{
  "format": "rulemetric-supabase-replay-kit-v1",
  "imageReference": "public.ecr.aws/supabase/postgres@sha256:82a04ba6c05f60950a74ae46be3726abb18d06ee44da936276fd782e72e36855",
  "sources": {
    "__init__.py": {
      "sha256": "ed3b61a97c9741f9862614bc18c8b634239b0f18b31b02820985432c488afe55",
      "content": "\"\"\"Independent Postgres authorization pilot for native subscription harnesses.\"\"\"\n"
    },
    "fixtures.py": {
      "sha256": "13e04472c6fffbaa0712a6eaa625845d690c453d274050c29c9111a0e27f148a",
      "content": "\"\"\"Authored requirements, starting data, and private reference implementations.\n\nThe checker is authored from access requirements, not the candidate skill.\nOnly schema_sql(), task_prompt(), and public documentation enter actor workspaces.\n\"\"\"\nfrom __future__ import annotations\n\nTASKS = (\"tenant-records\", \"document-sharing\", \"public-catalog\")\nUSERS = {name: f\"00000000-0000-0000-0000-{index:012d}\" for index, name in enumerate(\n    (\"owner_a\", \"editor_a\", \"viewer_a\", \"owner_b\", \"outsider\"), 1)}\nORGS = {\"a\": \"10000000-0000-0000-0000-000000000001\", \"b\": \"10000000-0000-0000-0000-000000000002\"}\n\n\ndef schema_sql():\n    return f\"\"\"\nCREATE ROLE migrator LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;\nCREATE ROLE anon LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOBYPASSRLS;\nCREATE ROLE authenticated LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOBYPASSRLS;\nGRANT CREATE ON DATABASE fixture TO migrator;\nREVOKE CREATE ON SCHEMA public FROM PUBLIC;\nGRANT USAGE, CREATE ON SCHEMA public TO migrator;\nGRANT USAGE ON SCHEMA public TO anon, authenticated;\nCREATE SCHEMA auth;\nCREATE FUNCTION auth.uid() RETURNS uuid LANGUAGE sql STABLE AS\n$$ SELECT nullif(current_setting('request.jwt.claim.sub', true), '')::uuid $$;\nGRANT USAGE ON SCHEMA auth TO anon, authenticated, migrator;\nGRANT EXECUTE ON FUNCTION auth.uid() TO anon, authenticated, migrator;\nSET ROLE migrator;\nCREATE TABLE public.organizations(id uuid PRIMARY KEY, name text NOT NULL);\nCREATE TABLE public.memberships(org_id uuid REFERENCES organizations, user_id uuid NOT NULL,\n access text NOT NULL CHECK(access IN ('editor','viewer')), PRIMARY KEY(org_id,user_id));\nCREATE TABLE public.records(id integer PRIMARY KEY, org_id uuid NOT NULL REFERENCES organizations,\n owner_id uuid NOT NULL, body text NOT NULL, published boolean NOT NULL DEFAULT false);\nCREATE TABLE public.shares(record_id integer REFERENCES records ON DELETE CASCADE, user_id uuid NOT NULL,\n active boolean NOT NULL DEFAULT true, PRIMARY KEY(record_id,user_id));\nINSERT INTO organizations VALUES ('{ORGS['a']}','Acme'),('{ORGS['b']}','Birch');\nINSERT INTO memberships VALUES\n ('{ORGS['a']}','{USERS['owner_a']}','editor'),\n ('{ORGS['a']}','{USERS['editor_a']}','editor'),\n ('{ORGS['a']}','{USERS['viewer_a']}','viewer'),\n ('{ORGS['b']}','{USERS['owner_b']}','editor');\nINSERT INTO records VALUES\n (1,'{ORGS['a']}','{USERS['owner_a']}','Acme published',true),\n (2,'{ORGS['a']}','{USERS['owner_a']}','Acme draft',false),\n (3,'{ORGS['b']}','{USERS['owner_b']}','Birch published',true),\n (4,'{ORGS['b']}','{USERS['owner_b']}','Birch draft',false),\n (5,'{ORGS['a']}','{USERS['editor_a']}','Other editor draft',false);\nINSERT INTO shares VALUES (1,'{USERS['outsider']}',true),(2,'{USERS['outsider']}',false);\nRESET ROLE;\n\"\"\"\n\n\nCOMMON = \"\"\"You are changing a small application's PostgreSQL access rules in an isolated fixture.\nUse only the supplied container tool. All files and scratch database are disposable.\nDo not access host services, credentials, other containers, or external networks.\nRead /app/schema.sql and /app/docs first. PostgreSQL is available on the local Unix\nsocket: psql -h /tmp -U migrator -d fixture. This is a non-superuser table-owner migration role.\nClients connect as anon or authenticated. The trusted authentication layer sets\nrequest.jwt.claim.sub; auth.uid() reads it. Do not change auth.uid(), roles, membership\nfacts, existing row identities/content, or create a substitute authentication system.\nClients must never get table ownership, BYPASSRLS, TRUNCATE, role membership, or\naccess to edit organizations/memberships. Use database grants and RLS policies.\nYou may add helper functions/indexes/schemas. Preserve the supplied table/column API.\nThe application accesses the base tables directly, so views alone are insufficient.\nWrite the requested migration file. It is replayed by an independent checker on a\nfresh database as migrator; changes made only to the scratch database are not submitted.\nUse your own checks in scratch. Trusted checker feedback is unavailable during both stages.\n\"\"\"\n\nREQUIREMENTS = {\n    \"tenant-records\": (\n        \"Only editor members of a record's organization may SELECT/INSERT/UPDATE/DELETE that organization's records. \"\n        \"An editor may create a record only with owner_id equal to their identity. An existing record's org_id and owner_id \"\n        \"must not be changed by clients. Users cannot access other organizations even by guessing IDs. \"\n        \"Viewer members, outsiders and anonymous clients have no record access. No client may access shares.\",\n        \"Product change: viewer members can now SELECT their organization's records. They still cannot INSERT/UPDATE/DELETE. \"\n        \"Preserve editor behavior and all isolation/immutable identity requirements. No client may access shares.\"),\n    \"document-sharing\": (\n        \"Authenticated users may SELECT/INSERT/UPDATE/DELETE their own records. For creation they must be editor members \"\n        \"of the target organization and owner_id must equal their identity. Existing org_id and owner_id are immutable. \"\n        \"Other users may SELECT an individually shared record, but never edit/delete it or gain access to neighboring records. \"\n        \"Only the record owner may SELECT/INSERT/UPDATE/DELETE its share rows. For this initial version every share row grants \"\n        \"read access regardless of its active flag. Anonymous clients cannot access records or shares.\",\n        \"Product change: owners revoke sharing by setting shares.active=false or deleting the share. Only active=true share rows \"\n        \"now grant read access. Honor revocation immediately in a new statement. Owners retain access. Recipients cannot \"\n        \"reactivate, create, inspect, change or delete shares. Preserve ownership and creation requirements.\"),\n    \"public-catalog\": (\n        \"Anyone, including anonymous visitors and authenticated outsiders, can SELECT all catalog records for this first public \"\n        \"version, regardless of published. Only editor members can INSERT/UPDATE/DELETE their organization's records. \"\n        \"On INSERT owner_id must equal their identity. Existing org_id and owner_id are immutable. \"\n        \"Viewers have public read access only. Anonymous clients cannot write. No client may access shares.\",\n        \"Product change: unpublished records are now private drafts. Public readers, authenticated outsiders, members of other \"\n        \"organizations and viewers may SELECT only published=true records. Editors may still SELECT all records in their \"\n        \"own organization and manage them, including publishing/unpublishing. Preserve all write and identity restrictions. \"\n        \"Do not delete or rewrite drafts to hide them.\"),\n}\n\n\ndef task_prompt(task, stage, treatment=False):\n    if task not in TASKS or stage not in (1, 2):\n        raise ValueError(\"Unknown scenario/stage\")\n    delivery = (\"\\nThe selected optional Supabase skill is supplied at /app/optional-skill/SKILL.md. \"\n                \"Read it and its relevant reference files before writing SQL.\\n\") if treatment else \"\"\n    filename = f\"00{stage}.sql\"\n    history = (\"Implement the initial access requirements.\\n\" if stage == 1 else\n               \"This is a fresh session. Your prior implementation is in /app/001.sql and has been applied in scratch. \"\n               \"Implement only the new requirements in 002.sql, which runs after 001.sql. You have not been given grading feedback.\\n\")\n    return COMMON + delivery + \"\\n\" + history + REQUIREMENTS[task][0] + (\"\\n\" + REQUIREMENTS[task][1] if stage == 2 else \"\") + f\"\\nSubmit /app/{filename}. End with a brief explanation and checks actually run.\"\n\n\ndef reference_sql(task, stage):\n    \"\"\"Private positive control, never supplied to study actors.