - delegation_events + - delegation_shadow_comparisons + - projection_delegation_inference_response_text + - savings_estimates + privileges: [INSERT, SELECT, UPDATE] + schema: public + login: true + schemas: + omninode_internal: + domain: OMNINODE_INTERNAL + owner: owner_omninode_internal + platform_catalog: + domain: PLATFORM_CATALOG + owner: owner_platform_catalog + public: + domain: TENANT + owner: owner_onex_tenant + tenant: + domain: TENANT + owner: owner_onex_tenant + omniintelligence: + bindings: + omninode_runtime_service: + database_ref: omniintelligence + dsn_env: OMNIINTELLIGENCE_DB_URL + principal: role_omniintelligence + checksum_ledger: service_owned + checksum_ledgers: + service_owned: + checksum_column: checksum + domain_column: domain + relation: schema_migrations + schema: public + stream_column: migration_stream + version_column: version + migration_stream: omniintelligence.service + owners: + owner_omniintelligence: + login: false + physical_name: omniintelligence + principals: + role_omniintelligence: + bypass_rls: false + grants: + - object_type: DATABASE + privileges: [CONNECT] + - object_type: SCHEMA + privileges: [USAGE] + schema: public + - object_type: TABLE + objects: + - dispatch_eval_results + privileges: [INSERT, SELECT, UPDATE] + schema: public + login: true + schemas: + public: + domain: OMNINODE_INTERNAL + owner: owner_omniintelligence +presets: + application-cloud: + - postgres + - onex_api + - omnidash + - omninode_runtime +schema_version: "2.0" +services: + omnidash: + mode: CLOUD + omninode_runtime: + mode: CLOUD + onex_api: + mode: CLOUD + postgres: + mode: CLOUD diff --git a/tests/unit/topology/test_application_database_table_grants.py b/tests/unit/topology/test_application_database_table_grants.py index 2f880231e5..a37c35825e 100644 --- a/tests/unit/topology/test_application_database_table_grants.py +++ b/tests/unit/topology/test_application_database_table_grants.py @@ -541,3 +541,170 @@ def test_replay_shipped_topology_now_accepts_the_deploy_relation() -> None: _resolve_projection_database_target( (_DEPLOY_RELATION,), load_topology_profile(profile) ) + + +# --------------------------------------------------------------------------- +# Incident replay (OMN-15701 registry): onex-dev CrashLoopBackOff on +# 2026-08-04, deployed digest sha256:5507667152e2 (infra dev 2e5ef7da) +# --------------------------------------------------------------------------- +# +# infra#2634 (merged 2026-08-03T05:05:30Z) correctly derived +# ``tenant_projection_writer`` TABLE grants for all nine house-tenant +# relations. infra#2632 (merged 2026-08-03T18:06:11Z, an ancestor of the +# deployed SHA) then re-ran the derivation's ``--write`` step against the CI +# workflow's hardcoded omnimarket fallback pin +# (``4637e625c99ef17c190aa471a5e51b7f646c6dfd``, 2026-07-30) instead of +# omnimarket's actual dev HEAD, and that pin still declared +# ``schema: omninode_internal`` for these relations (omnimarket's +# reclassification, commit 485be549, landed on omnimarket dev at +# 2026-08-03T15:56:54Z -- *after* #2632 merged). The regeneration silently +# reverted eight of the nine relations back to ``omninode_runtime`` / +# ``omninode_internal``, so every contract that declares one of them +# (``schema: tenant``, per the operator ruling recorded on OMN-15655) failed +# ``_require_projection_binding_privileges`` on every profile. +# +# ``onex-dev-topology-reverted-tenant-grants.yaml.captured`` is byte-identical +# to the shipped ``instances/onex-dev.yaml`` at infra dev commit +# ``2e5ef7da5d08df9f1bcbe7eff58eed696c14d1e4`` -- the exact bytes the +# CrashLoopBackOff pods loaded, not a reconstruction. + +_REVERTED_GRANTS_CAPTURE = ( + Path(__file__).parents[2] + / "fixtures" + / "omn15701" + / "onex-dev-topology-reverted-tenant-grants.yaml.captured" +) + +# Verbatim from the omninode-runtime pod's Auto-wiring failure on the +# CrashLoopBackOff observed 2026-08-04 (one of eight identically-shaped +# failures; capability_scores chosen as the exemplar). +_REVERTED_GRANT_ERROR = ( + "Projection binding 'tenant_projection' principal 'tenant_projection_writer' " + "lacks declared write privileges: INSERT, SELECT, UPDATE on table " + "tenant.capability_scores" +) + +_REVERTED_GRANT_RELATION = ModelDbTableDeclaration( + name="capability_scores", + database_ref="application", + schema="tenant", + migration="0002_capability_scores_tenant_id_and_rls.sql", + access="write", + role="capability_scores", +) + +# All eight relations infra#2632 reverted (the ninth, +# delegation_judge_verdict_events, was dropped from both grant lists entirely +# rather than merely moved, so it fails with a different message and is +# checked separately below). +_REVERTED_GRANT_RELATIONS = ( + _REVERTED_GRANT_RELATION, + ModelDbTableDeclaration( + name="context_roi_scores", + database_ref="application", + schema="tenant", + migration="003_context_roi_scores_tenant_id_and_rls.sql", + access="write", + role="scores", + ), + ModelDbTableDeclaration( + name="llm_cost_aggregates", + database_ref="application", + schema="tenant", + migration="0002_llm_cost_aggregates_tenant_id_and_rls.sql", + access="write", + role="cost_summary", + ), + ModelDbTableDeclaration( + name="dep_health_findings", + database_ref="application", + schema="tenant", + migration="002_dep_health_findings_tenant_id_and_rls.sql", + access="write", + role="findings", + ), + ModelDbTableDeclaration( + name="instruction_eval_aggregate_snapshots", + database_ref="application", + schema="tenant", + migration="0001_create_instruction_eval_aggregate_snapshots.sql", + access="write", + role="instruction_eval_aggregate", + ), + ModelDbTableDeclaration( + name="pattern_learning_artifacts", + database_ref="application", + schema="tenant", + migration="0000_create_pattern_learning_artifacts.sql", + access="write", + role="artifacts", + ), + ModelDbTableDeclaration( + name="agent_routing_decisions", + database_ref="application", + schema="tenant", + migration="0021_create_agent_routing_decisions.sql", + access="write", + role="agent_routing_decisions", + ), + ModelDbTableDeclaration( + name="skill_execution_snapshots", + database_ref="application", + schema="tenant", + migration="0001_create_skill_execution_snapshots.sql", + access="write", + role="skill_executions_aggregate", + ), +) + + +def test_omn15701_replay_captured_topology_reproduces_the_reverted_grant_failure() -> ( + None +): + """The exact shipped bytes that crash-looped onex-dev, driven through the + real resolver -- proves the captured incident fixture is non-vacuous.""" + from omnibase_core.models.core import ModelDeploymentTopology + + captured = ModelDeploymentTopology.from_yaml(_REVERTED_GRANTS_CAPTURE) + + with pytest.raises(ValueError) as excinfo: + _resolve_projection_database_target((_REVERTED_GRANT_RELATION,), captured) + assert str(excinfo.value) == _REVERTED_GRANT_ERROR + + +def test_omn15701_replay_captured_topology_fails_all_eight_reverted_relations() -> None: + """Every relation infra#2632 silently moved back must fail identically on + the captured (broken) topology -- not just the exemplar above.""" + from omnibase_core.models.core import ModelDeploymentTopology + + captured = ModelDeploymentTopology.from_yaml(_REVERTED_GRANTS_CAPTURE) + + for relation in _REVERTED_GRANT_RELATIONS: + with pytest.raises(ValueError, match="lacks declared write privileges"): + _resolve_projection_database_target((relation,), captured) + + +def test_omn15701_replay_shipped_topology_now_accepts_all_reverted_relations() -> None: + """The nine house-tenant relations resolve cleanly on every shipped profile + now that the tenant_projection_writer grants are restored.""" + for profile in sorted(SUPPORTED_TOPOLOGY_PROFILES): + topology = load_topology_profile(profile) + for relation in _REVERTED_GRANT_RELATIONS: + _resolve_projection_database_target((relation,), topology) + + +def test_omn15701_shipped_grants_restore_nightly_loop_configs_read() -> None: + """infra#2632 also dropped the omninode_runtime SELECT grant on + omninode_internal.nightly_loop_configs that infra#2634 had added; this is + the nightly_loop_controller effects-pod failure recorded on OMN-15655 + comment 4a229dbf. Must be restored alongside the tenant relations.""" + relation = ModelDbTableDeclaration( + name="nightly_loop_configs", + database_ref="application", + schema="omninode_internal", + migration="nightly_loop_configs.sql", + access="read", + role="nightly_loop_controller", + ) + for profile in sorted(SUPPORTED_TOPOLOGY_PROFILES): + _resolve_projection_database_target((relation,), load_topology_profile(profile))