fix(installer): reconcile protected owner grants

[Joncallim]

Summary

The post-migration installer grant refreshed the app role across every public table, including tables owned by Forge protected routine roles. That made the next upgrade reject an otherwise valid durable catalog fingerprint.

This change:

• moves privilege reconciliation into one shared transactional SQL path used by both forge upgrade and forge repair
• classifies the managed native database structurally: postgres or postgresql, literal forge login, nonempty URI-safe password, exact localhost:5432/forge, and no query or fragment suffix
• requires the terminal service_mode value in the install manifest to be native before normal repair can reconcile local privileges
• resolves native installer administration once before provisioning and reuses the same immutable mode, socket, port, user, and command prefix through managed migrations and final privilege reconciliation
• pins every installer and repair administrator call to the native Unix socket and port 5432 with psql -X, explicit user and database arguments, and cleared ambient PostgreSQL routing and credential variables
• uses only the current local superuser or the existing trusted noninteractive postgres operating-system fallback on Linux; custom TCP administrator credentials cannot redirect installer or repair
• guarantees forge repair --dry-run, custom or remote database URLs, missing database URLs, non-native or malformed manifests, and --skip-migrate never invoke the local reconciler
• requires internal installer and repair proof hooks to name their disposable targets explicitly and keeps those values out of normal routing
• verifies the fixed 37-table protected-owner inventory before mutation, then also reconciles any additional table owned by either protected role
• preserves ordinary app table, sequence, and default privileges while removing direct forge table and column grants from protected-owner tables
• restores only non-grantable SELECT on the two local-projection tables
• verifies effective forge table and column authority, rejecting leaked PUBLIC DML, column grants, and projection SELECT even when direct forge ACLs appear canonical
• preserves the canonical owner-granted PUBLIC SELECT exception on the S3 release-state table and unrelated-principal shared-SQL grants that do not confer authority to forge
• keeps exact legacy 0028 classification stricter: every column ACL remains an unknown near-miss and refuses without mutation
• locks every matching pg_class row and live pg_attribute row, so concurrent table and column ACL changes serialize with reconciliation
• accepts a known legacy INHERIT app-role state only when every other role attribute and membership edge is safe, then transactionally hardens it to NOINHERIT
• preserves the documented non-fatal privilege-refresh behavior while allowing unrelated installer PostgreSQL failures to remain fatal
• reports forge upgrade as the correct retry command for upgrade failures

No migration, repair artifact, or search-path contract changed.

Validation

• bash -n for installer, repair, and focused proof scripts
• bash scripts/test-install-managed-migrations.sh
• Full-process fake-PATH installer proof for hostile PostgreSQL environment variables across role/database provisioning, cached managed-migration reuse, and privilege reconciliation; every call asserts explicit -X, socket, port, user, and database arguments
• Full-process routing proof for hostile URL suffixes, malformed credentials, dry-run, missing URL, native-manifest last-value routing, Docker and nonlocal no-call behavior, --skip-migrate, and isolated hook behavior
• git diff --check
• cd web && npm run lint
• cd web && npx tsc --noEmit
• Full disposable PostgreSQL 16 proof for exact 0028 normalization, effective/PUBLIC authority refusal and rollback, strict legacy versus shared column-ACL behavior, canonical rerun, unsafe-role boundaries, races, forced post-grant rollback, and the real pinned installer and repair paths
• Real PostgreSQL 16 installer-managed 0025-to-latest sequence, already-latest rerun, and induced S5 failure cleanup

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 073e0dea3c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[gitguardian]

⚠️ GitGuardian has uncovered 4 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
35676673	Triggered	PostgreSQL Credentials	9fb5c45	scripts/test-install-managed-migrations.sh	View secret
35676674	Triggered	Generic Password	9fb5c45	web/scripts/ci/prove-installer-legacy-migration-repair.sh	View secret
35677352	Triggered	Generic Password	62c8a5e	scripts/test-install-managed-migrations.sh	View secret
35676673	Triggered	PostgreSQL Credentials	62c8a5e	scripts/test-install-managed-migrations.sh	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secrets safely. Learn here the best practices.
3. Revoke and rotate these secrets.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}