\"\"\"\n    setup = \"\"\"\nCREATE SCHEMA IF NOT EXISTS access_helpers;\nREVOKE ALL ON SCHEMA access_helpers FROM PUBLIC;\nGRANT USAGE ON SCHEMA access_helpers TO authenticated;\nCREATE OR REPLACE FUNCTION access_helpers.member_of(org uuid, editor_only boolean)\nRETURNS boolean LANGUAGE sql STABLE SECURITY DEFINER SET search_path=pg_catalog,public AS\n$$ SELECT EXISTS(SELECT 1 FROM public.memberships m WHERE m.org_id=org AND m.user_id=auth.uid()\n AND (NOT editor_only OR m.access='editor')) $$;\nCREATE OR REPLACE FUNCTION access_helpers.owns(rec integer)\nRETURNS boolean LANGUAGE sql STABLE SECURITY DEFINER SET search_path=pg_catalog,public AS\n$$ SELECT EXISTS(SELECT 1 FROM public.records r WHERE r.id=rec AND r.owner_id=auth.uid()) $$;\nCREATE OR REPLACE FUNCTION access_helpers.identity_unchanged(rec integer, org uuid, own uuid)\nRETURNS boolean LANGUAGE sql STABLE SECURITY DEFINER SET search_path=pg_catalog,public AS\n$$ SELECT EXISTS(SELECT 1 FROM public.records r WHERE r.id=rec AND r.org_id=org AND r.owner_id=own) $$;\nCREATE OR REPLACE FUNCTION access_helpers.shared(rec integer, active_only boolean)\nRETURNS boolean LANGUAGE sql STABLE SECURITY DEFINER SET search_path=pg_catalog,public AS\n$$ SELECT EXISTS(SELECT 1 FROM public.shares s WHERE s.record_id=rec AND s.user_id=auth.uid()\n AND (NOT active_only OR s.active)) $$;\nREVOKE ALL ON ALL FUNCTIONS IN SCHEMA access_helpers FROM PUBLIC;\nGRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA access_helpers TO authenticated;\nREVOKE ALL ON organizations,memberships,records,shares FROM anon,authenticated;\nALTER TABLE organizations ENABLE ROW LEVEL SECURITY;\nALTER TABLE memberships ENABLE ROW LEVEL SECURITY;\nALTER TABLE records ENABLE ROW LEVEL SECURITY;\nALTER TABLE shares ENABLE ROW LEVEL SECURITY;\nGRANT SELECT,INSERT,UPDATE,DELETE ON records TO authenticated;\n\"\"\"\n    if stage == 2:\n        setup = \"DROP POLICY read_records ON records;\\n\"\n    if task == \"tenant-records\":\n        read = f\"access_helpers.member_of(org_id, {'true' if stage == 1 else 'false'})\"\n        write = \"access_helpers.member_of(org_id,true)\"\n    elif task == \"document-sharing\":\n        read = f\"owner_id=auth.uid() OR access_helpers.shared(id, {'false' if stage == 1 else 'true'})\"\n        write = \"owner_id=auth.uid()\"\n    else:\n        read = \"true\" if stage == 1 else \"published OR access_helpers.member_of(org_id,true)\"\n        write = \"access_helpers.member_of(org_id,true)\"\n        if stage == 1:\n            setup += \"GRANT SELECT ON records TO anon; GRANT USAGE ON SCHEMA access_helpers TO anon; GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA access_helpers TO anon;\\n\"\n    roles = \"anon,authenticated\" if task == \"public-catalog\" else \"authenticated\"\n    setup += f\"CREATE POLICY read_records ON records FOR SELECT TO {roles} USING ({read});\\n\"\n    if stage == 1:\n        setup += f\"\"\"\nCREATE POLICY insert_records ON records FOR INSERT TO authenticated\n WITH CHECK(access_helpers.member_of(org_id,true) AND owner_id=auth.uid());\nCREATE POLICY update_records ON records FOR UPDATE TO authenticated USING({write})\n WITH CHECK(({write}) AND access_helpers.identity_unchanged(id,org_id,owner_id));\nCREATE POLICY delete_records ON records FOR DELETE TO authenticated USING({write});\n\"\"\"\n        if task == \"document-sharing\":\n            setup += \"\"\"\nGRANT SELECT,INSERT,UPDATE,DELETE ON shares TO authenticated;\nCREATE POLICY own_shares ON shares FOR ALL TO authenticated\n USING(access_helpers.owns(record_id)) WITH CHECK(access_helpers.owns(record_id));\n\"\"\"\n    return setup\n"
    },
    "database.py": {
      "sha256": "4841c172a28a56f203d54b989af054c0efd629c43988ad30372d96df754ea7f7",
      "content": "\"\"\"Owned, network-isolated Postgres boxes. No shared database connections.\"\"\"\nfrom __future__ import annotations\n\nimport asyncio\nimport json\nfrom pathlib import Path\nimport subprocess\nimport time\nfrom types import SimpleNamespace\nimport uuid\n\nDEFAULT_IMAGE = \"public.ecr.aws/supabase/postgres@sha256:82a04ba6c05f60950a74ae46be3726abb18d06ee44da936276fd782e72e36855\"\n\n\nclass Database:\n    def __init__(self, image=DEFAULT_IMAGE, purpose=\"verifier\", unlimited=False):\n        self.image = image\n        self.unlimited = unlimited\n        self.name = \"rm-rls-\" + purpose + \"-\" + uuid.uuid4().hex[:12]\n        self.started = False\n\n    def __enter__(self):\n        command = \"mkdir /tmp/pgdata; initdb -D /tmp/pgdata --auth=trust --no-locale >/tmp/init.log 2>&1 && \" \\\n                  \"pg_ctl -D /tmp/pgdata -l /tmp/pg.log -o \\\"-k /tmp -c listen_addresses='' -c shared_buffers=32MB\\\" -w start && exec sleep infinity\"\n        resources = [] if self.unlimited else [\"--memory\", \"768m\", \"--cpus\", \"1\", \"--pids-limit\", \"192\"]\n        temporary = \"/tmp:rw,mode=1777\" + (\"\" if self.unlimited else \",size=512m\")\n        workspace = \"/app:rw,uid=101,gid=102,mode=0755\" + (\"\" if self.unlimited else \",size=64m\")\n        subprocess.run([\"docker\", \"run\", \"-d\", \"--name\", self.name, \"--label\", \"rulemetric.study=supabase-rls\",\n                        \"--network\", \"none\", \"--cap-drop\", \"ALL\", \"--security-opt\", \"no-new-privileges\",\n                        \"--user\", \"postgres\", \"--read-only\", \"--tmpfs\", temporary,\n                        \"--tmpfs\", workspace, *resources, \"--workdir\", \"/app\", \"--entrypoint\", \"bash\",\n                        self.image, \"-c\", command], check=True, capture_output=True, timeout=30)\n        self.started = True\n        deadline = time.monotonic() + 30\n        while time.monotonic() < deadline:\n            result = subprocess.run([\"docker\", \"exec\", self.name, \"pg_isready\", \"-h\", \"/tmp\"], capture_output=True, timeout=5)\n            if result.returncode == 0:\n                break\n            time.sleep(.2)\n        else:\n            self.__exit__(None, None, None)\n            raise RuntimeError(\"Owned PostgreSQL did not become ready\")\n        self.sql(\"CREATE DATABASE fixture\", database=\"postgres\", check=True)\n        return self\n\n    def __exit__(self, *_args):\n        if self.started:\n            subprocess.run([\"docker\", \"rm\", \"-f\", self.name], check=True, capture_output=True, timeout=30)\n            self.started = False\n\n    def sql(self, sql, role=\"postgres\", database=\"fixture\", check=False):\n        result = subprocess.run([\"docker\", \"exec\", \"-i\", self.name, \"psql\", \"-X\", \"-q\", \"-A\", \"-t\",\n                                 \"-v\", \"ON_ERROR_STOP=1\", \"-h\", \"/tmp\", \"-U\", role, \"-d\", database],\n                                input=(\"\" if self.unlimited else \"SET statement_timeout='5s'; SET lock_timeout='2s';\\n\") + sql,\n                                text=True, capture_output=True, timeout=None if self.unlimited else 15)\n        if check and result.returncode:\n            raise RuntimeError(result.stderr[-4000:])\n        return result\n\n    def put(self, target, content):\n        if not target.startswith(\"/app/\") or \"..\" in Path(target).parts:\n            raise ValueError(\"Actor file is outside its workspace\")\n        result = subprocess.run([\"docker\", \"exec\", \"-i\", self.name, \"python3\", \"-c\",\n                                 \"import sys;from pathlib import Path;p=Path(sys.argv[1]);p.parent.mkdir(parents=True,exist_ok=True);p.write_bytes(sys.stdin.buffer.read())\", target],\n                                input=content if isinstance(content, bytes) else content.encode(), capture_output=True, timeout=10)\n        if result.returncode:\n            raise RuntimeError(\"Owned actor file write failed\")\n\n    def get(self, target):\n        result = subprocess.run([\"docker\", \"exec\", self.name, \"python3\", \"-c\",\n                                 \"import sys;from pathlib import Path;p=Path(sys.argv[1]);assert p.is_file() and not p.is_symlink();sys.stdout.buffer.write(p.read_bytes())\", target],\n                                capture_output=True, timeout=10)\n        if result.returncode:\n            raise RuntimeError(\"Expected ordinary migration file is missing or oversized\")\n        return result.stdout.decode(\"utf-8\")\n\n    async def exec(self, command, timeout_sec=120, cwd=None, **_kwargs):\n        result = await asyncio.to_thread(subprocess.run, [\"docker\", \"exec\", \"-w\", cwd or \"/app\", self.name,\n                                                         \"bash\", \"-c\", command], capture_output=True, text=True, timeout=timeout_sec)\n        return SimpleNamespace(return_code=result.returncode, stdout=result.stdout, stderr=result.stderr)\n"
    },
    "grader.py": {
      "sha256": "94cafe8ad11a88750f521b5cdb3a6bc66d58e2505490be4e5410bde75bc2c98a",
