[Aliferous3]

Summary

Phase 1C-B1 — the database substrate of the merged ownership checkpoint
architecture (PR #79), gated on the B0.5 pinned-revision spike (PR #80,
verdict PASS).

Migration 013_ownership_checkpointing.sql created — database layer
only. It adds the relations and primitives the crash-safe
multi-invocation history walk requires:

• ownership_scope_versions (RETAINED / CORE) — separates immutable
  base-scope identity from per-version membership at grain
  (scope_id, calculation_version); excluded/exclusion_reason are
  versioned, cardinality_cap-only. Tenant pair and scope/repo pair are
  DB-enforced; the scope FK is exactly ON DELETE NO ACTION.
• ownership_history_work (EPHEMERAL) — per
  scope×version×month×work_key accumulation counters. work_key is
  unlinked or a 64-hex pseudonymous key; no plaintext contributor
  identity, no paths, no provider payloads.
• ownership_contributor_build_work (EPHEMERAL) — build-level
  identity staging for represented keys only ((repository, version, work_key)); synthetic buckets structurally refused; no scope
  provenance column per §5.3.
• ownership_snapshots → ownership_scopes FK re-created ON DELETE NO ACTION (same deployed constraint name/keys) plus a new composite
  ownership_snapshots_scope_version FK
  (scope_id, repository_id, user_id, calculation_version) → ownership_scope_versions NO ACTION: a snapshot cannot exist without
  matching same-repo/same-tenant/same-version membership, while
  repository/account teardown still destroys the complete ownership
  graph in one statement through the direct tenant cascades (proven).
• Primitives — own_checkpoint_page (page delta + durable cursor in
  one CAS transaction; replay returns stale, never double-counts),
  own_restart_scope (staging cleanup by committed-V provenance),
  own_promote_build (exact-set staged≡represented validation before the
  atomic flip + metadata apply), own_abandon_build (the one canonical
  cleanup), own_build_preflight/own_build_init (§5.6c retired-version
  GC gate, split so no third version coexists), own_sweep_stale_work
  (abandon-routed sweep). All SECURITY INVOKER, service_role-only,
  closed OWNERSHIP_INTERNAL_ERROR taxonomy.
• dash_ownership_scopes now enumerates scopes through
  ownership_scope_versions at active_version; building-version
  scopes and exclusion state cannot leak into active output. Same
  signature, grants, invoker model.
• 012→013 upgrade: pre-existing ownership rows are backfilled into
  membership inside 013 before the composite FK validates. Migration 012
  is untouched.
• Backup classification: ownership_scope_versions → CORE (backed
  up); both work tables → EPHEMERAL (never in the dump — a restored
  building version is abandoned, not resumed piecemeal).

Scope

Not in this tranche (still unimplemented, by design): production GitHub
history walking, live object(oid:) traversal, runtime pagination,
ACCUMULATE/RESOLVE worker loops, cron/webhook ownership orchestration,
serverless slicing, live promotion trigger, UI, dashboard launch, feature
flags, backfill, or any production ownership writes.

Production untouched. Migration 013 was applied only to throwaway
local Postgres 17 databases. The production ownership worker is not
wired and no ownership rows were written anywhere but synthetic
scratch databases. .env.local was never used.

Security / privacy impact

• Security/privacy behavior changed and is explained below

• New tables: RLS enabled, zero browser/user policies, service_role
  DML only — same model as 012. New functions: SECURITY INVOKER,
  search_path pinned, EXECUTE revoked from public/anon/
  authenticated, granted to service_role only.

• Privacy: counter rows carry pseudonymous work_key only; identity
  fields (github_node_id, display_login) exist solely in
  represented-key staging + retained contributor rows; synthetic
  unlinked/other can never enter staging. No emails, names,
  databaseIds, paths, commit text, or provider error text anywhere.

• Backup: work tables are backup-excluded (fail-closed classification in
  backup-scope.mjs); restore of a mid-build version routes through the
  canonical abandon primitive — proven in the drill.

Database / deployment impact

• Migration included (013_ownership_checkpointing.sql)
• Environment/configuration change required
• Deployment order matters — apply via the standard db:migrate
  path; 012-era rows are backfilled by the migration itself

Verification

• npm run build
• npm run typecheck
• npm test — 631 pass / 0 fail (3 pre-existing env-gated skips)
• npm audit --audit-level=moderate — 0 vulnerabilities
• SBOM CycloneDX valid
• gitleaks v8.30.1 (worktree + full history) — no leaks
• npm run db:drill — real Postgres 17, full PASS
• Visual QA completed for UI changes — N/A, no UI

Exact real-Postgres integrity tests performed (all inside
npm run db:drill, scripts/ownership-checkpoint-proofs.mjs):

• A–F: snapshot↔membership composite-FK — orphan snapshot, wrong version,
  cross-repo, cross-tenant all rejected by name-checked constraints;
  membership delete blocked by snapshot; legal order succeeds.
• G–I: direct scope delete rejected while referenced; legal
  snapshots→membership→scope prune succeeds.
• J–L: single-statement DELETE FROM repositories / DELETE FROM users
  removes all seven ownership relations including both work tables.
• M–O: building-version scopes/exclusion/identity invisible under
  active-N dash_ownership_scopes.
• P–Q: initial-build abort zeroes V1 artifacts; N→N+1 abort keeps N
  byte-identical, prunes N+1-only contributors/scopes.
• R–T: scope restart removes failed-scope staging (new + existing
  contributors), preserves committed-V-provenanced staging, resets to
  fresh ACCUMULATE.
• U–W: promotion rejects extra and missing staged keys, accepts the
  exact set and applies metadata atomically with the flip.
• X–AA: retired-version rows block init; preflight GC unblocks; forced
  mid-GC failure rolls back atomically and retries cleanly; clean-state
  preflight is a no-op.
• Checkpoint CAS: apply → stale on replay (lost-response safe), stale
  cursor/version rejection with zero writes, additive counters, least/
  greatest timestamp merge, pass transitions, frozen is_bot staging,
  attribution drift fails closed.
• Backup: work tables absent from the archive; ownership_scope_versions
  present; restored building version cleanly abandoned; V1 preserved.
• Upgrade leg: real 001→012 chain + 012-era rows → 013 applies, data
  preserved, membership backfilled, confdeltype='a' on all three FKs.

Test plan

• CI security gate (test/build/audit/SBOM)
• CI gitleaks job
• CI recovery-drill job (postgres:17 service)
• Reviewer: confirm migration 012 file is byte-identical on main

Contributor agreement

• I have read and agree to the Contributor License Agreement for this contribution.

Generated with Devin

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
dev-ledger	Ready	Preview	Oct 19, 2026 1:40pm UTC