Admin / admin / extension
Independently verify the active tab, connection, server, and database before extension intent.
Public-safe SQL proof packet
Show the operator handoff without publishing the scripts.
This checked-in synthetic example makes expected context, prerequisite status, protected handling categories, validation-step presence, stop conditions, gaps, and provenance inspectable before a DBA or operator makes an independent decision.
Public claim level: demo. Derived from sql-operator-runbook-packet/v2 at a public commit with reduced static-analysis coverage. It contains no statement text, protected values, connection details, scheduled command body, or observed database result.
Proof identity
One public fixture, one public commit, one bounded projection.
Repository
joefeser/tracemapCommit
a522705b3b9f331d65ef4e05e723fc4d2d647f08Fixture
samples/sql-operator-runbook/setup.sql · synthetic and repo-relativePacket identity
public-sql-runbook-proof-v1 · public-safe projection, not raw scan outputCoverage
reduced · static analysis only · build not run · runtime observation unavailableOrdered context checkpoints
Every transition is a reason to verify the active client context.
The example uses categorical server, database, schema, and execution-mode roles. It cannot observe which pgAdmin tab or connection is active.
Archive target / archive data / archive
Stop on wrong-tab or wrong-database uncertainty before foreign-server, permission, user-mapping, or schema-import intent.
Source / source data / application
Independently verify the source context before publication intent.
Archive target / archive data / archive
Require owner review at the pg_cron scheduled-context boundary.
Archive target / validation only / archive
Keep validation-step presence separate from any observed result.
Archive target / archive data / archive
Require owner review before a cleanup or rollback-shaped candidate.
PostgreSQL surfaces
The fixture shows some mechanisms and preserves the rest as gaps.
postgres_fdw · illustratedExtension, foreign-server, user-mapping, schema-import, and permission-candidate categories are visible.dblink · missing-evidenceThis fixture does not illustrate extension or call boundaries; absence from the fixture is not a runtime conclusion.Logical replication · partialPublication intent is visible. Subscription evidence is not established, and replication health remains outside static proof.
pg_cron · illustratedExtension and scheduled-operation categories are visible; the scheduled command body is omitted and execution is not observed.Permission prerequisite language
A closed vocabulary keeps checked-in evidence from becoming an authorization claim.
present-in-scriptsCompatible checked-in evidence appears for the illustrated operation; effective permission still requires DBA validation.missing-evidenceCompatible evidence was not established within coverage; runtime absence is not established.conflicting-evidenceStatic grant, revoke, ordering, or context evidence disagrees.unknownIdentity, ordering, parsing, or coverage does not support a stronger status.needs-owner-reviewAdministrative capability, protected handling, or scheduled context requires a named human owner.Protected categories
The packet names the boundary and omits the material.
User mapping
user-mapping and credential-option categories; values omitted.Connection setup
connection-material and credential-option categories; values omitted.Remote input
remote-query-input category; statement content omitted.Scheduled operation
scheduled-command-body category; command content omitted.Intent versus validation
Four columns that never collapse into runtime success.
foreign-serverintended-by-script · milestone validation step not established · validation-evidence-not-providedscheduled-jobintended-by-script · milestone validation step not established · validation-evidence-not-providedvalidationvalidation-step-present · no database result is published or observedcleanup-candidateintended-by-script · completion and reversibility remain unknownEvidence attachment
Every illustrated row can be traced without exposing source text.
Context and validation
database.sql.context.declaration.v1 · Tier2Structural · repo-relative spans · sql-execution-context/0.1.0Protected handling
database.sql.secret-bearing-step.v1 · Tier2Structural · repo-relative spans · sql-secret-safety/0.1.0Permission prerequisites
database.postgres.permission.coverage.v1 · Tier2Structural · complete or reduced coverage · postgres-permission-evidence/0.1.0Archive-link surfaces
database.postgres.archive-link.v1 · Tier2Structural; gaps use Tier4Unknown · postgres-archive-link/0.1.0Stops, gaps, and owners
The packet ends at the point where operator judgment begins.
- Stop at every manual context transition until the active client tab, connection, server, database, schema, and role are independently verified.
- Stop at protected-material boundaries and route handling through the approved owner process.
- Stop on missing, conflicting, unknown, or owner-review permission evidence until a DBA validates the prerequisite candidate.
- Keep
dblink, logical-subscription, archive-link direction, and reduced-coverage gaps visible. - Ask who owns execution order, scheduled-operation review, independent validation, and cleanup review outside TraceMap.
Public claim boundary
This packet supports review questions, not operator authorization.
- It does not execute SQL, connect to a live database, or observe an active database client.
- It does not establish setup completion, effective permissions, object existence, replication health, scheduled execution, validation results, or successful rollback.
- It contains no raw SQL, credentials, connection strings, scheduled command bodies, local paths, private infrastructure names, raw database output, or internal ticket details.
- It does not replace DBA/operator approval, security review, change control, tests, telemetry, logs, or human judgment.
- The core scanner and reducer use no LLM calls, embeddings, vector databases, or prompt-based classification.
Keep the proof attached