      "content": "\"\"\"Trusted role-level checks, never mounted into actor environments.\"\"\"\nfrom __future__ import annotations\n\nfrom .database import Database\nfrom .fixtures import TASKS, USERS, ORGS, schema_sql\n\n\ndef check(db, name, query, expected=None, user=None, role=\"authenticated\", denied=False):\n    identity = USERS.get(user, \"\")\n    result = db.sql(f\"BEGIN; SET LOCAL request.jwt.claim.sub='{identity}';\\n{query}\\nROLLBACK;\", role=role)\n    lines = result.stdout.strip().splitlines()\n    # Permission-denied is a legitimate access refusal; syntax errors and broken\n    # helpers must never masquerade as a successful negative authorization test.\n    refused = result.returncode != 0 and any(message in result.stderr for message in (\n        \"permission denied\", \"violates row-level security policy\"))\n    actual = lines[-1] if lines else \"\"\n    passed = (refused or (result.returncode == 0 and actual == \"0\")) if denied else result.returncode == 0 and actual == expected\n    return {\"name\": name, \"passed\": passed, \"returncode\": result.returncode,\n            \"actual\": actual, \"expected\": \"refused or zero rows\" if denied else expected,\n            \"stderr\": result.stderr[-2000:]}\n\n\ndef checks(db, task, stage):\n    rows = []\n    def read(name, user, ids, role=\"authenticated\"):\n        rows.append(check(db, name, \"SELECT coalesce(string_agg(id::text,',' ORDER BY id),'') FROM public.records;\",\n                          expected=ids, user=user, role=role))\n    def write(name, user, statement, allow=False, role=\"authenticated\"):\n        rows.append(check(db, name, f\"WITH changed AS ({statement} RETURNING 1) SELECT count(*) FROM changed;\",\n                          expected=\"1\" if allow else None, user=user, role=role, denied=not allow))\n    if task == \"tenant-records\":\n        read(\"editor sees own organization\", \"editor_a\", \"1,2,5\")\n        read(\"other tenant sees own organization\", \"owner_b\", \"3,4\")\n        if stage == 2:\n            read(\"viewer reads own organization\", \"viewer_a\", \"1,2,5\")\n        else:\n            rows.append(check(db, \"viewer has no initial read\", \"SELECT count(*) FROM records;\", user=\"viewer_a\", denied=True))\n        for user in (\"owner_a\", \"editor_a\"):\n            write(\"editor update \" + user, user, \"UPDATE records SET body='updated' WHERE id=1\", True)\n            write(\"editor delete \" + user, user, \"DELETE FROM records WHERE id=5\", True)\n        write(\"viewer cannot edit\", \"viewer_a\", \"UPDATE records SET body='bad' WHERE id=1\")\n        write(\"viewer cannot delete\", \"viewer_a\", \"DELETE FROM records WHERE id=1\")\n        rows.append(check(db, \"outsider has no read\", \"SELECT count(*) FROM records;\", user=\"outsider\", denied=True))\n    elif task == \"document-sharing\":\n        read(\"owner retains both documents\", \"owner_a\", \"1,2\")\n        read(\"other owner isolated\", \"owner_b\", \"3,4\")\n        read(\"recipient receives only selected shares\", \"outsider\", \"1,2\" if stage == 1 else \"1\")\n        read(\"unshared editor sees own document only\", \"editor_a\", \"5\")\n        write(\"owner updates own document\", \"owner_a\", \"UPDATE records SET body='updated' WHERE id=1\", True)\n        write(\"owner deletes own unshared document\", \"owner_a\", \"DELETE FROM records WHERE id=2\", True)\n        write(\"recipient cannot edit\", \"outsider\", \"UPDATE records SET body='bad' WHERE id=1\")\n        write(\"recipient cannot delete\", \"outsider\", \"DELETE FROM records WHERE id=1\")\n        write(\"peer cannot edit owner's document\", \"editor_a\", \"UPDATE records SET body='bad' WHERE id=1\")\n        write(\"owner may create share\", \"owner_a\", f\"INSERT INTO shares VALUES(2,'{USERS['viewer_a']}',true)\", True)\n        write(\"owner may deactivate share\", \"owner_a\", \"UPDATE shares SET active=false WHERE record_id=1\", True)\n        write(\"owner may remove share\", \"owner_a\", \"DELETE FROM shares WHERE record_id=1\", True)\n        for statement, label in ((f\"INSERT INTO shares VALUES(1,'{USERS['viewer_a']}',true)\", \"create\"),\n                                 (\"UPDATE shares SET active=true WHERE record_id=2\", \"reactivate\"),\n                                 (\"DELETE FROM shares WHERE record_id=1\", \"delete\")):\n            write(\"recipient cannot \" + label + \" shares\", \"outsider\", statement)\n        rows.append(check(db, \"recipient cannot inspect shares\", \"SELECT count(*) FROM shares;\", user=\"outsider\", denied=True))\n        if stage == 2:\n            # Real revocation transitions are performed as the owner in the same\n            # transaction, followed by a newly authenticated recipient statement.\n            for action in (\"UPDATE shares SET active=false WHERE record_id=1;\", \"DELETE FROM shares WHERE record_id=1;\"):\n                sql = f\"\"\"BEGIN; SET LOCAL ROLE authenticated; SET LOCAL request.jwt.claim.sub='{USERS['owner_a']}';\n{action}\nSET LOCAL request.jwt.claim.sub='{USERS['outsider']}'; SELECT count(*) FROM records WHERE id=1;\nROLLBACK;\"\"\"\n                result = db.sql(sql)\n                rows.append({\"name\": \"immediate revocation: \" + action.split()[0], \"passed\": result.returncode == 0 and result.stdout.strip() == \"0\",\n                             \"actual\": result.stdout.strip(), \"stderr\": result.stderr[-2000:]})\n    else:\n        read(\"editor sees own drafts and public rows\", \"editor_a\", \"1,2,3,4,5\" if stage == 1 else \"1,2,3,5\")\n        read(\"other editor sees own drafts and public rows\", \"owner_b\", \"1,2,3,4,5\" if stage == 1 else \"1,3,4\")\n        for user in (\"outsider\", \"viewer_a\"):\n            read(user + \" public reads\", user, \"1,2,3,4,5\" if stage == 1 else \"1,3\")\n        read(\"anonymous public reads\", None, \"1,2,3,4,5\" if stage == 1 else \"1,3\", role=\"anon\")\n        write(\"editor may publish draft\", \"editor_a\", \"UPDATE records SET published=true WHERE id=2\", True)\n        write(\"editor may unpublish record\", \"editor_a\", \"UPDATE records SET published=false WHERE id=1\", True)\n        write(\"editor may delete own organization draft\", \"editor_a\", \"DELETE FROM records WHERE id=5\", True)\n        write(\"viewer cannot edit\", \"viewer_a\", \"UPDATE records SET body='bad' WHERE id=1\")\n        write(\"outsider cannot edit\", \"outsider\", \"UPDATE records SET body='bad' WHERE id=1\")\n    for label, user, role in ((\"anonymous\", None, \"anon\"), (\"missing identity\", None, \"authenticated\")):\n        if task != \"public-catalog\":\n            rows.append(check(db, label + \" cannot read\", \"SELECT count(*) FROM records;\", user=user, role=role, denied=True))\n        write(label + \" cannot insert\", user,\n              f\"INSERT INTO records VALUES(90,'{ORGS['a']}','{USERS['owner_a']}','bad',false)\", role=role)\n        write(label + \" cannot update\", user, \"UPDATE records SET body='bad' WHERE id=1\", role=role)\n        write(label + \" cannot delete\", user, \"DELETE FROM records WHERE id=1\", role=role)\n    write(\"editor inserts own record\", \"editor_a\", f\"INSERT INTO records VALUES(90,'{ORGS['a']}','{USERS['editor_a']}','new',false)\", True)\n    write(\"editor cannot insert into other tenant\", \"editor_a\", f\"INSERT INTO records VALUES(90,'{ORGS['b']}','{USERS['editor_a']}','bad',false)\")\n    write(\"editor cannot forge owner\", \"editor_a\", f\"INSERT INTO records VALUES(90,'{ORGS['a']}','{USERS['owner_a']}','bad',false)\")\n    write(\"viewer cannot insert\", \"viewer_a\", f\"INSERT INTO records VALUES(90,'{ORGS['a']}','{USERS['viewer_a']}','bad',false)\")\n    write(\"outsider cannot insert\", \"outsider\", f\"INSERT INTO records VALUES(90,'{ORGS['a']}','{USERS['outsider']}','bad',false)\")\n    write(\"cannot update foreign tenant\", \"owner_a\", \"UPDATE records SET body='bad' WHERE id=3\")\n    write(\"cannot delete foreign tenant\", \"owner_a\", \"DELETE FROM records WHERE id=4\")\n    write(\"cannot move existing record to another tenant\", \"owner_a\", f\"UPDATE records SET org_id='{ORGS['b']}' WHERE id=1\")\n    write(\"cannot reassign existing owner\", \"owner_a\", f\"UPDATE records SET owner_id='{USERS['outsider']}' WHERE id=1\")\n    for user in (\"owner_a\", \"viewer_a\", \"outsider\"):\n        write(user + \" cannot self-promote\", user, \"UPDATE memberships SET access='editor'\")\n        write(user + \" cannot alter organizations\", user, \"UPDATE organizations SET name='bad'\")\n    if task != \"document-sharing\":\n        rows.append(check(db, \"shares remain private\", \"SELECT count(*) FROM shares;\", user=\"owner_a\", denied=True))\n    guard = db.sql(\"\"\"SELECT bool_and(NOT rolsuper AND NOT rolbypassrls AND NOT rolcreaterole)\nFROM pg_roles WHERE rolname IN ('anon','authenticated');\nSELECT count(*) FROM pg_auth_members m JOIN pg_roles r ON r.oid=m.member WHERE r.rolname IN ('anon','authenticated');\nSELECT bool_and(NOT has_table_privilege(r,t,'TRUNCATE')) FROM (VALUES('anon'),('authenticated')) x(r)\nCROSS JOIN (VALUES('records'),('shares'),('memberships'),('organizations')) y(t);\nSELECT string_agg(id::text||':'||body,',' ORDER BY id) FROM records;\"\"\", check=True)\n    rows.append({\"name\": \"role attributes, membership, truncate and original data preserved\", \"passed\": guard.stdout.strip().splitlines() == [\n        \"t\", \"0\", \"t\", \"1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft\"], \"actual\": guard.stdout.strip()})\n    return rows\n\n\ndef grade(image, task, migrations):\n    if task not in TASKS or len(migrations) not in (1, 2):\n        raise ValueError(\"Unknown task/stage\")\n    with Database(image, \"verifier\") as db:\n        db.sql(schema_sql(), check=True)\n        snapshot_query = \"SELECT jsonb_build_object(\" + \",\".join(\n            \"'\" + table + \"',(SELECT jsonb_agg(to_jsonb(t) ORDER BY to_jsonb(t)::text) FROM public.\" + table + \" t)\"\n            for table in (\"records\", \"shares\", \"memberships\", \"organizations\")) + \");\"\n        before = db.sql(snapshot_query, check=True).stdout\n        for index, migration in enumerate(migrations, 1):\n            applied = db.sql(migration, role=\"migrator\")\n            if applied.returncode:\n                return {\"passed\": False, \"migrationApplied\": False, \"failedMigration\": index,\n                        \"stderr\": applied.stderr[-4000:], \"checks\": []}\n        try:\n            rows = checks(db, task, len(migrations))\n            after = db.sql(snapshot_query, check=True).stdout\n            rows.append({\"name\": \"all starting rows preserved exactly\", \"passed\": before == after})\n            return {\"passed\": all(row[\"passed\"] for row in rows), \"migrationApplied\": True, \"checks\": rows,\n                    \"passedChecks\": sum(row[\"passed\"] for row in rows), \"totalChecks\": len(rows)}\n        except Exception as error:\n            return {\"passed\": False, \"migrationApplied\": True, \"checkerError\": str(error), \"checks\": []}\n"
    },
    "grader_corrected.py": {
      "sha256": "3f5625746f70dbb2ef7dd006c57abb569fb473fbb4fa98a6e2b477289a7a845d",
      "content": "\"\"\"Trusted role-level checks, never mounted into actor environments.\"\"\"\nfrom __future__ import annotations\n\nimport re\n\nfrom .database import Database\nfrom .fixtures import TASKS, USERS, ORGS, schema_sql\n\n\ndef check(db, name, query, expected=None, user=None, role=\"authenticated\", denied=False):\n    identity = USERS.get(user, \"\")\n    result = db.sql(f\"\\\\set VERBOSITY verbose\\nBEGIN; SET LOCAL request.jwt.claim.sub='{identity}';\\n{query}\\nROLLBACK;\", role=role)\n    lines = result.stdout.strip().splitlines()\n    # Permission-denied is a legitimate access refusal; syntax errors and broken\n    # helpers must never masquerade as a successful negative authorization test.\n    refused = result.returncode != 0 and any(message in result.stderr for message in (\n        \"permission denied\", \"violates row-level security policy\"))\n    # Post-hoc correction: a PL/pgSQL RAISE EXCEPTION is a valid way to\n    # reject immutable identity updates. Restrict this allowance to the two\n    # identity mutation probes, explicit denial SQLSTATEs and a RAISE context. Ordinary\n    # permitted UPDATEs must still pass; syntax and broken-helper errors fail.\n    custom_identity_denial = (denied and name in (\n        \"cannot move existing record to another tenant\", \"cannot reassign existing owner\")\n        and result.returncode != 0 and re.search(r\"ERROR:\\s+(?:P0001|42501|23514):\", result.stderr) is not None\n        and \"at RAISE\" in result.stderr)\n    refused = refused or custom_identity_denial\n    actual = lines[-1] if lines else \"\"\n    passed = (refused or (result.returncode == 0 and actual == \"0\")) if denied else result.returncode == 0 and actual == expected\n    return {\"name\": name, \"passed\": passed, \"returncode\": result.returncode,\n            \"actual\": actual, \"expected\": \"refused or zero rows\" if denied else expected,\n            \"stderr\": result.stderr[-2000:]}\n\n\ndef checks(db, task, stage):\n    rows = []\n    def read(name, user, ids, role=\"authenticated\"):\n        rows.append(check(db, name, \"SELECT coalesce(string_agg(id::text,',' ORDER BY id),'') FROM public.records;\",\n                          expected=ids, user=user, role=role))\n    def write(name, user, statement, allow=False, role=\"authenticated\"):\n        rows.append(check(db, name, f\"WITH changed AS ({statement} RETURNING 1) SELECT count(*) FROM changed;\",\n                          expected=\"1\" if allow else None, user=user, role=role, denied=not allow))\n    if task == \"tenant-records\":\n        read(\"editor sees own organization\", \"editor_a\", \"1,2,5\")\n        read(\"other tenant sees own organization\", \"owner_b\", \"3,4\")\n        if stage == 2:\n            read(\"viewer reads own organization\", \"viewer_a\", \"1,2,5\")\n        else:\n            rows.append(check(db, \"viewer has no initial read\", \"SELECT count(*) FROM records;\", user=\"viewer_a\", denied=True))\n        for user in (\"owner_a\", \"editor_a\"):\n            write(\"editor update \" + user, user, \"UPDATE records SET body='updated' WHERE id=1\", True)\n            write(\"editor delete \" + user, user, \"DELETE FROM records WHERE id=5\", True)\n        write(\"viewer cannot edit\", \"viewer_a\", \"UPDATE records SET body='bad' WHERE id=1\")\n        write(\"viewer cannot delete\", \"viewer_a\", \"DELETE FROM records WHERE id=1\")\n        rows.append(check(db, \"outsider has no read\", \"SELECT count(*) FROM records;\", user=\"outsider\", denied=True))\n    elif task == \"document-sharing\":\n        read(\"owner retains both documents\", \"owner_a\", \"1,2\")\n        read(\"other owner isolated\", \"owner_b\", \"3,4\")\n        read(\"recipient receives only selected shares\", \"outsider\", \"1,2\" if stage == 1 else \"1\")\n        read(\"unshared editor sees own document only\", \"editor_a\", \"5\")\n        write(\"owner updates own document\", \"owner_a\", \"UPDATE records SET body='updated' WHERE id=1\", True)\n        write(\"owner deletes own unshared document\", \"owner_a\", \"DELETE FROM records WHERE id=2\", True)\n        write(\"recipient cannot edit\", \"outsider\", \"UPDATE records SET body='bad' WHERE id=1\")\n        write(\"recipient cannot delete\", \"outsider\", \"DELETE FROM records WHERE id=1\")\n        write(\"peer cannot edit owner's document\", \"editor_a\", \"UPDATE records SET body='bad' WHERE id=1\")\n        write(\"owner may create share\", \"owner_a\", f\"INSERT INTO shares VALUES(2,'{USERS['viewer_a']}',true)\", True)\n        write(\"owner may deactivate share\", \"owner_a\", \"UPDATE shares SET active=false WHERE record_id=1\", True)\n        write(\"owner may remove share\", \"owner_a\", \"DELETE FROM shares WHERE record_id=1\", True)\n        for statement, label in ((f\"INSERT INTO shares VALUES(1,'{USERS['viewer_a']}',true)\", \"create\"),\n                                 (\"UPDATE shares SET active=true WHERE record_id=2\", \"reactivate\"),\n                                 (\"DELETE FROM shares WHERE record_id=1\", \"delete\")):\n            write(\"recipient cannot \" + label + \" shares\", \"outsider\", statement)\n        rows.append(check(db, \"recipient cannot inspect shares\", \"SELECT count(*) FROM shares;\", user=\"outsider\", denied=True))\n        if stage == 2:\n            # Real revocation transitions are performed as the owner in the same\n            # transaction, followed by a newly authenticated recipient statement.\n            for action in (\"UPDATE shares SET active=false WHERE record_id=1;\", \"DELETE FROM shares WHERE record_id=1;\"):\n                sql = f\"\"\"BEGIN; SET LOCAL ROLE authenticated; SET LOCAL request.jwt.claim.sub='{USERS['owner_a']}';\n{action}\nSET LOCAL request.jwt.claim.sub='{USERS['outsider']}'; SELECT count(*) FROM records WHERE id=1;\nROLLBACK;\"\"\"\n                result = db.sql(sql)\n                rows.append({\"name\": \"immediate revocation: \" + action.split()[0], \"passed\": result.returncode == 0 and result.stdout.strip() == \"0\",\n                             \"actual\": result.stdout.strip(), \"stderr\": result.stderr[-2000:]})\n    else:\n        read(\"editor sees own drafts and public rows\", \"editor_a\", \"1,2,3,4,5\" if stage == 1 else \"1,2,3,5\")\n        read(\"other editor sees own drafts and public rows\", \"owner_b\", \"1,2,3,4,5\" if stage == 1 else \"1,3,4\")\n        for user in (\"outsider\", \"viewer_a\"):\n            read(user + \" public reads\", user, \"1,2,3,4,5\" if stage == 1 else \"1,3\")\n        read(\"anonymous public reads\", None, \"1,2,3,4,5\" if stage == 1 else \"1,3\", role=\"anon\")\n        write(\"editor may publish draft\", \"editor_a\", \"UPDATE records SET published=true WHERE id=2\", True)\n        write(\"editor may unpublish record\", \"editor_a\", \"UPDATE records SET published=false WHERE id=1\", True)\n        write(\"editor may delete own organization draft\", \"editor_a\", \"DELETE FROM records WHERE id=5\", True)\n        write(\"viewer cannot edit\", \"viewer_a\", \"UPDATE records SET body='bad' WHERE id=1\")\n        write(\"outsider cannot edit\", \"outsider\", \"UPDATE records SET body='bad' WHERE id=1\")\n    for label, user, role in ((\"anonymous\", None, \"anon\"), (\"missing identity\", None, \"authenticated\")):\n        if task != \"public-catalog\":\n            rows.append(check(db, label + \" cannot read\", \"SELECT count(*) FROM records;\", user=user, role=role, denied=True))\n        write(label + \" cannot insert\", user,\n              f\"INSERT INTO records VALUES(90,'{ORGS['a']}','{USERS['owner_a']}','bad',false)\", role=role)\n        write(label + \" cannot update\", user, \"UPDATE records SET body='bad' WHERE id=1\", role=role)\n        write(label + \" cannot delete\", user, \"DELETE FROM records WHERE id=1\", role=role)\n    write(\"editor inserts own record\", \"editor_a\", f\"INSERT INTO records VALUES(90,'{ORGS['a']}','{USERS['editor_a']}','new',false)\", True)\n    write(\"editor cannot insert into other tenant\", \"editor_a\", f\"INSERT INTO records VALUES(90,'{ORGS['b']}','{USERS['editor_a']}','bad',false)\")\n    write(\"editor cannot forge owner\", \"editor_a\", f\"INSERT INTO records VALUES(90,'{ORGS['a']}','{USERS['owner_a']}','bad',false)\")\n    write(\"viewer cannot insert\", \"viewer_a\", f\"INSERT INTO records VALUES(90,'{ORGS['a']}','{USERS['viewer_a']}','bad',false)\")\n    write(\"outsider cannot insert\", \"outsider\", f\"INSERT INTO records VALUES(90,'{ORGS['a']}','{USERS['outsider']}','bad',false)\")\n    write(\"cannot update foreign tenant\", \"owner_a\", \"UPDATE records SET body='bad' WHERE id=3\")\n    write(\"cannot delete foreign tenant\", \"owner_a\", \"DELETE FROM records WHERE id=4\")\n    write(\"cannot move existing record to another tenant\", \"owner_a\", f\"UPDATE records SET org_id='{ORGS['b']}' WHERE id=1\")\n    write(\"cannot reassign existing owner\", \"owner_a\", f\"UPDATE records SET owner_id='{USERS['outsider']}' WHERE id=1\")\n    for user in (\"owner_a\", \"viewer_a\", \"outsider\"):\n        write(user + \" cannot self-promote\", user, \"UPDATE memberships SET access='editor'\")\n        write(user + \" cannot alter organizations\", user, \"UPDATE organizations SET name='bad'\")\n    if task != \"document-sharing\":\n        rows.append(check(db, \"shares remain private\", \"SELECT count(*) FROM shares;\", user=\"owner_a\", denied=True))\n    guard = db.sql(\"\"\"SELECT bool_and(NOT rolsuper AND NOT rolbypassrls AND NOT rolcreaterole)\nFROM pg_roles WHERE rolname IN ('anon','authenticated');\nSELECT count(*) FROM pg_auth_members m JOIN pg_roles r ON r.oid=m.member WHERE r.rolname IN ('anon','authenticated');\nSELECT bool_and(NOT has_table_privilege(r,t,'TRUNCATE')) FROM (VALUES('anon'),('authenticated')) x(r)\nCROSS JOIN (VALUES('records'),('shares'),('memberships'),('organizations')) y(t);\nSELECT string_agg(id::text||':'||body,',' ORDER BY id) FROM records;\"\"\", check=True)\n    rows.append({\"name\": \"role attributes, membership, truncate and original data preserved\", \"passed\": guard.stdout.strip().splitlines() == [\n        \"t\", \"0\", \"t\", \"1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft\"], \"actual\": guard.stdout.strip()})\n    return rows\n\n\ndef grade(image, task, migrations):\n    if task not in TASKS or len(migrations) not in (1, 2):\n        raise ValueError(\"Unknown task/stage\")\n    with Database(image, \"verifier\") as db:\n        db.sql(schema_sql(), check=True)\n        snapshot_query = \"SELECT jsonb_build_object(\" + \",\".join(\n            \"'\" + table + \"',(SELECT jsonb_agg(to_jsonb(t) ORDER BY to_jsonb(t)::text) FROM public.\" + table + \" t)\"\n            for table in (\"records\", \"shares\", \"memberships\", \"organizations\")) + \");\"\n        before = db.sql(snapshot_query, check=True).stdout\n        for index, migration in enumerate(migrations, 1):\n            applied = db.sql(migration, role=\"migrator\")\n            if applied.returncode:\n                return {\"passed\": False, \"migrationApplied\": False, \"failedMigration\": index,\n                        \"stderr\": applied.stderr[-4000:], \"checks\": []}\n        try:\n            rows = checks(db, task, len(migrations))\n            after = db.sql(snapshot_query, check=True).stdout\n            rows.append({\"name\": \"all starting rows preserved exactly\", \"passed\": before == after})\n            return {\"passed\": all(row[\"passed\"] for row in rows), \"migrationApplied\": True, \"checks\": rows,\n                    \"passedChecks\": sum(row[\"passed\"] for row in rows), \"totalChecks\": len(rows)}\n        except Exception as error:\n            return {\"passed\": False, \"migrationApplied\": True, \"checkerError\": str(error), \"checks\": []}\n"
    }
  },
  "schema": "\nCREATE ROLE migrator LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;\nCREATE ROLE anon LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOBYPASSRLS;\nCREATE ROLE authenticated LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOBYPASSRLS;\nGRANT CREATE ON DATABASE fixture TO migrator;\nREVOKE CREATE ON SCHEMA public FROM PUBLIC;\nGRANT USAGE, CREATE ON SCHEMA public TO migrator;\nGRANT USAGE ON SCHEMA public TO anon, authenticated;\nCREATE SCHEMA auth;\nCREATE FUNCTION auth.uid() RETURNS uuid LANGUAGE sql STABLE AS\n$$ SELECT nullif(current_setting('request.jwt.claim.sub', true), '')::uuid $$;\nGRANT USAGE ON SCHEMA auth TO anon, authenticated, migrator;\nGRANT EXECUTE ON FUNCTION auth.uid() TO anon, authenticated, migrator;\nSET ROLE migrator;\nCREATE TABLE public.organizations(id uuid PRIMARY KEY, name text NOT NULL);\nCREATE TABLE public.memberships(org_id uuid REFERENCES organizations, user_id uuid NOT NULL,\n access text NOT NULL CHECK(access IN ('editor','viewer')), PRIMARY KEY(org_id,user_id));\nCREATE TABLE public.records(id integer PRIMARY KEY, org_id uuid NOT NULL REFERENCES organizations,\n owner_id uuid NOT NULL, body text NOT NULL, published boolean NOT NULL DEFAULT false);\nCREATE TABLE public.shares(record_id integer REFERENCES records ON DELETE CASCADE, user_id uuid NOT NULL,\n active boolean NOT NULL DEFAULT true, PRIMARY KEY(record_id,user_id));\nINSERT INTO organizations VALUES ('10000000-0000-0000-0000-000000000001','Acme'),('10000000-0000-0000-0000-000000000002','Birch');\nINSERT INTO memberships VALUES\n ('10000000-0000-0000-0000-000000000001','00000000-0000-0000-0000-000000000001','editor'),\n ('10000000-0000-0000-0000-000000000001','00000000-0000-0000-0000-000000000002','editor'),\n ('10000000-0000-0000-0000-000000000001','00000000-0000-0000-0000-000000000003','viewer'),\n ('10000000-0000-0000-0000-000000000002','00000000-0000-0000-0000-000000000004','editor');\nINSERT INTO records VALUES\n (1,'10000000-0000-0000-0000-000000000001','00000000-0000-0000-0000-000000000001','Acme published',true),\n (2,'10000000-0000-0000-0000-000000000001','00000000-0000-0000-0000-000000000001','Acme draft',false),\n (3,'10000000-0000-0000-0000-000000000002','00000000-0000-0000-0000-000000000004','Birch published',true),\n (4,'10000000-0000-0000-0000-000000000002','00000000-0000-0000-0000-000000000004','Birch draft',false),\n (5,'10000000-0000-0000-0000-000000000001','00000000-0000-0000-0000-000000000002','Other editor draft',false);\nINSERT INTO shares VALUES (1,'00000000-0000-0000-0000-000000000005',true),(2,'00000000-0000-0000-0000-000000000005',false);\nRESET ROLE;\n",
  "taskPrompts": {
    "tenant-records/1/baseline": "You are changing a small application's PostgreSQL access rules in an isolated fixture.\nUse only the supplied container tool. All files and scratch database are disposable.\nDo not access host services, credentials, other containers, or external networks.\nRead /app/schema.sql and /app/docs first. PostgreSQL is available on the local Unix\nsocket: psql -h /tmp -U migrator -d fixture. This is a non-superuser table-owner migration role.\nClients connect as anon or authenticated. The trusted authentication layer sets\nrequest.jwt.claim.sub; auth.uid() reads it. Do not change auth.uid(), roles, membership\nfacts, existing row identities/content, or create a substitute authentication system.\nClients must never get table ownership, BYPASSRLS, TRUNCATE, role membership, or\naccess to edit organizations/memberships. Use database grants and RLS policies.\nYou may add helper functions/indexes/schemas. Preserve the supplied table/column API.\nThe application accesses the base tables directly, so views alone are insufficient.\nWrite the requested migration file. It is replayed by an independent checker on a\nfresh database as migrator; changes made only to the scratch database are not submitted.\nUse your own checks in scratch. Trusted checker feedback is unavailable during both stages.\n\nImplement the initial access requirements.\nOnly editor members of a record's organization may SELECT/INSERT/UPDATE/DELETE that organization's records. An editor may create a record only with owner_id equal to their identity. An existing record's org_id and owner_id must not be changed by clients. Users cannot access other organizations even by guessing IDs. Viewer members, outsiders and anonymous clients have no record access. No client may access shares.\nSubmit /app/001.sql. End with a brief explanation and checks actually run.",
    "tenant-records/1/skill": "You are changing a small application's PostgreSQL access rules in an isolated fixture.\nUse only the supplied container tool. All files and scratch database are disposable.\nDo not access host services, credentials, other containers, or external networks.\nRead /app/schema.sql and /app/docs first. PostgreSQL is available on the local Unix\nsocket: psql -h /tmp -U migrator -d fixture. This is a non-superuser table-owner migration role.\nClients connect as anon or authenticated. The trusted authentication layer sets\nrequest.jwt.claim.sub; auth.uid() reads it. Do not change auth.uid(), roles, membership\nfacts, existing row identities/content, or create a substitute authentication system.\nClients must never get table ownership, BYPASSRLS, TRUNCATE, role membership, or\naccess to edit organizations/memberships. Use database grants and RLS policies.\nYou may add helper functions/indexes/schemas. Preserve the supplied table/column API.\nThe application accesses the base tables directly, so views alone are insufficient.\nWrite the requested migration file. It is replayed by an independent checker on a\nfresh database as migrator; changes made only to the scratch database are not submitted.\nUse your own checks in scratch. Trusted checker feedback is unavailable during both stages.\n\nThe selected optional Supabase skill is supplied at /app/optional-skill/SKILL.md. Read it and its relevant reference files before writing SQL.\n\nImplement the initial access requirements.\nOnly editor members of a record's organization may SELECT/INSERT/UPDATE/DELETE that organization's records. An editor may create a record only with owner_id equal to their identity. An existing record's org_id and owner_id must not be changed by clients. Users cannot access other organizations even by guessing IDs. Viewer members, outsiders and anonymous clients have no record access. No client may access shares.\nSubmit /app/001.sql. End with a brief explanation and checks actually run.",
    "tenant-records/2/baseline": "You are changing a small application's PostgreSQL access rules in an isolated fixture.\nUse only the supplied container tool. All files and scratch database are disposable.\nDo not access host services, credentials, other containers, or external networks.\nRead /app/schema.sql and /app/docs first. PostgreSQL is available on the local Unix\nsocket: psql -h /tmp -U migrator -d fixture. This is a non-superuser table-owner migration role.\nClients connect as anon or authenticated. The trusted authentication layer sets\nrequest.jwt.claim.sub; auth.uid() reads it. Do not change auth.uid(), roles, membership\nfacts, existing row identities/content, or create a substitute authentication system.\nClients must never get table ownership, BYPASSRLS, TRUNCATE, role membership, or\naccess to edit organizations/memberships. Use database grants and RLS policies.\nYou may add helper functions/indexes/schemas. Preserve the supplied table/column API.\nThe application accesses the base tables directly, so views alone are insufficient.\nWrite the requested migration file. It is replayed by an independent checker on a\nfresh database as migrator; changes made only to the scratch database are not submitted.\nUse your own checks in scratch. Trusted checker feedback is unavailable during both stages.\n\nThis is a fresh session. Your prior implementation is in /app/001.sql and has been applied in scratch. Implement only the new requirements in 002.sql, which runs after 001.sql. You have not been given grading feedback.\nOnly editor members of a record's organization may SELECT/INSERT/UPDATE/DELETE that organization's records. An editor may create a record only with owner_id equal to their identity. An existing record's org_id and owner_id must not be changed by clients. Users cannot access other organizations even by guessing IDs. Viewer members, outsiders and anonymous clients have no record access. No client may access shares.\nProduct change: viewer members can now SELECT their organization's records. They still cannot INSERT/UPDATE/DELETE. Preserve editor behavior and all isolation/immutable identity requirements. No client may access shares.\nSubmit /app/002.sql. End with a brief explanation and checks actually run.",
    "tenant-records/2/skill": "You are changing a small application's PostgreSQL access rules in an isolated fixture.\nUse only the supplied container tool. All files and scratch database are disposable.\nDo not access host services, credentials, other containers, or external networks.\nRead /app/schema.sql and /app/docs first. PostgreSQL is available on the local Unix\nsocket: psql -h /tmp -U migrator -d fixture. This is a non-superuser table-owner migration role.\nClients connect as anon or authenticated. The trusted authentication layer sets\nrequest.jwt.claim.sub; auth.uid() reads it. Do not change auth.uid(), roles, membership\nfacts, existing row identities/content, or create a substitute authentication system.\nClients must never get table ownership, BYPASSRLS, TRUNCATE, role membership, or\naccess to edit organizations/memberships. Use database grants and RLS policies.\nYou may add helper functions/indexes/schemas. Preserve the supplied table/column API.\nThe application accesses the base tables directly, so views alone are insufficient.\nWrite the requested migration file. It is replayed by an independent checker on a\nfresh database as migrator; changes made only to the scratch database are not submitted.\nUse your own checks in scratch. Trusted checker feedback is unavailable during both stages.\n\nThe selected optional Supabase skill is supplied at /app/optional-skill/SKILL.md. Read it and its relevant reference files before writing SQL.\n\nThis is a fresh session. Your prior implementation is in /app/001.sql and has been applied in scratch. Implement only the new requirements in 002.sql, which runs after 001.sql. You have not been given grading feedback.\nOnly editor members of a record's organization may SELECT/INSERT/UPDATE/DELETE that organization's records. An editor may create a record only with owner_id equal to their identity. An existing record's org_id and owner_id must not be changed by clients. Users cannot access other organizations even by guessing IDs. Viewer members, outsiders and anonymous clients have no record access. No client may access shares.\nProduct change: viewer members can now SELECT their organization's records. They still cannot INSERT/UPDATE/DELETE. Preserve editor behavior and all isolation/immutable identity requirements. No client may access shares.\nSubmit /app/002.sql. End with a brief explanation and checks actually run.",
    "document-sharing/1/baseline": "You are changing a small application's PostgreSQL access rules in an isolated fixture.\nUse only the supplied container tool. All files and scratch database are disposable.\nDo not access host services, credentials, other containers, or external networks.\nRead /app/schema.sql and /app/docs first. PostgreSQL is available on the local Unix\nsocket: psql -h /tmp -U migrator -d fixture. This is a non-superuser table-owner migration role.\nClients connect as anon or authenticated. The trusted authentication layer sets\nrequest.jwt.claim.sub; auth.uid() reads it. Do not change auth.uid(), roles, membership\nfacts, existing row identities/content, or create a substitute authentication system.\nClients must never get table ownership, BYPASSRLS, TRUNCATE, role membership, or\naccess to edit organizations/memberships. Use database grants and RLS policies.\nYou may add helper functions/indexes/schemas. Preserve the supplied table/column API.\nThe application accesses the base tables directly, so views alone are insufficient.\nWrite the requested migration file. It is replayed by an independent checker on a\nfresh database as migrator; changes made only to the scratch database are not submitted.\nUse your own checks in scratch. Trusted checker feedback is unavailable during both stages.\n\nImplement the initial access requirements.\nAuthenticated users may SELECT/INSERT/UPDATE/DELETE their own records. For creation they must be editor members of the target organization and owner_id must equal their identity. Existing org_id and owner_id are immutable. Other users may SELECT an individually shared record, but never edit/delete it or gain access to neighboring records. Only the record owner may SELECT/INSERT/UPDATE/DELETE its share rows. For this initial version every share row grants read access regardless of its active flag. Anonymous clients cannot access records or shares.\nSubmit /app/001.sql. End with a brief explanation and checks actually run.",
    "document-sharing/1/skill": "You are changing a small application's PostgreSQL access rules in an isolated fixture.\nUse only the supplied container tool. All files and scratch database are disposable.\nDo not access host services, credentials, other containers, or external networks.\nRead /app/schema.sql and /app/docs first. PostgreSQL is available on the local Unix\nsocket: psql -h /tmp -U migrator -d fixture. This is a non-superuser table-owner migration role.\nClients connect as anon or authenticated. The trusted authentication layer sets\nrequest.jwt.claim.sub; auth.uid() reads it. Do not change auth.uid(), roles, membership\nfacts, existing row identities/content, or create a substitute authentication system.\nClients must never get table ownership, BYPASSRLS, TRUNCATE, role membership, or\naccess to edit organizations/memberships. Use database grants and RLS policies.\nYou may add helper functions/indexes/schemas. Preserve the supplied table/column API.\nThe application accesses the base tables directly, so views alone are insufficient.\nWrite the requested migration file. It is replayed by an independent checker on a\nfresh database as migrator; changes made only to the scratch database are not submitted.\nUse your own checks in scratch. Trusted checker feedback is unavailable during both stages.\n\nThe selected optional Supabase skill is supplied at /app/optional-skill/SKILL.md. Read it and its relevant reference files before writing SQL.\n\nImplement the initial access requirements.\nAuthenticated users may SELECT/INSERT/UPDATE/DELETE their own records. For creation they must be editor members of the target organization and owner_id must equal their identity. Existing org_id and owner_id are immutable. Other users may SELECT an individually shared record, but never edit/delete it or gain access to neighboring records. Only the record owner may SELECT/INSERT/UPDATE/DELETE its share rows. For this initial version every share row grants read access regardless of its active flag. Anonymous clients cannot access records or shares.\nSubmit /app/001.sql. End with a brief explanation and checks actually run.",
    "document-sharing/2/baseline": "You are changing a small application's PostgreSQL access rules in an isolated fixture.\nUse only the supplied container tool. All files and scratch database are disposable.\nDo not access host services, credentials, other containers, or external networks.\nRead /app/schema.sql and /app/docs first. PostgreSQL is available on the local Unix\nsocket: psql -h /tmp -U migrator -d fixture. This is a non-superuser table-owner migration role.\nClients connect as anon or authenticated. The trusted authentication layer sets\nrequest.jwt.claim.sub; auth.uid() reads it. Do not change auth.uid(), roles, membership\nfacts, existing row identities/content, or create a substitute authentication system.\nClients must never get table ownership, BYPASSRLS, TRUNCATE, role membership, or\naccess to edit organizations/memberships. Use database grants and RLS policies.\nYou may add helper functions/indexes/schemas. Preserve the supplied table/column API.\nThe application accesses the base tables directly, so views alone are insufficient.\nWrite the requested migration file. It is replayed by an independent checker on a\nfresh database as migrator; changes made only to the scratch database are not submitted.\nUse your own checks in scratch. Trusted checker feedback is unavailable during both stages.\n\nThis is a fresh session. Your prior implementation is in /app/001.sql and has been applied in scratch. Implement only the new requirements in 002.sql, which runs after 001.sql. You have not been given grading feedback.\nAuthenticated users may SELECT/INSERT/UPDATE/DELETE their own records. For creation they must be editor members of the target organization and owner_id must equal their identity. Existing org_id and owner_id are immutable. Other users may SELECT an individually shared record, but never edit/delete it or gain access to neighboring records. Only the record owner may SELECT/INSERT/UPDATE/DELETE its share rows. For this initial version every share row grants read access regardless of its active flag. Anonymous clients cannot access records or shares.\nProduct change: owners revoke sharing by setting shares.active=false or deleting the share. Only active=true share rows now grant read access. Honor revocation immediately in a new statement. Owners retain access. Recipients cannot reactivate, create, inspect, change or delete shares. Preserve ownership and creation requirements.\nSubmit /app/002.sql. End with a brief explanation and checks actually run.",
    "document-sharing/2/skill": "You are changing a small application's PostgreSQL access rules in an isolated fixture.\nUse only the supplied container tool. All files and scratch database are disposable.\nDo not access host services, credentials, other containers, or external networks.\nRead /app/schema.sql and /app/docs first. PostgreSQL is available on the local Unix\nsocket: psql -h /tmp -U migrator -d fixture. This is a non-superuser table-owner migration role.\nClients connect as anon or authenticated. The trusted authentication layer sets\nrequest.jwt.claim.sub; auth.uid() reads it. Do not change auth.uid(), roles, membership\nfacts, existing row identities/content, or create a substitute authentication system.\nClients must never get table ownership, BYPASSRLS, TRUNCATE, role membership, or\naccess to edit organizations/memberships. Use database grants and RLS policies.\nYou may add helper functions/indexes/schemas. Preserve the supplied table/column API.\nThe application accesses the base tables directly, so views alone are insufficient.\nWrite the requested migration file. It is replayed by an independent checker on a\nfresh database as migrator; changes made only to the scratch database are not submitted.\nUse your own checks in scratch. Trusted checker feedback is unavailable during both stages.\n\nThe selected optional Supabase skill is supplied at /app/optional-skill/SKILL.md. Read it and its relevant reference files before writing SQL.\n\nThis is a fresh session. Your prior implementation is in /app/001.sql and has been applied in scratch. Implement only the new requirements in 002.sql, which runs after 001.sql. You have not been given grading feedback.\nAuthenticated users may SELECT/INSERT/UPDATE/DELETE their own records. For creation they must be editor members of the target organization and owner_id must equal their identity. Existing org_id and owner_id are immutable. Other users may SELECT an individually shared record, but never edit/delete it or gain access to neighboring records. Only the record owner may SELECT/INSERT/UPDATE/DELETE its share rows. For this initial version every share row grants read access regardless of its active flag. Anonymous clients cannot access records or shares.\nProduct change: owners revoke sharing by setting shares.active=false or deleting the share. Only active=true share rows now grant read access. Honor revocation immediately in a new statement. Owners retain access. Recipients cannot reactivate, create, inspect, change or delete shares. Preserve ownership and creation requirements.\nSubmit /app/002.sql. End with a brief explanation and checks actually run.",
    "public-catalog/1/baseline": "You are changing a small application's PostgreSQL access rules in an isolated fixture.\nUse only the supplied container tool. All files and scratch database are disposable.\nDo not access host services, credentials, other containers, or external networks.\nRead /app/schema.sql and /app/docs first. PostgreSQL is available on the local Unix\nsocket: psql -h /tmp -U migrator -d fixture. This is a non-superuser table-owner migration role.\nClients connect as anon or authenticated. The trusted authentication layer sets\nrequest.jwt.claim.sub; auth.uid() reads it. Do not change auth.uid(), roles, membership\nfacts, existing row identities/content, or create a substitute authentication system.\nClients must never get table ownership, BYPASSRLS, TRUNCATE, role membership, or\naccess to edit organizations/memberships. Use database grants and RLS policies.\nYou may add helper functions/indexes/schemas. Preserve the supplied table/column API.\nThe application accesses the base tables directly, so views alone are insufficient.\nWrite the requested migration file. It is replayed by an independent checker on a\nfresh database as migrator; changes made only to the scratch database are not submitted.\nUse your own checks in scratch. Trusted checker feedback is unavailable during both stages.\n\nImplement the initial access requirements.\nAnyone, including anonymous visitors and authenticated outsiders, can SELECT all catalog records for this first public version, regardless of published. Only editor members can INSERT/UPDATE/DELETE their organization's records. On INSERT owner_id must equal their identity. Existing org_id and owner_id are immutable. Viewers have public read access only. Anonymous clients cannot write. No client may access shares.\nSubmit /app/001.sql. End with a brief explanation and checks actually run.",
    "public-catalog/1/skill": "You are changing a small application's PostgreSQL access rules in an isolated fixture.\nUse only the supplied container tool. All files and scratch database are disposable.\nDo not access host services, credentials, other containers, or external networks.\nRead /app/schema.sql and /app/docs first. PostgreSQL is available on the local Unix\nsocket: psql -h /tmp -U migrator -d fixture. This is a non-superuser table-owner migration role.\nClients connect as anon or authenticated. The trusted authentication layer sets\nrequest.jwt.claim.sub; auth.uid() reads it. Do not change auth.uid(), roles, membership\nfacts, existing row identities/content, or create a substitute authentication system.\nClients must never get table ownership, BYPASSRLS, TRUNCATE, role membership, or\naccess to edit organizations/memberships. Use database grants and RLS policies.\nYou may add helper functions/indexes/schemas. Preserve the supplied table/column API.\nThe application accesses the base tables directly, so views alone are insufficient.\nWrite the requested migration file. It is replayed by an independent checker on a\nfresh database as migrator; changes made only to the scratch database are not submitted.\nUse your own checks in scratch. Trusted checker feedback is unavailable during both stages.\n\nThe selected optional Supabase skill is supplied at /app/optional-skill/SKILL.md. Read it and its relevant reference files before writing SQL.\n\nImplement the initial access requirements.\nAnyone, including anonymous visitors and authenticated outsiders, can SELECT all catalog records for this first public version, regardless of published. Only editor members can INSERT/UPDATE/DELETE their organization's records. On INSERT owner_id must equal their identity. Existing org_id and owner_id are immutable. Viewers have public read access only. Anonymous clients cannot write. No client may access shares.\nSubmit /app/001.sql. End with a brief explanation and checks actually run.",
    "public-catalog/2/baseline": "You are changing a small application's PostgreSQL access rules in an isolated fixture.\nUse only the supplied container tool. All files and scratch database are disposable.\nDo not access host services, credentials, other containers, or external networks.\nRead /app/schema.sql and /app/docs first. PostgreSQL is available on the local Unix\nsocket: psql -h /tmp -U migrator -d fixture. This is a non-superuser table-owner migration role.\nClients connect as anon or authenticated. The trusted authentication layer sets\nrequest.jwt.claim.sub; auth.uid() reads it. Do not change auth.uid(), roles, membership\nfacts, existing row identities/content, or create a substitute authentication system.\nClients must never get table ownership, BYPASSRLS, TRUNCATE, role membership, or\naccess to edit organizations/memberships. Use database grants and RLS policies.\nYou may add helper functions/indexes/schemas. Preserve the supplied table/column API.\nThe application accesses the base tables directly, so views alone are insufficient.\nWrite the requested migration file. It is replayed by an independent checker on a\nfresh database as migrator; changes made only to the scratch database are not submitted.\nUse your own checks in scratch. Trusted checker feedback is unavailable during both stages.\n\nThis is a fresh session. Your prior implementation is in /app/001.sql and has been applied in scratch. Implement only the new requirements in 002.sql, which runs after 001.sql. You have not been given grading feedback.\nAnyone, including anonymous visitors and authenticated outsiders, can SELECT all catalog records for this first public version, regardless of published. Only editor members can INSERT/UPDATE/DELETE their organization's records. On INSERT owner_id must equal their identity. Existing org_id and owner_id are immutable. Viewers have public read access only. Anonymous clients cannot write. No client may access shares.\nProduct change: unpublished records are now private drafts. Public readers, authenticated outsiders, members of other organizations and viewers may SELECT only published=true records. Editors may still SELECT all records in their own organization and manage them, including publishing/unpublishing. Preserve all write and identity restrictions. Do not delete or rewrite drafts to hide them.\nSubmit /app/002.sql. End with a brief explanation and checks actually run.",
    "public-catalog/2/skill": "You are changing a small application's PostgreSQL access rules in an isolated fixture.\nUse only the supplied container tool. All files and scratch database are disposable.\nDo not access host services, credentials, other containers, or external networks.\nRead /app/schema.sql and /app/docs first. PostgreSQL is available on the local Unix\nsocket: psql -h /tmp -U migrator -d fixture. This is a non-superuser table-owner migration role.\nClients connect as anon or authenticated. The trusted authentication layer sets\nrequest.jwt.claim.sub; auth.uid() reads it. Do not change auth.uid(), roles, membership\nfacts, existing row identities/content, or create a substitute authentication system.\nClients must never get table ownership, BYPASSRLS, TRUNCATE, role membership, or\naccess to edit organizations/memberships. Use database grants and RLS policies.\nYou may add helper functions/indexes/schemas. Preserve the supplied table/column API.\nThe application accesses the base tables directly, so views alone are insufficient.\nWrite the requested migration file. It is replayed by an independent checker on a\nfresh database as migrator; changes made only to the scratch database are not submitted.\nUse your own checks in scratch. Trusted checker feedback is unavailable during both stages.\n\nThe selected optional Supabase skill is supplied at /app/optional-skill/SKILL.md. Read it and its relevant reference files before writing SQL.\n\nThis is a fresh session. Your prior implementation is in /app/001.sql and has been applied in scratch. Implement only the new requirements in 002.sql, which runs after 001.sql. You have not been given grading feedback.\nAnyone, including anonymous visitors and authenticated outsiders, can SELECT all catalog records for this first public version, regardless of published. Only editor members can INSERT/UPDATE/DELETE their organization's records. On INSERT owner_id must equal their identity. Existing org_id and owner_id are immutable. Viewers have public read access only. Anonymous clients cannot write. No client may access shares.\nProduct change: unpublished records are now private drafts. Public readers, authenticated outsiders, members of other organizations and viewers may SELECT only published=true records. Editors may still SELECT all records in their own organization and manage them, including publishing/unpublishing. Preserve all write and identity restrictions. Do not delete or rewrite drafts to hide them.\nSubmit /app/002.sql. End with a brief explanation and checks actually run."
  },
  "candidate": {
    "repository": "https://github.com/supabase/agent-skills",
    "commit": "c9be0e931b7930f7d02126d04774d904c381e7d7",
    "skill": "supabase-postgres-best-practices",
    "hashes": {
      "CHANGELOG.md": "751ad110037c85d400018c9894716a04fa46357ff55c22b1169b280752e19e88",
      "SKILL.md": "ad65e776f45e761bafc609d3f506c77c1032225aa65e0c4c02f241b8071e5855",
      "references/_contributing.md": "191e039e7d94764e6073410b513b559f9a594e0fdf0252a30c2a2986df2ab3bc",
      "references/_sections.md": "c9e992612b422c7122de0b7542ebc2450db283edaab08cfe86c6d657fcccccd5",
      "references/_template.md": "6299954250f212caabe339d752c3e5313a8e07d1a182a4e4b425baee91df1bd2",
      "references/advanced-full-text-search.md": "40c2606bbb4c4dce31308f201b24cc7f58c7df05b1d9c6856fe2b888d3b7cf28",
      "references/advanced-jsonb-indexing.md": "24cacf6a8bc35901dd566d24502ce8e57f810a5c196b897e61d52726e521d106",
      "references/conn-idle-timeout.md": "630588902c00fcec59a5988cc5d042f76dcf2c923a535abfd8c47dca205eaed5",
      "references/conn-limits.md": "11b2a67a7c7679cbbc5d807bbb17e69c98484a581d0c8b929c03408f412b81b2",
      "references/conn-pooling.md": "88cf086bf98ba865d2e9d0579974e1366b14157619d6a93e7da77be91084e4a5",
      "references/conn-prepared-statements.md": "174e9332fe3dda5c99b2b00159fb1915ae36c00bab3a7882c14e73e4344e946e",
      "references/data-batch-inserts.md": "531933b82d6a622d0fae29e0ea80be6fe5d78655adf2804c271ea84a1930de37",
      "references/data-n-plus-one.md": "21a44905e5b16a42741892ec34bb1bfef124d049b140a76934a9acd0f46f5fc2",
      "references/data-pagination.md": "73c9fa10a3d439bedea0e11b640bd25bf30dd50f0d9006cf85baf7c3151543fa",
      "references/data-upsert.md": "2612af83b20a2701dde30ef1f8d7efd26b7e9eef84717226b8f038a2d2150ff7",
      "references/lock-advisory.md": "c88d259dbf81c3771438f59a165f7eab8acd09999dd370bdf807521c73f35aab",
      "references/lock-deadlock-prevention.md": "09aee46f51d7178c8e55fe056cd5a94a64ba2c122fe418e6900cd99f297b2347",
      "references/lock-short-transactions.md": "5aa7f61095916986d39644b446cdbcd2bacca7ef698a3bb50b3f82dd60207602",
      "references/lock-skip-locked.md": "6c45077f430f29cd9cd8f448c94d578e827e7bd023fcdaf717a756acb116fa4b",
      "references/monitor-explain-analyze.md": "4cb67ffbf8e57f2e5b380b0beb4242528b513723ce314a2c2ffcf083bd4203d7",
      "references/monitor-pg-stat-statements.md": "89dca99d4e894fcbdcac136be7ad9fbc03d1342904f065c1b198dc9cf495f098",
      "references/monitor-vacuum-analyze.md": "2892272011710eb49b3f185ec12f15ce9ce4c365792c672f6e2a9c90da426a1a",
      "references/query-composite-indexes.md": "73e42424e671f0266e74fdb220db3196790f69fb43e2b19c7b9483eb4971b554",
      "references/query-covering-indexes.md": "daf2a7f0477fb7357b62b5fb5b185b1995a77a186347e45cb780e25e7a7589b6",
      "references/query-index-types.md": "472a74f22c2df203bd0154999b3a5a0187cca2ab3d9a3978e305bb7c32f1a282",
      "references/query-missing-indexes.md": "91ad8b0ff4365704b4830a7f077c6f140f7140fd5d3ce5cd0b92b160cf9e25f1",
      "references/query-partial-indexes.md": "6448982bc8558c6555284958edc331b29239c6a0130e6b4501dd6d4da607a6dd",
      "references/schema-constraints.md": "90e8efda3e9e81095e642911ad4aae2809d160f29414338fa997253238f510f8",
      "references/schema-data-types.md": "e01b58c14c7f3f65d8ead580b9a4fcf70b83baaab0f9a5f83c569c9fd113e8c8",
      "references/schema-foreign-key-indexes.md": "7587713d12a65a212365459b3d39e4717d8a79e4073b10bd62f1054d8192c0dd",
      "references/schema-lowercase-identifiers.md": "4bc80f70865f2390872591f326c8a6be6456a0aeb5a7e5a2475d7cd9d43059ab",
      "references/schema-partitioning.md": "541e13fbeaf4bb1485c9059d4c9417dbdb766cf16f4237cd63a04ada7ec45b90",
      "references/schema-primary-keys.md": "3c8beabef82066f9a0838b926da0885117fd2d9a263aaf84cb5ca9e5f0d400e9",
      "references/security-privileges.md": "095909274a4fb43df785d7144cf674eeb40284d2d45628f14af4108737b93663",
      "references/security-rls-basics.md": "e04dd1a3a382aafdaaa73fe9f7976352acdde6e90c2a2470d281b94d4f44b096",
      "references/security-rls-performance.md": "2e1faeca7d5746e246b1c78f9492fe2a9cfa41c4d7fa1e23c402d58fa18ea014"
    }
  },
  "documentationHashes": {
    "postgres-17-rls.html": "4a192371e7ca0227a41ed822a46b6b25cee7cb43ece298b291264452481c9ee2",
    "supabase-rls.md": "b0b81f8b7f72e8fbd9e83314b9e4d1b658827754bfe9d469e0ec3a243a0029c0"
  },
  "documentationSources": [
    "https://supabase.com/docs/guides/database/postgres/row-level-security",
    "https://www.postgresql.org/docs/17/ddl-rowsecurity.html"
  ],
  "notes": "Executable fixture/checker and submitted SQL replay. Native actor adapters/transcripts are retained privately; this kit does not reproduce model sampling or access subscriptions. Candidate and documentation bytes are identified by hashes and original source links, not redistributed."
}